Why the April 28 Collapse Matters More Than It Seems
The Digital AI Omnibus package, proposed by the European Commission on November 19, 2025, was designed to defer the AI Act’s high-risk compliance obligations — originally scheduled for August 2, 2026 — to December 2, 2027 for standalone systems and August 2, 2028 for AI embedded in regulated products. For most enterprises, this proposed deferral had functioned as an unofficial grace period: compliance preparation proceeded at a measured pace, assuming the extension would pass before the August deadline.
The April 28 trilogue was the second political-level negotiation between the European Parliament, the Council, and the Commission. It collapsed. The specific sticking point was whether AI systems embedded in regulated products — medical devices, toy safety systems, industrial machinery, connected vehicles — should be carved out of AI Act requirements because they already fall under sectoral safety regulations. The European Parliament and major industry groups pushed for these carve-outs; the Council opposed them as potentially deregulatory rather than simplifying.
A third meeting was scheduled for mid-May. The critical problem: even if the third meeting reaches agreement on the carve-out language, the formal legislative process requires publication in the Official Journal of the EU and a minimum notice period before new provisions take effect. The legal expert consensus, as expressed by DLA Piper’s Brussels practice in April 2026, is that formal adoption before August 2 is “impractical.” The original AI Act, as written, becomes enforceable on August 2, 2026 for Annex III high-risk systems — with no Omnibus extension in force.
The European Commission’s own language in its April 2026 guidance reinforced this: it told organizations to “continue compliance preparations in line with the existing deadline of 2 August 2026 rather than waiting for the proposed deferral.”
What Annex III Actually Requires by August 2
The Annex III high-risk classification covers eight categories where AI is used in decisions that significantly affect individuals. For private-sector enterprises, the two broadest categories are employment AI and financial services AI.
Employment AI (Annex III, Category 4): Any AI system used in recruitment and candidate selection, CV screening, performance evaluation, task allocation or monitoring, promotion or termination decisions, and worker monitoring — if these outputs affect employment decisions — is high-risk. This captures automated applicant tracking systems, AI-assisted interview scoring, predictive performance management, and workforce analytics platforms.
Financial services AI (Annex III, Category 5): Credit scoring, insurance risk evaluation, and benefits eligibility determination are high-risk. A bank’s AI model scoring loan applications is high-risk. An insurer’s telematics-based pricing model is high-risk if it affects coverage eligibility decisions.
Biometrics (Annex III, Category 1): Any AI using biometric identification or emotion recognition in real-time or post-hoc contexts is high-risk (with narrow exemptions). This captures facial recognition in office building access control, emotion-inference tools in customer service, and identity verification systems.
For each high-risk system, enterprises must complete — by August 2, 2026:
- Risk Management System: Documented lifecycle risk identification, estimation, evaluation, and mitigation procedures
- Technical Documentation: Complete system specifications covering design, training data, testing methodology, and post-deployment monitoring
- Automatic Logging: Minimum 6-month immutable operation logs enabling incident reconstruction
- Human Oversight Protocol: Named personnel with authority to monitor, intervene in, and override the AI system
- Conformity Assessment: Self-assessment for most categories; third-party mandatory for biometric identification systems
- EU Database Registration: Public pre-deployment registration via the EUDAMED-equivalent AI database
Advertisement
A 12-Week Compliance Roadmap for Enterprise Teams
1. Conduct the Annex III Inventory Audit Now — Not in July
Start with a full inventory of all AI systems your organization deploys or provides to others. Map each against the eight Annex III categories. Many organizations significantly underestimate their Annex III exposure because AI is embedded in software they did not build themselves — a third-party HR platform with AI screening, a banking core with AI credit scoring, a building management system with behavioral analytics. Map every system, including third-party tools where you are the deployer.
This inventory is not a one-person job. It requires input from HR (employment AI), Finance and Lending (financial services AI), Facilities (biometrics), IT Security (AI in monitoring tools), and Legal. Many organizations discover their first three to five high-risk systems during this audit that they had not previously identified. The IAPP’s April 2026 guidance suggests this inventory takes two weeks for mid-sized organizations and four to six weeks for large multinationals.
2. Distinguish Provider Obligations from Deployer Obligations
The AI Act creates asymmetric obligations depending on whether you are the provider (built the AI system) or the deployer (using a third-party AI system). Providers carry the heavier burden — they must produce technical documentation, conformity assessments, and register in the EU database before placing the system on the market. Deployers must follow provider instructions, assign qualified oversight personnel, monitor for performance drift, and report serious incidents.
For most large enterprises, both roles apply simultaneously: you are a deployer for third-party tools and a provider for internally-built AI systems. Do not assume that using a vendor’s AI product means the vendor bears all compliance responsibility. If you customize, fine-tune, or modify a third-party AI system to a degree that changes its intended purpose or risk profile, you become a provider for that system under Article 25.
3. Prioritize the Documentation Gap — It Is the Most Common Failure Mode
According to the ComplianceHub analysis published April 25, 2026, the three compliance elements most commonly lagging among enterprises preparing for August 2 are: technical documentation (particularly training data provenance and testing methodology), automatic logging infrastructure, and human oversight protocols. Risk management systems and conformity assessments are more advanced because they are analogous to ISO 27001 and ISO 31000 frameworks that many organizations already follow.
If you must triage: documentation and logging are the fastest-moving items to fix. Technical documentation for a well-understood system can be produced in four to six weeks with adequate internal resources or external counsel. Automatic logging is an engineering task that takes two to four weeks if infrastructure already captures relevant data. Human oversight protocols require HR and legal alignment but can be drafted and approved in three to four weeks.
The Failure Scenario: What August 2 Without Preparation Means
For organizations that have not completed conformity assessments and EU database registration by August 2, the AI Act’s enforcement mechanism activates immediately. There is no grace period, no voluntary disclosure reduction, and no minimum threshold before national competent authorities can investigate.
The penalty structure is:
- Prohibited AI practices (Annex I): Up to €35 million or 7% of global annual turnover
- High-risk AI violations (Annex III non-compliance): Up to €15 million or 3% of global annual turnover
- Incorrect or misleading information to authorities: Up to €7.5 million or 1.5%
The highest-risk scenario for enterprises: deploying an AI employment screening system that has not completed conformity assessment, with incomplete technical documentation, and no immutable logging. This combination — which describes many currently-deployed applicant tracking systems — exposes the organization to €15 million or 3% penalties beginning August 3, 2026.
The Omnibus package, if eventually adopted, would retroactively restructure these obligations. But retroactive relief after enforcement has begun is not guaranteed, and enforcement timelines vary by member state — Germany, France, and the Netherlands have indicated they will activate their AI supervisory authorities immediately at the August 2 trigger.
Frequently Asked Questions
Does the EU AI Act apply to Algerian companies that sell AI software to European clients?
Yes. The AI Act applies extraterritorially when AI systems are placed on the EU market or when their outputs affect EU residents, regardless of where the provider is incorporated. An Algerian SaaS company that sells an AI-powered recruitment tool to a French HR department is a “provider” under the AI Act if the system falls within Annex III categories. It must produce technical documentation, complete conformity assessment, and register in the EU AI database before the French customer can legally deploy it.
What happens if the EU Digital Omnibus is adopted after August 2, 2026 — does it retroactively protect non-compliant companies?
Retroactive protection is not guaranteed and depends on the Omnibus’s transitional provisions, which are still being negotiated. If enforcement has already begun by the time the Omnibus is formally adopted, organizations under active investigation are unlikely to benefit from retrospective relief. The legally safe position, as of May 2026, is to treat August 2 as the real compliance deadline.
What is the difference between Annex III high-risk systems and Annex I prohibited AI systems?
Annex I (prohibited practices) covers AI that poses unacceptable risks regardless of use case: mass social scoring by public authorities, real-time remote biometric identification by law enforcement in public spaces (with narrow exceptions), and AI systems that exploit psychological vulnerabilities. These are banned outright. Annex III (high-risk) covers AI in specific high-stakes domains — employment, education, biometrics, critical infrastructure, financial services, law enforcement — that is permitted but subject to strict requirements: documentation, oversight, conformity assessment, and registration. The fine maximum for Annex III violations (€15M or 3%) is lower than for Annex I (€35M or 7%) but still significant.
—
Sources & Further Reading
- EU AI Act Omnibus: What Just Happened and What Comes Next — IAPP
- The Digital AI Omnibus: Proposed Deferral of High-Risk AI Obligations — DLA Piper
- EU AI Act August 2026 Deadline: Annex III High-Risk Compliance Guide — ComplianceHub
- EU AI Act Omnibus Deal Fails April 2026 Talks — The Next Web
- EU AI Act Official Text (Regulation 2024/1689) — EUR-Lex
