EU AI Act August 2026: What Actually Changes, and What Was Delayed to 2027

Following the Digital Omnibus, Annex III high-risk obligations are fixed at 2 December 2027. That is -- days from now. Regulated financial institutions deploying high-risk AI systems need more than a compliance plan by then. They need a tamper-evident audit trail that can answer a regulator on demand — and the time to build it is not 2027.

What the Digital Omnibus Changed

On 29 June 2026, the Council of the EU gave final adoption to the Digital Omnibus package, deferring Annex III Chapter III obligations — including Article 12 logging and Article 9 risk management — to 2 December 2027 for standalone Annex III systems. This is now settled law, not a proposal. Article 50 transparency obligations are unaffected and remain live from 2 August 2026.

Annex III covers high-risk AI applications in financial services: credit scoring, insurance underwriting, algorithmic systems that materially influence decisions affecting individuals or organisations, and AI used in employment and access to essential services. From 2 December 2027, national competent authorities can open investigations, request audit logs, and issue penalties for non-compliance under Article 12 and Article 9. The maximum penalty for a provider of a non-compliant high-risk AI system is 3% of global annual turnover or €15 million, whichever is higher (Art. 99(4)).

Article 12: The Logging Obligation

Article 12 requires that high-risk AI systems technically allow for the automatic recording of events throughout operational lifetime. Three words carry the compliance weight: automatic, lifetime, and technically.

• Automatic means logs generated without operator intervention at the moment events occur. Scheduled exports do not qualify. Manual captures do not qualify.
• Lifetime means from deployment to decommissioning. Not from when your compliance programme started. If your AI system has been running, those logs should already exist.
• Technically means built into the system. A policy document stating intent to log does not satisfy Article 12.

The Six-Month Gap Problem

Article 19 requires automatically generated logs to be retained for a minimum of six months. Organisations that start logging on August 2 will have no audit trail for decisions made before that date.

If a complaint or regulatory investigation covers a decision made in June or July 2026, there will be no records to produce. That absence is itself a compliance failure. Organisations that started logging in February have a complete six-month trail from day one of enforcement.

What Must Be in Place Before 2 December 2027

• Automatic event capture at each decision point. Input, model version, prompt, output, timestamp. Every inference that could materially affect a person or organisation.
• Tamper-evidence you can demonstrate. Not a policy statement. A mechanism. Cryptographic hash chaining means any modification breaks the entire subsequent chain, detectable by anyone, not just your vendor.
• Eighteen months of retained records with clear chain of custody. Know where logs are stored, who has access, and how you produce them on regulator request within a reasonable timeframe. Investigations may cover decisions made well before enforcement begins.
• Independent verifiability. The integrity of your audit trail should be checkable without depending on your own infrastructure or your vendor's word.

Why Starting Now Still Matters

The Annex III deadline moved from August 2026 to December 2027. The audit trail requirement did not. Article 12 requires logging to capture the system's operational lifetime, not just the period after enforcement begins. Organisations that start logging in late 2027 will have no records for decisions made in 2025 or 2026 — the period when AI adoption accelerated most rapidly in financial services.

Regulators investigating a 2026 credit decision in 2028 will ask for the audit trail. Organisations that built it will produce it. Organisations that waited will have nothing to show. The delay in enforcement date does not create a delay in the need for evidence.