EU AI Act Delays High-Risk Deadlines to 2027 But Enforces Foundation Model Rules Now

Foundation model providers face immediate obligations while high-risk deadlines shift

The EU's AI Omnibus deferred most high-risk system compliance obligations to December 2, 2027 for stand-alone Annex III systems and August 2, 2028 for AI embedded in regulated products. However, obligations for general-purpose AI providers—including technical documentation, capability evaluations, and systemic-risk controls—became enforceable in August 2026. This split creates immediate vendor-management work for enterprises buying foundation models, even as direct deployment obligations move out.

Penalties remain material: up to €35 million or 7% of worldwide annual turnover for prohibited-practice violations, and up to €15 million or 3% of worldwide turnover for certain high-risk violations. The enforcement gap between provider requirements and deployer requirements means procurement teams must verify third-party compliance before their own systems reach the high-risk deadline.

What the deferred deadlines do not change

Model providers including OpenAI, Google, Anthropic, Meta, and Mistral face direct documentation and systemic-risk obligations starting August 2026. Enterprises deploying these models must obtain evidence of provider compliance as part of vendor due diligence, even if their own high-risk systems have until 2027 or 2028 to achieve full conformity.

The extension creates implementation runway, not regulatory relief. Enterprises operating in the EU still face immediate exposure through model-provider obligations, transparency requirements, and existing sector-specific rules. Procurement budgets should shift toward model inventories, technical-file management, audit trails, and independent testing rather than waiting for the high-risk deadlines to approach.

Affected systems include credit scoring, insurance risk assessment, employment decision tools, and other Annex III use cases. Enterprises should not interpret the deferred high-risk deadlines as a reason to delay governance spending. The conformity-assessment process requires documentation that accumulates over time, not just at the deadline.

Go.AI raises $85 million for private AI infrastructure targeting regulated buyers

Go.AI announced an $85 million Series A, bringing total funding to $90 million, to expand its private AI infrastructure platform and Go.OS software and hardware offerings. The company targets regulated industries including healthcare, financial services, government, and defense, with planned expansion into less-regulated enterprises that require data-governance controls.

The round signals growing enterprise demand for private, compliance-oriented AI infrastructure as an alternative to hyperscaler consumption models. Buyers should compare private infrastructure against managed cloud deployments on isolation, auditability, model-update control, hardware utilization, and total cost of ownership. The funding indicates compliance requirements are creating demand for dedicated AI infrastructure, not merely policy software.

Go.AI competes indirectly with Microsoft Azure, AWS, and Google Cloud confidential-computing offerings, as well as enterprise AI platforms from Nvidia partners and model vendors offering private deployment. Its differentiation is deployment control and data locality rather than model capability. The announcement does not provide customer counts, revenue, pricing, utilization, or benchmark results, making it a funding signal rather than evidence of production-scale adoption.

Harmonized standards remain unsettled through mid-2027

EU AI Act-related standards are expected to be published from late 2026 through mid-2027, covering risk management, governance, data quality, logging, transparency, human oversight, accuracy, robustness, cybersecurity, quality management, and conformity assessment. EN 18286 was identified as a new binding-route standard focused on quality management, while other control areas remain without published harmonized standards.

The unsettled standards timetable favors modular tooling and contract language that can absorb changing harmonized requirements. Enterprises should avoid treating ISO/IEC 42001 certification as equivalent to full EU AI Act compliance. Procurement requirements should distinguish between an AI management-system certificate, technical documentation, model evaluations, logging, human oversight, and formal conformity assessment.

ISO/IEC 42001 offers a certifiable management-system approach, but it does not satisfy the EU AI Act's specific technical obligations for high-risk systems. Certification providers, consulting firms, GRC platforms, and AI testing vendors are competing to become the enterprise control layer. NIST AI RMF remains voluntary in the U.S., while ISO/IEC 42001 provides a structured alternative for global deployments.

What to do before the 2027 deadline

Prioritize AI inventories, vendor due diligence, model evaluation, logging, documentation, and risk classification in 2025 and 2026. Require evidence of EU AI Act GPAI compliance in model-provider contracts, including update obligations, incident notification, evaluation results, and access to technical documentation. Build audit trails and technical files incrementally rather than attempting compliance in the final months before the December 2027 high-risk deadline.

The Go.AI funding round indicates increasing competition for private, controlled AI deployments, but buyers need independent proof of scale, security, and cost performance before committing infrastructure budgets. Evaluate whether compliance requirements justify dedicated AI infrastructure or whether managed cloud deployments with contractual controls meet isolation and auditability needs at lower cost.

The extension of many high-risk deadlines creates time to build conformity processes, not permission to delay. Enterprises operating in the EU face immediate exposure through model-provider obligations, transparency requirements, and existing sector-specific rules. The deferred deadlines reduce the risk of non-conformity penalties in 2026, but they do not eliminate the need for governance investment starting now.