EU Extends AI Act High-Risk Deadlines to 2028, FTC Targets Accuracy Claims

EU Extends High-Risk AI System Compliance to August 2028

The Council of the European Union approved an AI Act amendment on 29 June 2026 that extends the compliance deadline for high-risk AI systems embedded into regulated products from August 2026 to 2 August 2028. Standalone high-risk systems under Annex III now face a deadline of 2 December 2027 instead of August 2026. The extensions apply only to specific high-risk categories — general-purpose AI obligations and transparency rules remain on their original schedules.

This creates a two-tier vendor market. Providers that already built documentation, risk controls, and audit artifacts can sell compliance-ready systems today and capture delayed competitors' customers. Smaller model providers and application vendors without mature governance tooling now face 18 months of explaining why they are not ready when larger rivals are.

For enterprise buyers, the extensions reduce immediate deployment pressure but do not eliminate planning work. Procurement teams must classify each AI system now because governance obligations differ by use case and transition dates are staggered. A model serving customer service in France may fall under different rules than the same model screening loan applications. The worst outcome is discovering in late 2027 that a system you deployed in early 2026 needed different controls all along.

FTC Proposes Policy on Accuracy Suppression in AI Systems

On 1 July 2026, the U.S. Federal Trade Commission published a proposed policy statement targeting what it calls suppression of accuracy in AI systems. The comment period closes 31 July 2026. The policy addresses AI vendors that trade accuracy for safety, cost, or content moderation goals without adequately disclosing those tradeoffs to customers or end users.

This raises the compliance floor for AI vendors. Companies that deploy models with known accuracy limitations — for example, systems that prioritize false negatives over false positives in content moderation, or that throttle precision to reduce compute costs — now face consumer-protection scrutiny if those tradeoffs are not documented and disclosed. The FTC position strengthens vendors that publish detailed model cards, benchmark results, and performance tradeoff explanations, because those artifacts become evidence of good faith.

Enterprise buyers should expect more contractual language about model accuracy, especially in customer-facing and regulated workflows. If an AI system produces false outputs that harm consumers — wrong product recommendations, incorrect eligibility determinations, misleading chatbot responses — the FTC may now argue that the vendor suppressed accuracy and the enterprise buyer failed to verify claims. This increases the value of pre-deployment testing, contractual accuracy guarantees, and vendor indemnity provisions.

Singapore Issues Runtime Safeguards Framework for Agentic Finance

On 3 July 2026, the Monetary Authority of Singapore published Safeguards for Agentic Finance at Runtime (SAFR), the first formal regulator-issued framework for AI agents in financial services. Unlike voluntary industry guidance, SAFR establishes expectations for runtime controls, approval gates, and human override features in autonomous or semi-autonomous AI systems.

This benefits governance vendors, observability platforms, and fintech infrastructure providers that can prove runtime monitoring and escalation controls. Pre-deployment testing alone is no longer sufficient for agentic systems that execute transactions, make credit decisions, or manage portfolios. The framework assumes AI agents will behave unpredictably at runtime and requires technical safeguards to detect and halt harmful actions before they complete.

Financial-services buyers must now budget for runtime monitoring, not just model validation. This includes audit logging that captures agent decisions, approval workflows that escalate high-risk actions to humans, and kill switches that disable agents when behavior drifts outside defined parameters. Vendors that cannot demonstrate these controls lose access to Singapore's financial market and create compliance risk for buyers deploying similar systems elsewhere.

California and Colorado AI Rules Now Active

California's Transparency in Frontier Artificial Intelligence Act (SB 53) applies to frontier models trained with compute exceeding 10^26 FLOPs. Developers with annual revenue above $500 million must publish Frontier AI Safety Frameworks and transparency reports before deploying new models. California's Automated Decision-Making Technology Regulations became effective 1 January 2026, with ADMT-specific compliance deferred to 1 January 2027.

The Colorado AI Act took effect 30 June 2026 and requires organizations deploying high-risk AI systems to conduct documented risk assessments, implement algorithmic discrimination safeguards, and maintain ongoing monitoring.

These state rules fragment the U.S. compliance landscape. Large model providers can absorb governance overhead, but smaller vendors struggle to justify the cost for a single state. For enterprise buyers, this increases procurement leverage — you can now require vendors to prove they meet SB 53 thresholds, can produce safety frameworks, and have ADMT tools ready for 2027. Vendors that cannot answer those questions lose deals.

What to Watch

China's Interim Measures for the Administration of Anthropomorphic AI Interaction Services became effective 15 July 2026, creating the first dedicated regulatory category for AI agents. Buyers selling into China must now classify products as generative AI, anthropomorphic interaction services, or AI agents, because compliance obligations differ by category.

The UK and Germany published a bilateral AI safety statement on 30 June 2026, increasing pressure on global vendors to harmonize documentation and safety processes across jurisdictions. Multinational buyers should expect more requests for cross-border assurance evidence, model governance consistency, and incident reporting that works in multiple regulatory regimes.

The key procurement question for the next six months: which vendors can prove compliance across EU, U.S., Singapore, and China rules simultaneously, and which are optimizing for one market at the expense of others? The cost of switching vendors mid-deployment is higher than the cost of verifying global compliance now.