DEADLINE December 2, 2027
Last verified against primary sources:
EU AI Act — High-Risk Obligations (Annex III)
EU · Effective December 2, 2027
What it is
Annex III lists the stand-alone AI systems the EU treats as high-risk: AI used in employment and worker management (CV screening, interview scoring, promotion decisions), creditworthiness assessment, education access and evaluation, insurance underwriting, and access to essential public and private services. For these systems the full compliance regime applies: risk management, data governance, technical documentation, logging, human oversight, accuracy requirements, conformity assessment, and registration in the EU database.
Why the date moved
These obligations were originally due August 2, 2026. The Digital Omnibus (Reg. (EU) 2026/1744) moved them to December 2, 2027 because the harmonized standards providers need to demonstrate conformity weren't ready, not because the requirements were softened. The transparency duties in Article 50 never moved and are enforceable now.
Does it apply to you?
The honest answer for most indie SaaS at $0–5K MRR: not directly, yet. But if your product screens candidates, scores loan or tenant applications, evaluates students, or gates access to essential services for EU users, you are exactly who Annex III describes, and sixteen months is a realistic runway for conformity work rather than a long one. If you're building toward those use cases, the architecture decisions you make now (logging, human-override paths, documentation) cost far less than retrofits in 2027.
Penalties
Non-compliance with high-risk obligations: up to €15M or 3% of global annual turnover.
What SaaSalyst checks
No automated check covers Annex III obligations. Conformity assessments, risk-management systems, and technical documentation aren't observable from a URL scan, and we won't pretend otherwise. This page exists so the deadline is on your radar, not because a scanner can verify it.
Official text: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
FAQ
Our HR-tech product serves EU companies. Is the deferral a reprieve?
It's runway, not a reprieve. The obligations are unchanged; only the date moved. Transparency duties for the same product are already enforceable.
Do SME simplifications apply?
The Omnibus extends simplified documentation paths to SMEs and small mid-caps, but simplified is not exempt. The core obligations stand.
Sources
Regulation (EU) 2024/1689, Annex III; Regulation (EU) 2026/1744 (in force Jul 27, 2026).
See where your app stands
SaaSalyst scans your website in 30 seconds across 118 business readiness checks: compliance signals, security headers, SEO, accessibility, and AI readiness.
Scan Your App