The European Parliament has voted to extend your high-risk AI system deadlines to December 2027 and August 2028. Meanwhile, the Council wants to reinstate registration obligations you thought you'd escaped. If you're managing AI systems that might fall under Annex III classifications, you're facing a choice that affects your next two years of compliance work.
This isn't about whether to comply. It's about which compliance pathway makes sense given your system's characteristics, your organizational capacity, and the regulatory signals coming from Brussels.
The Decision You're Facing
Your high-risk AI system needs a compliance strategy that accounts for:
- Timeline uncertainty: Parliament and Council are negotiating. The Commission's original August 2026 deadline may shift to December 2027 or August 2028 depending on whether your system falls under EU sectoral safety legislation.
- Registration scope: The Council mandate reinstates provider registration obligations in the EU database for systems you might have considered exempt from high-risk classification.
- Standards readiness: Key harmonized standards won't be finalized by August 2026, which is why Parliament supports postponement in the first place.
You need to choose between preparing for the earliest possible deadline, waiting for final negotiated timelines, or pursuing sectoral compliance pathways.
Key Factors That Affect Your Choice
Three factors determine which path fits your situation:
Factor 1: Does your system fall under EU sectoral safety legislation?
If your AI system operates within sectors covered by existing EU safety frameworks (medical devices, machinery, aviation), you're looking at the August 2028 timeline under Parliament's proposal. The Council supports the same date. This gives you an extra year compared to standalone high-risk systems.
Factor 2: Can you absorb early compliance costs?
Building Technical Documentation (Annex IV), establishing quality management systems, and implementing conformity assessment procedures require dedicated resources. Early preparation means you're ready regardless of the final timeline, but it also means investing before standards are finalized.
Factor 3: What's your risk tolerance for registration obligations?
The Council wants providers to register systems even if they're exempt from high-risk classification. If you've been treating your system as exempt, you need to evaluate whether registration obligations apply and what documentation that triggers.
Path A: Prepare for December 2027 (Standalone High-Risk Systems)
Choose this path if your system is classified as high-risk under Annex III but doesn't fall under sectoral safety legislation.
When this makes sense:
- You're deploying AI in employment decisions, credit scoring, law enforcement support, or education access.
- Your system isn't covered by medical device, machinery, or aviation regulations.
- You have internal capacity to build compliance infrastructure now.
- You want regulatory certainty and can't afford last-minute scrambles.
What you need to do: Start building your Technical Documentation (Annex IV) framework now, even before harmonized standards are finalized. Focus on requirements that won't change: risk management systems, data governance procedures, human oversight mechanisms, and accuracy metrics.
Establish your quality management system aligned with Article 17 requirements. This includes documentation processes, change management protocols, and post-market monitoring procedures.
Don't wait for final standards to define your conformity assessment approach. Work with your legal team to determine whether you'll need third-party assessment (Article 43) or can rely on internal processes.
The trade-off:
You're investing resources before the regulatory landscape fully stabilizes. If Parliament and Council negotiate different timelines or if your system's classification changes, you might be over-prepared. But you eliminate deadline risk.
Path B: Wait for Sectoral Integration (August 2028)
Choose this path if your AI system operates within an established EU safety framework.
When this makes sense:
- Your system is embedded in medical devices, industrial machinery, or aviation equipment.
- You're already managing compliance with sector-specific regulations.
- You need time to integrate AI-specific requirements into existing quality systems.
- The Council mandate requiring the Commission to provide guidance for sectoral operators matters to you.
What you need to do: Map your existing sectoral compliance processes against AI Act requirements. Identify gaps between your current quality management system and Article 17 obligations.
Monitor the Commission's guidance development. The Council mandate specifically requires guidance to help sectoral operators comply while minimizing compliance burden. This guidance will clarify how AI Act requirements layer onto your existing obligations.
Use the extra year to pilot AI-specific controls: enhanced data quality monitoring, bias testing protocols, and explainability mechanisms that go beyond your current sectoral requirements.
The trade-off:
You have more time, but you're also managing two evolving regulatory frameworks simultaneously. Sectoral legislation will need to develop AI safety requirements, and there's no guaranteed timeline for that work. The open letter from TÜV-Verband and AlgorithmWatch warns that moving high-risk products to Annex I-B creates fragmentation risk.
Path C: Pursue Exemption with Registration Readiness
Choose this path if you believe your system qualifies for exemption from high-risk classification but you need to prepare for registration obligations.
When this makes sense:
- Your system's risk profile sits at the boundary of Annex III classifications.
- You have defensible arguments for exemption based on limited impact or human oversight.
- The Council's reinstatement of registration obligations affects you.
- You want to minimize compliance burden while maintaining regulatory visibility.
What you need to do: Document your exemption rationale with precision. Reference specific Annex III criteria and explain why your system doesn't meet high-risk thresholds. This documentation becomes your registration submission.
Prepare for EU database registration even if you're exempt from full high-risk obligations. The Council mandate makes this clear: exemption from high-risk classification doesn't mean exemption from registration.
Build lightweight versions of core AI Act controls. Even exempt systems benefit from data governance procedures, accuracy monitoring, and human oversight documentation. If your exemption argument fails, you've got a foundation to build on.
The trade-off:
You're betting on exemption while preparing for registration. If regulators disagree with your classification, you'll need to accelerate full compliance. The risk: Equinet-ENNHRI warned that regulatory simplifications tied to company size rather than system risk could have systemic implications.
Summary Matrix
| Decision Factor | Path A (Dec 2027) | Path B (Aug 2028) | Path C (Exemption) |
|---|---|---|---|
| System type | Standalone high-risk | Sectoral safety | Boundary cases |
| Timeline pressure | Immediate | Extended | Conditional |
| Resource intensity | High upfront | Phased integration | Minimal unless reclassified |
| Standards dependency | Proceed without final standards | Wait for sectoral guidance | Light documentation |
| Registration obligation | Full compliance | Full compliance | Registration only |
| Risk exposure | Over-preparation | Fragmentation across sectors | Reclassification challenge |
The Parliament's plenary vote is expected on 26 March, followed by negotiations with the Council. Your decision doesn't lock you in permanently, but it determines where you invest compliance resources over the next six months. Choose the path that matches your system's regulatory profile and your organization's capacity to absorb preparation costs before timelines finalize.
