The EU AI Act's high-risk deadline moved. What stayed the same, plus SDAIA and PL 2338

The EU AI Act's high-risk obligations, the ones everyone raced toward for 2 August 2026, were delayed by the Digital Omnibus: stand-alone Annex III systems now apply from 2 December 2027, AI embedded in regulated products from 2 August 2028. The European Parliament endorsed the delay on 16 June 2026, and the Council gave final adoption on 29 June 2026. That is not a reprieve. The banned practices have applied since February 2025, and general-purpose AI obligations since August 2025. Only the hardest deadline moved.

Here's the part people miss: the Act doesn't care whether you wrote the model. If you've bought an AI tool and you're using it in a way that touches hiring, credit, access to services, or anything else on the high-risk list, the obligation lands on you as the deployer, not just on the vendor. "We're only using ChatGPT / a SaaS feature" is not a defence. It's the most common gap I see.

Three regimes, three clocks, and they don't line up

The EU AI Act just moved its hardest date, but it isn't the only AI rule that matters this year.

In the Gulf, there's no single AI statute yet, but there's a tightening stack: the UAE Charter for AI, the central bank's AI/ML guidance for financial institutions, and the Information Assurance Standard, which already names AI as in-scope. In Saudi Arabia, SDAIA runs national AI governance with ISO 42001 and a dedicated AI law expected within a couple of years. Saudi has called 2026 its "Year of AI." Neither regulator is waiting for Brussels.

In Brazil, PL 2338, a risk-based framework partly modelled on the EU AI Act, has cleared the Senate and is moving through the Chamber of Deputies. The LGPD already governs the data your AI systems process, delay in Brussels or not.

What to actually do now

Build the inventory first. Catalogue every AI system you build, buy, or have quietly embedded in a SaaS product, including the "shadow AI" your teams adopted without telling anyone. This usually takes a few days and is the single most valuable step.

Classify by risk, not by hype. Most of what you run is low-risk and needs little more than transparency. A small number of use cases, anything touching people's rights, livelihoods, or safety, carry the real obligations.

Put a human in the loop where it counts. For high-risk uses, document who reviews the output, when, and how they can override it.

Keep records you can hand over. Logging, basic technical documentation, and a note on the data each high-risk system uses.

Tighten the vendor contracts. Your AI suppliers should be telling you how they comply. If a contract is silent on the AI Act, that's a renewal conversation.

The bottom line

Treat this as a programme, not a panic, and treat the extra runway as a head start, not a pause. The companies that handle the AI Act well will be the ones who inventoried early, sized their effort to real risk, and turned "we can prove our AI is governed" into something a nervous enterprise buyer actually wants to hear, whether that buyer sits in Brussels, Riyadh, or São Paulo.

---

The Tek Atelier builds proportionate, board-ready AI governance programmes across the Gulf, Latin America, and Europe. Get in touch.