What changed in the EU AI Act timetable for US groups with European exposure?

The high-risk timetable has changed, and a single “August 2026 AI Act deadline” is no longer an adequate implementation plan. The European Commission states that the AI Omnibus entered into force on 27 July 2026. The revised dates are 2 December 2027 for Annex III high-risk systems and 2 August 2028 for high-risk systems embedded in regulated products under Annex I. (digital-strategy.ec.europa.eu)

This is not a blanket postponement of the entire AI Act. The official implementation material distinguishes the high-risk dates from other provisions already applicable. (digital-strategy.ec.europa.eu)

Recommended action for an exposed US group: maintain separate jurisdictional classifications against a shared AI-use inventory. Record the provider/deployer role, use case, affected market, classification rationale and applicable obligation version.

Do not copy the EU classification into California or Colorado automatically. Make the platform demonstrate how one technology can support several uses with different legal outcomes.

For AI features inside the GRC platform itself, require source-linked outputs, permission tests and human approval as buyer acceptance criteria. These are recommended assurance controls, not a claim that every GRC assistant falls into a particular statutory AI category.