THE EU AI ACT: WHAT CHANGED, WHAT DIDN’T, AND WHERE THE RISK SITS

---

Exec summary

The EU AI Act’s high-risk deadlines just moved to December 2027 and August 2028. Most institutions are reading that as relief. It isn’t — the classification work, the missing system inventory, and the still-unmoved August 2026 disclosure deadline haven’t gone anywhere. The real exposure sits in execution, not conversation: what your AI systems actually do, not what they say.

---

THE FULL PICTURE

August 2, 2026 was supposed to be the deadline for high-risk AI obligations under the EU AI Act.

For most regulated systems, it no longer is.

But the story most compliance briefings are telling right now — “the deadline moved, breathe easy” — is the wrong story. Reading it that way is the most expensive mistake a regulated institution can make this year.

I. WHAT ACTUALLY CHANGED

The EU has a new law in progress called the “Digital Omnibus on AI.” It’s basically a set of edits to the original AI Act. It was agreed on by EU lawmakers on May 7, 2026, approved by the European Parliament on June 16, and given final sign-off by the Council on June 29. The only thing left is for it to be officially published — expected sometime before August 2, 2026.

Here’s what it changes:

— AI that makes high-stakes decisions on its own (like credit scoring or hiring) — originally due August 2026, now pushed to December 2, 2027. That’s an extra 16 months.

— AI that’s built into a regulated product (like a medical device) — originally due August 2027, now pushed to August 2, 2028. That’s an extra 12 months.

Both new dates are now fixed. They’re not “maybe” dates waiting on some future review — they’re locked in, assuming the law gets published as expected.

WHAT DIDN’T CHANGE

Some rules were never touched by this delay:

— Certain AI uses have been banned outright since February 2025 (things like AI that manipulates people or scores citizens like a social credit system).

— Rules for big AI model providers have applied since August 2025.

— If your company uses a chatbot or AI agent to talk to customers, you still have to tell them it’s AI — that requirement is still due August 2026. A follow-up rule about labeling AI-generated content is due December 2026.

None of that moved. This is the part most companies are missing, because all the news coverage is about the parts that got delayed.

THE CATCH

None of this is officially law yet. It still needs to be published by the EU before August 2, 2026. If that publication gets delayed for any reason, the original 2026 deadline snaps back into place automatically. So: plan around the new dates, but don’t treat them as guaranteed until the law is actually published.

II. THE DATES AT A GLANCE

III. FOR BANKS AND CREDIT UNIONS: WATCH FOR DOUBLE DUTY

Credit scoring is still on the list of high-risk uses — that hasn’t changed, only the deadline has (December 2027 now). If you use AI to help decide loan approvals, credit limits, or fraud risk, you’re building toward a real compliance program: documentation, testing, human oversight, and registering the system with EU authorities. You have more time, but the work itself hasn’t gotten smaller.

Here’s the part a lot of banks miss: if you also use AI for hiring or HR decisions (screening candidates, evaluating performance, flagging terminations), that’s a second, completely separate high-risk category under the same law. Same deadline, but it’s not one project — it’s two. Each needs its own risk review and its own paperwork trail.

One piece of good news: the rules got looser around using sensitive data (like race or health information) specifically to test AI for bias. You’re now allowed to use that data for that purpose, as long as you can show it was genuinely necessary.

The catch: you need to write down that justification before you use the data — not after, once someone asks why you did it.

One more thing that has nothing to do with the AI Act: European privacy law (GDPR) already requires documentation on automated scoring systems today. That obligation doesn’t wait for 2027 — it’s already in force. A lot of banks will find out their GDPR paperwork is more overdue than their AI Act paperwork.

IV. FOR HEALTHCARE: THE QUESTION THAT DECIDES YOUR DEADLINE

Healthcare has a trickier problem than banking. Your deadline depends on answering one specific question: is your AI system part of a certified medical device, or is it a separate system that just helps decide who gets care and when?

— If it’s built into a certified medical device (like diagnostic imaging software) → your deadline is August 2028.

— If it’s a standalone system that decides things like who gets prioritized, who gets pre-approved for a procedure, or who gets routed to a specialist, without itself being a device → your deadline is December 2027.

Get that classification wrong, and you might think you have more time than you actually do.

There’s also a helpful narrowing already in the Act: if an AI system only makes things more convenient or efficient — and doesn’t create real risk to someone’s health or safety if it fails — it may not count as “high-risk” at all.

That’s good news for things like call routing or administrative triage in a healthcare contact center. But you can’t just assume your system qualifies for this exception. You need to document, in writing, why the system’s failure mode is low-risk. Regulators will want to see your reasoning, not just your conclusion.

V. THE REAL FAULT LINE: WHERE CONTACT CENTER AI ACTUALLY SITS

Here’s the pattern underneath everything in Sections III and IV, and it’s bigger than either banking or healthcare on its own.

Anywhere an AI system decides what happens next in a live, regulated interaction — that’s the classification gray zone. Not the chatbot that answers a question. The system is one step behind it, deciding what the interaction actually leads to.

A few examples of what that looks like in practice:

— A healthcare contact center AI that triages an inbound call by how urgent it sounds, and decides whether it gets escalated to a nurse now or queued for later.

— A bank’s fraud-detection AI that decides whether to freeze a transaction, flag an account for review, or route the caller straight to a human agent.

— An IVR system in any regulated industry that uses AI to decide which department, which specialist, or which outcome a customer gets routed to — not just what they’re told.

On the surface, all of these look administrative. Underneath, each one is a live decision with a real consequence if it’s wrong: a patient waits too long, a legitimate transaction gets frozen, a customer gets routed away from the help they actually needed. That’s exactly the kind of failure mode that pulls a system back into high-risk territory, no matter how convenient or “back-office” it looks from the outside.

And here’s the part worth sitting with: the new EU rules don’t resolve this for you. The Digital Omnibus moved deadlines. It did not draw a clean line around which of these systems counts as high-risk and which doesn’t. That line still has to be drawn system by system, with a documented, defensible reason for where it falls — and that’s true whether the deadline is 2027, 2028, or next Tuesday.

This is also where the real compliance risk actually lives, and it’s easy to miss if governance stays focused on the conversation layer — reviewing transcripts, checking what the AI said, auditing tone and accuracy. None of that captures what these systems are exposed to. The exposure is in the execution layer: what the AI actually did next — which system it touched, what action it triggered, who it routed the case to, and whether a human could see and stop that action before it happened. A transcript that reads perfectly well can still sit on top of a decision that was never properly classified, logged, or overseen.

That’s the fault line every regulated contact center needs to find before a regulator finds it for them.

VI. DON’T MISTAKE THE DELAY FOR A BREAK

There are three reasons “we have more time now” is a dangerous way to think about this.

1. The detailed rulebook still isn’t finished. Regulators are still writing the technical standards that define what “compliant” actually looks like in practice. Those standards aren’t done yet. So a chunk of your extra time will just go toward waiting for guidance that hasn’t arrived — not toward actual building.

2. The hard part was never the paperwork — it’s knowing what you have. Most companies don’t have a complete list of every AI system they’re running, including ones bought from vendors and ones built in-house. Building that list, and sorting each system into the right risk category, takes the same amount of work whether your deadline is 2026 or 2027. Waiting doesn’t make that task any easier — it just means you’ll do it later, with more systems to account for by then.

3. The customer-disclosure deadline wasn’t delayed at all. If you’re focused entirely on 2027 and 2028, you might walk right past the nearer deadline — telling customers they’re talking to AI — which is still due in 2026.

VII. WHAT “BEING COMPLIANT” ACTUALLY LOOKS LIKE DAY TO DAY

On paper, this sounds like a documentation exercise. In practice, if regulators come asking, they’re going to want to see what your AI system actually did in a real transaction — not just how well it performed in testing.

Here’s what that requires in plain terms:

— A risk review that’s kept up to date, not something written once and filed away. Every time you retrain the model or change what it’s used for, you need to revisit the risk assessment.

— A clear, written reason for using any sensitive data, created at the time you decided to use it — not invented afterward to justify the decision.

— A real human in the loop — someone who sees a decision before it happens and can actually stop it, not someone who checks a report after the fact.

— Logs that explain not just what the AI said or did, but why it acted that way and what systems it was allowed to touch.

— All the paperwork and registration done before you launch the system, not scrambled together after something goes wrong.

The common mistake: companies build governance around reviewing what the AI said, but nothing captures what it actually did once it took action inside a real system — approving something, updating a record, escalating a case. That’s where the real exposure sits.

What This Means for CCaaS and SI Partners

Not every customer pilot got the same breathing room. Loan-decisioning and clinical-device AI bought over a year. Contact-center triage and routing didn’t move at all — routing a call is the same consequential decision regulators are targeting.

That’s a deal-timing signal, not a footnote.

Customers assuming blanket relief will find out otherwise mid-renewal.

“Governed before it happens, not fixed after” just became a live conversation partners need to have — ready or not.

HOW THIS ACTUALLY GETS BUILT: WHAT GOVERNED EXECUTION ACTUALLY REQUIRES

Every one of those five requirements above is really the same underlying problem, asked five different ways: can you prove, for any action your AI took, that it was allowed to happen, that the right person or role greenlit it, that there’s a clear record of why, and that it couldn’t have fired out of turn?

That’s the test any governed system has to pass.. It’s a simple way to think about what “governed execution” actually requires at the moment an AI system acts — not after the fact.

First, Governed: Policy decides whether an action is allowed to run, before it starts. Not a human reviewing it after the fact — a rule checking it in real time, at the moment the AI is about to do something.

Second, Authorized: Role-and-context-based permissions for who or what can trigger the action. The AI doesn’t get blanket access to your systems. It gets exactly the access a specific role, in a specific context, is allowed to have — nothing more.

Third, Traced: A decision path built to your institution’s actual audit and examiner requirements. Not a generic activity log — a record built so that when an examiner asks “why did this happen,” the answer is already sitting there.

Fourth, Enforced: Sequence and business-rule enforcement, so no step fires out of order. The AI can’t skip a required approval, act before a mandatory check, or take a shortcut a human employee wouldn’t be allowed to take either.

Put together, this is the difference between an AI system that sounds compliant and one that actually is. A transcript can look perfect and still sit on top of an action that was never checked against policy, never tied to a specific authorization, never traceable back to a clear reason, and never confirmed to have happened in the right order. That gap — between what the AI said and what it was actually allowed and able to do — is exactly what regulators will be probing for once the high-risk deadlines arrive.

VIII. WHAT TO DO IN THE NEXT 90 DAYS

1. Make a complete list of every AI system you’re running — bought and built in-house. Nothing else can happen until this list exists.

2. Sort each one into the right risk category, and write down your reasoning — especially for anything you’re tempted to call “low-risk.”

3. Get customer disclosure and AI-content labeling done on schedule. This deadline didn’t move, and it’s closer than people think.

4. Combine your privacy-law paperwork and AI Act paperwork into one process where they overlap — don’t do the same work twice.

5. Build logging that shows what your AI systems actually did, not just what they said.

6. Keep an eye on when the EU officially publishes the new law. The new dates aren’t official until that happens.

THE BOTTOM LINE

Companies that treat the next year and a half as time to actually build their AI governance will be in good shape when the detailed rules finally land. Companies that treat it as a reason to relax will be trying to build the whole thing in the final weeks before the deadline hits — with more systems to account for, and less time to do it properly.

The hardest part of this isn’t the paperwork — it’s knowing what your AI systems actually do once they act, and whether anyone could see and stop them before they did. That’s a systems question, not a legal one.

If you’re not confident you could answer it today for every AI system running in your contact center, talk to NovelVox about what governed execution looks like in practice — before a regulator asks you to show your work.

Connect with Us