When the EU AI Act was finalised in 2024, it came with a staggered set of deadlines, and one date dominated the conversation: 2nd August 2026, when the toughest obligations – those covering high-risk AI systems – were due to take effect. Most compliance planning across the channel has been built around that date for the past two years.
Then came May 2026. This was when the European Parliament and the Council agreed on a package of amendments known as the Digital Omnibus on AI, which pushes back some of the deadlines associated with the AI Act. There are practical, rather than political, reasons for this delay: the technical standards and assessment routes that would have made high-risk compliance workable simply weren’t ready in time, and pushing ahead regardless would have left businesses being held to requirements no regulator could yet tell them how to meet. Now we’ve got a reset timeline, with the most demanding obligations taking effect in December 2027 and August 2028, rather than August 2026 and August 2027.
Before we go further, a note for UK partners: While the EU AI Act is an EU regulation, its reach is territorial, not geographical. If your customers operate in the EU, serve EU citizens, or deploy AI tools that touch EU data, they are in scope regardless of where the business is based. A significant proportion of Climb’s partner base is in the UK, and for many of those partners, this legislation is every bit as relevant as it is for a partner headquartered in Munich or Amsterdam. If you have customers who operate in the EU or serve EU citizens, then everything that follows applies.
So, what does this mean for you, and for the customers relying on you to get this right?
The reset doesn’t apply evenly and treating it as a blanket delay is where most of the risk now sits. Some obligations have already been live for almost a year. Others still arrive exactly on schedule this summer. One brand-new rule appears for the first time this winter. A customer who’s heard “the AI Act got pushed back” and stopped preparing may be sitting on a live obligation with weeks to go.
The Act sorts AI systems by risk level, and the highest tier of AI that’s still allowed to operate – “high-risk” – covers AI used in sensitive areas: recruitment and staff monitoring, credit scoring, education and exam grading, law enforcement, border control, and biometric identification, among others. The Act asks for the most from the businesses building and using these high-risk systems: risk assessments, human oversight, data governance, and formal documentation.
It’s this category that’s been delayed, but even within it, the delay isn’t uniform. High-risk systems that stand alone – a recruitment screening tool, for instance – now have until December 2027 to comply, instead of August 2026. High-risk AI that’s built into a product already regulated elsewhere, such as a medical device or a piece of machinery, has until August 2028, a year later than originally planned. Separately, the requirement for each EU country to set up a testing environment for new AI systems (a “regulatory sandbox”) has also been delayed, from August 2026 to August 2027.
The reason for all of this is that the detailed guidance businesses need to comply – how to classify a system, what evidence a conformity check requires – wasn’t going to be ready in time. Delaying the obligations rather than enforcing them against standards that don’t exist yet was, in that sense, the only workable option. But the underlying task hasn’t gone anywhere. Working out which AI systems a business uses, and which of those fall into the high-risk category, is an important job which still needs to be done – and it’s worth starting with your customers now, before you’re doing it against a much tighter clock.
What hasn’t moved
Two things here are worth spelling out clearly:
The first is general-purpose AI models – the large underlying models that sit behind tools like chatbots and AI copilots, built by a small number of major providers. Obligations on these have applied since August 2025, almost a year before the Omnibus was even agreed, and nothing about the recent changes affects them. Most AI tools on the market are built on top of one of these general-purpose models rather than built from scratch, so a customer using almost any mainstream AI tool has likely been operating under active rules for nearly a year already, whether they’ve realised it or not.
The second is transparency. Separately from the high-risk category, the Act requires that people are told when they’re interacting with AI, and that AI-generated content – images, audio, video – can be identified as such. Most of these disclosure requirements are still due on the original date, 2nd August 2026. There’s one narrower exception to this: the requirement to digitally watermark AI-generated content – tagging it so it can be detected as AI-made rather than human-made – moves to 2nd December 2026. But that later date only applies to tools that are already on the market before this August. Any new AI tool that generates content and launches after 2nd August 2026 has to meet the watermarking requirement from day one, with no extra time at all.
There’s also a genuinely new addition, unrelated to any of the timeline shuffling. During the final negotiations, a ban was added on AI systems that generate illegal, exploitative imagery – a prohibition that didn’t exist in the Act at all in 2024. It comes into force on 2nd December 2026. The obligation this creates sits primarily with providers: any vendor offering a general-purpose image or video generation tool now needs to demonstrate that it has safeguards built in to prevent that kind of misuse.
These are the three obligations your customers are most likely to miss this year, precisely because they don’t carry the same headline weight as the 2027 high-risk deadline.
What this means for partners
The practical starting point is the same regardless of which deadline applies: know what AI your customer is using. That means separating out standalone tools from AI embedded in other products and internally built systems from ones that were bought in. Nothing about the delay changes this step, because reclassifying a system later depends on already knowing it exists.
From there, the two questions worth raising with your customers now are whether they’re subject to the transparency requirements arriving this August, and – for anyone offering a customer-facing AI feature that generates content – whether they’re ready for the December labelling deadline. Both are considerably closer than the 2027 date most people have heard about.
This is also where, as a UK partner especially, you have the clearest opportunity to add value. Many of your customers may not have connected the EU AI Act to their own operations, particularly if they think of themselves as a UK business first. But the moment they serve EU customers, employ people in the EU, or offer AI-powered tools to EU users, the Act applies. Being the partner who helps them work that out – before it becomes a problem – is what turns a product conversation into an advisory relationship.
The extended runway on high-risk systems is best treated as time to build that advisory relationship properly, not as a reason to leave the conversation until the standards are finalised.
And this is where Climb sees its role: working through the detail behind a moving regulatory timeline alongside you, customer by customer, so the right questions get asked before a deadline is missed rather than after. Where a customer’s exposure moves beyond a straightforward conversation – into formal audit, security testing, or ongoing compliance monitoring – Climb can also point you toward specialist vendors in our portfolio who work in exactly that space, rather than leaving you to source that expertise on your own.
Climb’s view
The partners who come out ahead here are the ones who can tell a customer, specifically, which of these obligations applies to them and when. Getting to that level of detail isn’t something you need to work out alone. It’s a conversation Climb works through with you directly, and one worth having with your customers now, not when the next deadline is only weeks away.
If you want to go deeper on what the EU AI Act means for you and your customers, Climb’s EU AI Act Playbook is a good place to start. It breaks down the regulation, the key obligations and what they mean in practice, helping partners understand where the opportunities and risks sit and approach customer conversations with greater confidence.
And if you’re starting that conversation with a customer today, these six questions can help you quickly understand where they stand…
Six questions to ask your customers now for the EU AI Act
If you’re sitting down with a customer and want to work out their compliance position on the EU AI Act, these are the questions to start with. You don’t need to be a compliance specialist to ask them, you just need to be willing to start the conversation.
- Do you use any AI tools or features in your business, including ones embedded in other products? Most organisations underestimate how many AI systems they’re already running. Copilots, chatbots, automated content tools, smart filtering in email or security platforms all count.
- Are any of those tools customer-facing? Chatbots, virtual assistants, AI-generated recommendations, automated messaging…if a customer or member of the public interacts with it, the transparency obligations from August 2026 are likely to apply.
- Do any of your AI tools generate images, audio, or video? If so, the watermarking requirement applies from 2nd December 2026 for tools already on the market, or from launch date for anything new. This is the one most customers will not have heard about.
- Do you operate in the EU, or serve EU citizens? If the answer is yes, the Act applies, regardless of where the business is headquartered.
- Have you mapped which of your AI systems might fall into a high-risk category? Recruitment tools, credit scoring, exam grading, biometric ID, law enforcement – if any of these apply, your customer will need risk assessments, human oversight frameworks, and formal documentation in place by December 2027.
- Do you know which compliance deadlines apply to your set-up, and when? If they can’t answer this, that’s your opening.
The EU AI Act is only one part of a wider regulatory landscape that partners and their customers are having to navigate. From AI governance and cyber resilience to NIS2 and DORA, the challenge is understanding what applies, what needs to happen next and where the right technology and expertise can help.
Climb’s Compliance & Resilience Hub brings together practical resources created to help partners make sense of these requirements and turn compliance into more productive customer conversations. Explore the hub for playbooks, guidance and resources covering the regulations shaping the conversations you’re having today.
