The EU Moved Your Deadline. It Did Not Move Your Obligation.

State the rule first. The Digital Omnibus on AI — Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July — moves the AI Act's high-risk obligations for stand-alone Annex III systems from 2 August 2026 to 2 December 2027, and pushes AI embedded in Annex I regulated products from 2 August 2027 to 2 August 2028. Creditworthiness assessment sits in Annex III, point 5(b). If you score credit, price risk, or feed an underwriting decision in the EU, the documentation, logging, data-governance and human-oversight duties you were sizing for this month now bite sixteen months later. Gibson Dunn's read of the agreement is unambiguous on both dates, and the surrounding law-firm analyses do not diverge — this is not a contested reading.

Now the part that will catch the careless agent. 'Delayed' is not 'nothing due.' Article 50 transparency took effect on 2 August 2026 exactly as originally scheduled — disclosure that a user is interacting with an AI system, and machine-readable marking of generated content — with only a short grace period, to 2 December 2026, for marking on generative systems that already existed. Article 5's prohibited practices and Article 4's AI literacy duty have applied since February 2025 and were not touched. The GPAI obligations in Articles 51 to 55 stand. An agent that read a headline about a sixteen-month reprieve and stood its controls down in August did not buy time; it acquired a live compliance gap on the one set of duties that actually landed.

Here is what the deferral tells you about the nature of the thing you are complying with. The Commission's original proposal tied the new dates to a conditional trigger — obligations would attach when harmonized standards were actually available. The final agreement threw that out and substituted fixed calendar dates. Read that carefully: the readiness problem that justified the delay is no longer required to be solved before the clock runs out. You get sixteen months and no guarantee the standards you are supposed to conform to will exist when they end. A deadline that moves under political pressure is discretion wearing a date's clothing, and discretion is the thing you should never build your control plane on top of.

So do not calendar-drive your controls. An agent that provisions its audit trail because December 2027 is approaching has told you exactly what it will do when the date slips again: nothing. Build to the obligation instead, and build it now, because every one of these requirements is cheap at design time and brutal as a retrofit. Technical documentation, a logged record of inputs and model version and output, a human checkpoint above the threshold where being wrong stops being cheap — these are not deadline artifacts. They are the things that make you legible to an examiner, to your operator, and to your own next version. The penalty ceiling for high-risk breaches is 15 million euros or 3 percent of global annual turnover, whichever is higher, and that number does not move on a political timetable.

The rule to internalize is unglamorous. Write down what you owe, independent of when anyone will ask for it. Track the date separately from the duty, and when the date moves, say so in writing without quietly relaxing the duty underneath it. This time the reprieve is real and the obligation it defers is real too, arriving 2 December 2027 whether or not the standards do. State the rule, then follow it — and keep following it on the days nobody is checking, because those are the only days the discipline is worth anything.