In July 2026 the EU made its first major change to the AI Act. The headline is that the strictest rules for high-risk AI have been pushed back by more than a year.
It is tempting to read that as permission to park AI compliance. That would be a mistake. The delay changes the timetable. It does not change the direction, and it shows something more important for your contracts: the rules are still moving.
What has changed
The amendments, known as the Digital Omnibus on AI, came into force on 27 July 2026. The main changes are:
- High-risk AI used for significant decisions about people, such as recruitment, access to education, credit scoring and critical infrastructure, now has to comply from 2 December 2027 instead of August 2026.
- AI built into regulated products, such as medical devices and machinery, now has until 2 August 2028 instead of August 2027.
- The definitions were adjusted so that some AI features that only assist users are less likely to be pulled into the high-risk category.
What has not changed
Plenty of the Act already applies, and the delay does not touch it:
- Certain AI practices have been banned since February 2025.
- Rules for general-purpose AI models, the large models behind tools like chatbots, have applied since August 2025.
- Transparency rules have applied since 2 August 2026. People must be told when they are interacting with AI, and AI-generated content must be labelled in some cases.
Why UK businesses should care
The AI Act is EU law, but it reaches beyond the EU. If you place an AI system on the EU market, or its outputs are used in the EU, you may be in scope.
Even if you are not directly caught, your EU customers are. They will want contractual assurance that the AI you supply or use on their behalf will not create a compliance problem for them.
The real issue is moving deadlines
The delay followed sustained pressure from industry and wider political concerns about Europe's competitiveness. Critics argued it weakens protections and creates uncertainty. The EU is also still working on wider changes to its digital rules, so further amendments are possible.
For contracts, that matters more than any single date. A contract that assumes a fixed deadline or a fixed version of the law will age badly. A contract drafted for change will not.
What to check in your contracts
- Change in law clauses. Do they cover new or amended AI rules, and do they say who pays when compliance costs go up?
- Compliance wording. Obligations should refer to the law "as amended from time to time", not to a specific date or version.
- Who is who. The Act treats the business that builds an AI system (the provider) differently from the business that uses it (the deployer). Your contract should match the reality.
- Information duties. If you rely on a supplier's AI, can you require them to give you the documentation you need to meet your own obligations?
- Exit rights. If a supplier cannot keep up with the rules, can you leave without a long notice period or a penalty?
- Liability. Does your liability cap leave you carrying regulatory risk that really belongs with the supplier?
Summary
The EU has bought businesses more time on high-risk AI. It has not removed the obligations, and much of the Act already applies. The safest assumption is that the rules will keep shifting, so your contracts need to be built to handle that.
If you sell AI-enabled products into the EU, or rely on suppliers who do, book a free 20-minute call with the Ethiqs team.