The AI Act's high-risk rules slipped sixteen months for want of a conformity path

Run the new deadline against the process it exists to accommodate. Conformity assessment bodies were largely undesignated as of June 2026, against certification timelines running nine to twenty-four months ^[8]. The Omnibus entered into force on 27 July 2026 ^[1]. Begin a twenty-four month assessment on that day and you finish around 27 July 2028, close to eight months past the 2 December 2027 date for standalone Annex III systems ^[1]. Only the nine-month end of the range clears the window, landing in late April 2027 ^[2]. The extension reads generous on a calendar and tight against a queue that has not opened.

The dev.to write-up that walks through the change makes a distinction worth keeping: the rules did not slip because they were unreasonable, they slipped because the machinery for proving you follow them was not built, and a requirement postponed for missing paperwork infrastructure is not a requirement withdrawn ^[17]. The supporting evidence is dull and specific. The Commission's standardisation request to CEN and CENELEC was originally due in April 2025 and remained undelivered after amendment ^[6], roughly fourteen months overdue by the June 2026 check that found no harmonised standard from the relevant technical committee cited in the Official Journal ^[7][3].

Article 14 is the clause I would keep on the wall whatever the date says. It requires design, including human-machine interface tools, that allows effective oversight by natural persons while the system is in use ^[14]. Then it names what the overseer must be able to do: decide in a particular situation not to use the system, or disregard, override or reverse the output ^[15], and interrupt it through a stop button or similar procedure that brings the system to a halt in a safe state ^[16]. The post reads those two sentences as code paths rather than policy ^[19], and that is the right read. Reverse implies an inverse operation plus a durable record of who invoked it, which puts the override upstream of anything that retries the call. Halt in a safe state implies a partially processed batch has a defined resting place; a stop that leaves half the rows scored is a kill switch with better branding.

What is enforceable now is narrower. Article 50 was not deferred ^[9]. People must be informed they are interacting with an AI system unless that is obvious ^[10], and synthetic audio, image, video and text must be marked in a machine-readable format and detectable as artificially generated, with deepfakes disclosed as such ^[11]. The missing standards bite here too, because nothing in that record names the marking format you are meant to use ^[7]. For text published to inform the public on matters of public interest, the disclosure duty lifts when the piece went through human editorial review and someone holds editorial responsibility for publishing it ^[12]. The post's reading is that accountability, not human contact, discharges the obligation ^[13].

In my context that sets the spend. Keep record-keeping and the override wired into the runtime, because they are cheap to maintain and expensive to retrofit while sitting in a certification queue. Keep the byline path in the CMS, because that one is live ^[12]. Defer external audit rehearsal until a body is designated and a standard is cited, since there is currently nothing to rehearse against ^[7][8]. Controls in an unenforced period rarely get deleted; they get bypassed by the next retry loop someone adds in a hurry.