Waiting for 2027
Essay #007 · 2026 · Reading time 5 min · Field: Law / Regulation · Market: all
In May 2026, a piece of news went through the executive floors, and almost everywhere it triggered the same reaction: relief. The EU had agreed to postpone the strictest obligations of the AI Act. The requirements for high-risk systems, which were supposed to take effect this August, will now arrive at the end of 2027, and in part not until 2028. In many companies the topic promptly moved to the back of the pile, onto the stack of things that seem dealt with for now.
That relief is understandable. But it rests on a misunderstanding that can get expensive.
What was postponed and what was not
What was postponed is a narrowly defined part: the obligations for so-called high-risk systems. That means AI in recruitment, in credit decisions, or in safety-relevant products. These obligations are now due to take effect on 2 December 2027, and on 2 August 2028 in regulated product areas. The change is not yet formally in force, but the agreement stands.
What was not postponed is the rest. And the rest affects almost every company, while the high-risk question affects only a minority.
Three obligations already apply today or very soon:
The duty of AI literacy. Since February 2025, the AI Act requires companies to ensure sufficient AI literacy among the people who work with these systems. This obligation does not lie in the future. It is already running.
The prohibited practices. Also since February 2025, certain uses are simply banned, for instance systems that manipulate people through their behaviour. Whoever has something like that in use without knowing it has a problem that no postponement solves.
The transparency obligation. From August 2026, it must be recognisable when content comes from a machine and when people are talking to a machine. For systems already running, there is a grace period until December 2026. That is not a 2027 topic. That is next quarter.
Whoever reads the postponement as “nothing to do” has misread the news. What was postponed is the obligation that affects few. What remains in force is what affects almost everyone.
How the postponement was received
The industry association Bitkom measured in early 2026 how German companies view the AI Act. Of the companies that consider themselves affected, 93 percent expect a high implementation burden. More than half of all respondents say the law brings the business location more disadvantages than advantages.
That is the prevailing attitude: regulation as a burden, to be kept at arm’s length for as long as possible. The postponement fits this attitude perfectly. It confirms it and rewards looking away.
This is exactly where those who think ahead part ways with those who drift with the current: not in how they feel the burden, but in how they read the obligations.
What the obligations in force actually demand
The obligations that apply today describe capabilities that a well-run company needs anyway.
You can tick off the AI-literacy duty as a training requirement: a certificate, a mandatory briefing, done. In fact it demands something else: that the people in the company understand what they are working with. That starts with the person who decides. Whoever takes that seriously closes the knowledge gap between themselves and their team. That gap is exactly what Essay #001 of this archive describes: employees overtaking their boss, and the boss no longer knowing what is happening in their own company.
You can read the transparency obligation as labelling bureaucracy: an “AI-generated” notice everywhere. But it can only be fulfilled if the company knows where, in its own processes, machines are co-writing, co-speaking, or co-deciding. Most companies do not know that today. Whoever finds out in order to meet the obligation will know their own operations better than before.
In both cases the result is more than “compliant”. The result is a company that knows what it is doing.
The head start is built now, not in 2027
There are two ways to handle the postponement. The first reads 2 December 2027 as the starting gun: that is when we begin, until then the topic rests. The second takes the obligations in force today as the real work and starts now.
The difference is not a moral one but a matter of time. The company of the second kind has eighteen months to build something that cannot be produced overnight: leadership and staff who can handle these systems. An overview of what is running in the company. The first mistakes made and digested while there is still time for them.
The company of the first kind stands at the starting line in December 2027. It then has to catch up under time pressure on what others learned at leisure. That gap can no longer be closed — not because a deadline has passed, but because practice cannot be bought.
Regulation rarely creates head starts. This one does, for those who do not let the postponement lull them.
What there is to decide now
The legal department tells you what you must do and by when. It does not tell you what to make of it. That question can only be answered in one place in the company: with you.
The decision is not: “How do we become compliant by 2027?” It is: “Which of the obligations already in force do we treat, starting today, as a capability we need anyway?” Concretely, that means: find out where AI is already in use in the company. Define who needs to build which competence, starting with the management. And take the transparency obligation arriving in August as the occasion to walk through your own processes once, completely.
Most will wait. That is the opportunity.
— Axel Roth