Update: 8 May 2026. On 7 May 2026, the European Commission announced a political agreement to extend the compliance deadline for stand-alone Annex III high-risk AI systems from 2nd August 2026 to 2nd December 2027. AI embedded in regulated physical products faces a further extension to 2nd August 2028. This is a political agreement: the formal amending legislation has not yet been published. References to 2nd August 2026 throughout this article have been updated accordingly. The Article 50 watermarking and content labelling obligations are not affected by this change and remain due 2nd August 2026. Source: European Commission Press Release IP/26/1024, 7 May 2026.

The EU AI Act is already in force.[1] A political agreement announced on 7 May 2026 has moved the main compliance deadline for Annex III high-risk AI systems from 2nd August 2026 to 2nd December 2027. For regulated Irish SMEs in financial services, insurance, health technology, and HR tech, this is not a reason to delay. The extension is an opportunity to build a compliant governance architecture while time permits.

This article explains which obligations apply, which sectors are most directly affected, and what needs to be in place before your organisation deploys or continues to operate a high-risk AI system.

What is already prohibited

Not all of the EU AI Act's obligations start in August 2026. Eight categories of AI practice were prohibited from 2nd February 2025, six months after the Act entered into force.[5] These bans are already in effect.

The two categories most likely to be relevant to Irish SMEs are:

• Manipulative or deceptive techniques (Article 5(1)(a)): AI that uses subliminal methods or deliberate deception to influence a person's behaviour in a way that causes them harm. This can arise in marketing AI, sales chatbots, or customer engagement tools that are configured to steer users towards decisions against their interests.
• Exploiting vulnerabilities (Article 5(1)(b)): AI that targets people based on age, disability, or financial hardship to distort their decisions in a way that causes harm. This is relevant to any AI tool used in consumer finance, insurance, or welfare services.

The other prohibited categories cover social scoring by public authorities, predictive criminal profiling, facial recognition database scraping, emotion recognition in workplaces and education, biometric categorisation by protected characteristics, and real-time biometric identification in public spaces. These are less likely to be relevant to most Irish SMEs, but organisations using AI in HR or customer-facing contexts should be aware of the emotion recognition prohibition in particular.

If your organisation is using any AI tool that could fall into these categories, that is not a future compliance question. It is a current one.

In summary

Eight categories of AI practice have been prohibited since 2nd February 2025. The December 2027 deadline covers high-risk AI governance. These are two separate sets of obligations on two separate timelines.

What the current deadlines are

Following the political agreement announced on 7 May 2026, the obligations for providers and deployers of high-risk AI systems listed in Annex III of the EU AI Act (the Act's catalogue of high-risk use cases) become enforceable on 2nd December 2027 for stand-alone systems. AI systems embedded in regulated physical products face a further extension to 2nd August 2028. A provider is the organisation that builds or places an AI system on the market. A deployer is any organisation that uses it in a professional context.

The obligations themselves are unchanged: risk management systems, technical documentation, human oversight measures, and conformity assessments. The formal amending text has not yet been published, but the political agreement is confirmed. Organisations deploying high-risk AI systems without the required governance architecture will be operating out of compliance from December 2027. The penalties under the Act are significant: up to €15 million or 3% of global annual turnover for most violations, and up to €30 million or 6% of global turnover for prohibited AI uses.[2]

In summary

2nd December 2027 is the new planned enforcement date for Annex III stand-alone high-risk AI systems. That is 19 months away: enough time to build governance that genuinely holds up, rather than a compliance exercise assembled under pressure.

Which Irish SMEs are most directly affected?

The high-risk categories in Annex III are specific. An organisation is not automatically in scope simply because it uses AI. The question is whether the AI system performs a function that falls within one of the listed categories and whether it plays a material role in a consequential decision.

The categories most relevant to regulated Irish SMEs are:

• Financial services: AI used in creditworthiness assessment, insurance risk scoring, or eligibility decisions for financial products
• Human resources: AI used in recruitment, candidate screening, promotion decisions, or performance evaluation
• Health and education: AI used in access decisions for publicly funded services, or in systems that influence care pathways
• Law enforcement and border management: AI used by public authorities in risk profiling or access control decisions

The boundary between in-scope and out-of-scope is not always obvious. It depends on what the system does, not just where it is deployed. Some examples make the distinction clearer:

• Financial services: An AI model that analyses an applicant's income, employment history, and spending patterns to approve or decline a loan is in scope under Annex III point 5(b). An AI chatbot that answers general questions about loan eligibility without making any individual assessment is not.
• HR technology: An AI platform that scores and ranks CVs by inferred traits or skills to filter candidates for shortlisting is in scope under Annex III point 4. A basic keyword search tool that returns matching CVs without ranking or scoring is not.
• Health insurance: An AI system that processes individual health data to calculate personalised premiums or decline coverage is in scope under Annex III point 5(a). AI used to summarise anonymised aggregate claims data for internal forecasting is not.

Many Irish SMEs in these sectors are already using AI systems that fall into one or more of these categories, often through third-party tools. The obligation applies to deployers as well as providers. If your organisation is using a tool that meets the Annex III criteria, the compliance requirements fall on you regardless of who built it.[3]

In summary

If you operate in financial services, HR technology, or health tech and use AI in decision-making, you are likely in scope.

What governance architecture needs to be in place?

For deployers of in-scope systems, the core requirements are:

• A risk management system that identifies and mitigates risks specific to the intended use
• Technical documentation covering the system's purpose, data used, performance characteristics, and limitations
• Human oversight measures that allow a qualified person to understand, monitor, and if necessary override the system's outputs
• A Fundamental Rights Impact Assessment for deployers that are public bodies or private entities providing public services.[4] A Fundamental Rights Impact Assessment is a structured review of how an AI system's outputs could affect people's rights, including rights to equal treatment, privacy, and access to services.
• A post-market monitoring plan to track system performance once in use
• An incident reporting mechanism for serious incidents or malfunctions

A note on conformity assessment: the formal conformity assessment for a high-risk AI system is the provider's obligation, not the deployer's. The provider must produce an EU declaration of conformity and, for most Annex III categories, self-certify compliance before placing the system on the market. Deployers do not need to commission their own conformity assessment. What deployers must do is verify that the provider has completed theirs, by checking for the EU declaration of conformity and the instructions for use. Deployers must then maintain their own records of use, monitoring, and any issues reported to the provider, under Article 26.[6]

These are not paper compliance exercises. Each requires a functioning operational process, not just a policy document. The risk management system must be integrated into how the AI system is actually used. Human oversight must be genuinely exercisable, not nominal.

In summary

The obligations require operational governance, not just documentation.

What about AI systems already in use before August 2026?

The Act includes transition provisions for systems already in deployment. Under Article 111, high-risk AI systems already placed on the market or put into service before the applicable compliance date have a further period to come into conformity, provided they have not undergone significant changes.[1] Under the original text, this meant systems in use before 2nd August 2026 had until 2nd August 2027. Following the political agreement, the transition dates will shift accordingly: the precise provisions will be confirmed when the formal amending text is published.

For organisations currently operating high-risk AI systems, the practical question is not whether you are exempt, but how to use the available time effectively. The earlier you begin, the more robust your governance will be.

In summary

Transition provisions exist but do not remove the obligation. They provide time to comply, not permission to delay indefinitely.

Key takeaways

• Following the political agreement of 7 May 2026, the EU AI Act's Annex III high-risk AI system obligations are now planned to become enforceable on 2nd December 2027 for stand-alone systems, and 2nd August 2028 for AI embedded in regulated physical products.
• Regulated Irish SMEs in financial services, HR technology, and health tech are among the sectors most directly in scope.
• The obligations apply to deployers, not just to organisations that build AI systems.
• Compliance requires operational governance: risk management, human oversight, and documentation that reflect how the system is actually used.
• Organisations already using high-risk AI systems before the deadline have transition provisions, but not an indefinite exemption.

In summary

The December 2027 deadline applies to AI systems already in use, not only new deployments. Organisations that have not yet assessed their position have time to act, and the time to start is now, not in late 2027.

What to do now

If you are not certain which of your AI systems fall into the high-risk categories, or whether your current governance meets the required standard, the right starting point is a structured compliance assessment. The revised December 2027 deadline means you have the opportunity to build governance that will genuinely hold up, not a rushed checklist produced under pressure.

For a detailed explanation of what a Fundamental Rights Impact Assessment involves and who needs one, see what is a Fundamental Rights Impact Assessment and who needs one. If your AI tools also raise data residency questions, see EU data residency and AI tools: what every Irish SME needs to know. For financial services firms, see Does your financial services firm have an AI register? for a practical guide to the internal documentation Article 26 requires. For organisations deploying AI agents connected to live business systems, see AI gone rogue, or AI governance gone missing? for the eight governance controls that need to be in place before an AI agent can act on your behalf.

A Clear Gate Systems EU AI Act Compliance Audit identifies which of your AI systems are in scope, what governance needs to be in place, and the most practical sequence for building it.

Book a discovery call to discuss what this would involve for your organisation.