On July 31, 2026, a European company running an AI system classified as high-risk under Annex III of the EU AI Act has one day left. Not one month, not one week. One day. That is the state of the calendar as I write, and unless something changes at the Council in the next four weeks, it will still be the state of the calendar on the morning of August 1.
What the industry believes, and what the law says
Ask a CIO or a general counsel today whether the August 2 deadline is real, and half will answer no. They will point to the Digital Omnibus, a provisional agreement reached at the Council on May 7 that proposes to defer Annex III obligations to December 2, 2027. Sixteen months of extra runway. Enough time to breathe.
There is one problem. The Digital Omnibus is not law. It is a political agreement between member states that has not yet completed the ordinary legislative procedure. Trilogue is not done. Formal adoption has not happened. And the Council's own timeline, at the time of writing, does not have adoption before the fall.
So the practical situation on July 2 is this. August 2 remains the operative date. The proposed deferral to December 2027 is real as a signal, not real as an obligation. It is a horizon, not a floor.
The asymmetric bet
I have watched enough regulatory cycles to know the pattern. When a deferral is proposed but not adopted, most enterprises make one of two bets.
The first bet is to plan for August 2 anyway. This is what the compliance and risk functions want. It is expensive in the short run and boring in the medium run, because if the deferral goes through, you have spent months on a deadline that shifted. But it wins in both scenarios. If August 2 holds, you are ready. If deferral passes, you have used the runway to be more than ready.
The second bet is to plan for December 2027. This is what the CFO wants. It saves money now. It loses in one scenario. If August 2 holds, you have thirty-one days to close gaps that most enterprises took eighteen months to identify, and you are looking at fines of thirty-five million euros or seven percent of global turnover, whichever is higher.
That is not a fair coin. One outcome costs you money and time. The other outcome costs you the business.
If deferral doesn't happen, you have thirty days. If deferral happens, you have prepared. Every day you don't prepare, you are betting on the second outcome.
What the thirty-one days are actually for
In four weeks, no European enterprise starting from zero is going to build a full AI Act compliance program. That much is true. But there are three things that are achievable in that time, and that materially reduce the exposure regardless of what the Council decides.
The first is the inventory. Most of the fine risk lies not in the systems you know you have, but in the systems that quietly slipped into production over the last three years, inside HR tooling, credit models, access control, quality inspection. If nothing else, in the thirty-one days you can produce an honest inventory of every AI system you are operating or deploying, cross-referenced against Annex III.
The second is the classification. For every system on the inventory, classify it against the four AI Act categories, prohibited, high, limited, minimal. The classification itself is not compliance, but it is the document a regulator asks for on day one of an inquiry. Not having one is what turns a routine audit into a case.
The third is the disclosure posture. On August 2, if any of your high-risk systems interact with users, the Act requires transparency about the AI use. Whether you have the full conformity dossier or not, having a disclosure statement ready is thirty percent of the practical risk reduction, with less than five percent of the effort.
Why this matters for your business
The last two months before a regulatory deadline are, in my experience with GDPR and MiFID and Basel III, the months where most of the value gets destroyed by wishful thinking. The clients I have seen weather these transitions well did the same thing every time. They prepared for the harder outcome and were pleased when they got the easier one.
If the Council formally adopts the deferral in October, you will be ready sixteen months early, and you will have a competitive advantage in every procurement conversation with a customer who is not. If deferral does not pass, you will not be the CEO whose CFO is on the phone with the outside lawyer at eleven on the evening of August 1.
Thirty-one days. Plan for the calendar you can see, not the one someone told you might come.
— Pan