What AI-Assisted Legal Tools Owe the AI Act Right Now
A political agreement pushing the EU AI Act’s high-risk obligations out to December 2027 has led a lot of firms to file the whole regulation under “next year’s problem.” That reading is wrong. The deferral covers one specific chapter of the Act. Several other obligations were never touched by it, and some of them are already in force for firms using AI research and drafting tools today.
The practical risk is a firm that quietly stops all AI governance work, only to discover that transparency duties and obligations on general-purpose AI providers, whose models often sit underneath a legal research tool, were never part of the postponement. This article sets out what the deferral actually covers for law firms, what it leaves untouched, and what that means for AI governance work that should already be underway.
Executive Summary
The Digital Omnibus amendment to the EU AI Act deferred the application of high-risk system obligations, currently to December 2027, in response to unfinished technical standards. That deferral is real and specific: it applies to Chapter III. It does not touch the Act’s prohibited-practice bans, its obligations on providers of general-purpose AI models, or its transparency requirements, several of which are already binding on firms using AI tools today. For firms building AI governance programmes, the 2027 date is the wrong deadline to plan around if the goal is treating every obligation as still-pending.
Key Takeaways
- Only Chapter III high-risk system obligations were deferred, not the whole Act. Whether a specific legal AI tool is classified as high-risk is a separate question from whether other obligations already apply.
- Transparency obligations under Article 50 were not delayed and are already active. Disclosing AI-generated content to clients is a current obligation, not a future one.
- Obligations on general-purpose AI model providers were untouched by the deferral. Many legal AI tools sit on top of general-purpose models, and those underlying obligations predate the delay entirely.
- Prohibited AI practices remain banned regardless of the high-risk timeline.
- Governance infrastructure built now for transparency and documentation carries forward into any future high-risk classification, rather than requiring the work to be done twice.
What the Digital Omnibus Actually Deferred for Legal AI Tools
The deferral mechanism was introduced because the technical standards needed to operationalise high-risk obligations were not ready in time, not because the underlying policy goals changed.
A Targeted Delay to Chapter III, Not a Reset of the Act
The postponement applies to conformity assessment and the fuller compliance regime that Annex III systems are subject to. Everything outside that chapter proceeds on the timeline the Act originally set.
Backstop Dates Exist Precisely Because Standards Are Still Catching Up
The new date functions as a backstop, with December 2027 as the outer limit regardless. Regulators expect firms to keep preparing during the extension rather than treat it as an open-ended pause.
What Is Already in Force for Law Firms, Deferral or Not
Several obligations sit outside Chapter III entirely and have applied on their original schedule.
General-Purpose AI Model Obligations Predate the Deferral Entirely
Providers of general-purpose AI models, which underpin many legal research and drafting tools, have been subject to documentation, transparency and safety obligations since before the Digital Omnibus was even proposed.
Transparency and Disclosure Duties Are Live Now
Requirements that people be told when they are interacting with an AI system, or that AI-generated content be labelled, applied on the Act’s original schedule and were not moved by the Omnibus.
Why Treating the Delay as a Pause Costs More Later
A firm that stops all AI governance work because “the deadline moved to 2027” is discarding groundwork that would have made the eventual high-risk deadline easier to meet.
Documentation and Logging Built Now Are Not Wasted Work
The record-keeping and access control capability that high-risk systems will eventually need overlaps substantially with what transparency obligations already require.
Building AI Governance Around What Actually Applies Today
The practical starting point is separating the AI Act obligation calendar into what is live now and what is on a backstop timeline extending into 2027, prioritising governance work against the first list immediately.
How a Data Control Plane Supports AI Governance Obligations Already in Force
The Kiteworks Data Control Plane applies data-aware, zero-trust controls to every action any user or AI agent takes across every channel, and captures each one in a tamper-proof, unthrottled audit log that feeds directly into SIEM tooling. Because logging is complete and never sampled, firms can produce the detailed, queryable record of AI-related data access that current transparency obligations expect.
Firms that want to see how continuous, cross-channel evidence supports their current AI governance obligations can schedule a custom demo.
Frequently Asked Questions
Only the high-risk system obligations in Chapter III were deferred to December 2027. The deferral does not reset the entire Act or affect other chapters.
Yes, transparency and disclosure duties, including labeling AI-generated content and informing clients of AI interactions, are already in force and were never postponed.
Yes, providers of general-purpose AI models that underpin many legal AI tools remain subject to documentation, transparency, and safety obligations that predate the deferral.
Because prohibited practices, transparency duties, and GPAI obligations are already active, and documentation and logging work done now directly supports future high-risk compliance without duplication.