Public Sector AI and the Requirements Nobody Postponed
A political agreement pushing the EU AI Act’s high-risk obligations out to December 2027, covering AI used in essential public services and law enforcement, has led a lot of agencies to file the whole regulation under “next year’s problem.” That reading is wrong. The deferral covers one specific chapter of the Act. Several other obligations were never touched by it, and some are already in force for public sector AI today.
The practical risk is an agency that quietly stops all AI governance work, only to discover that transparency duties and obligations on general-purpose AI providers were never part of the postponement. This article sets out what the deferral actually covers, what it leaves untouched, and what that means for AI governance work that should already be underway.
Executive Summary
The Digital Omnibus amendment to the EU AI Act deferred high-risk system obligations, currently to December 2027, in response to unfinished technical standards. That deferral does not touch the Act’s prohibited-practice bans, its obligations on providers of general-purpose AI models, or its transparency requirements, several of which are already binding on agencies today.
Key Takeaways
- Only Chapter III high-risk system obligations were deferred, not the whole Act. AI used in essential public services and law enforcement is an Annex III category, moving to December 2027.
- Transparency obligations under Article 50 were not delayed and are already active.
- Obligations on general-purpose AI model providers were untouched by the deferral. Many public sector AI tools sit on top of general-purpose models.
- Prohibited AI practices remain banned regardless of the high-risk timeline.
- Governance infrastructure built now for transparency and documentation carries forward into any future high-risk classification.
What the Digital Omnibus Actually Deferred for Public Sector AI
The deferral mechanism was introduced because the technical standards needed to operationalise high-risk obligations were not ready in time.
A Targeted Delay to Chapter III, Not a Reset of the Act
The postponement applies to conformity assessment and the fuller compliance regime that Annex III systems, including many public sector AI applications, are subject to. Everything outside that chapter proceeds on the timeline the Act originally set.
Backstop Dates Exist Precisely Because Standards Are Still Catching Up
The new date functions as a backstop, with December 2027 as the outer limit regardless. Regulators expect agencies to keep preparing during the extension.
What Is Already in Force for Agencies, Deferral or Not
Several obligations sit outside Chapter III entirely and have applied on their original schedule.
General-Purpose AI Model Obligations Predate the Deferral Entirely
Providers of general-purpose AI models, which underpin many citizen-facing AI tools, have been subject to documentation obligations since before the Digital Omnibus was proposed.
Transparency and Disclosure Duties Are Live Now
Requirements that citizens be told when they are interacting with an AI system applied on the Act’s original schedule and were not moved by the Omnibus.
Why Treating the Delay as a Pause Costs More Later
An agency that stops all AI governance work is discarding groundwork that would have made the eventual high-risk deadline easier to meet.
Building AI Governance Around What Actually Applies Today
The practical starting point is separating the obligation calendar into what is live now and what is on a backstop timeline, prioritising governance work against the first list immediately.
How a Data Control Plane Supports AI Governance Obligations Already in Force
The Kiteworks Data Control Plane applies data-aware, zero-trust controls to every action any user or AI agent takes across every channel, and captures each one in a tamper-proof, unthrottled audit log that feeds directly into SIEM tooling, giving agencies the detailed, queryable record current transparency obligations expect.
Agencies that want to see how this applies to their current AI deployments can schedule a custom demo.
Frequently Asked Questions
The deferral applies only to Chapter III high-risk system obligations for Annex III categories like essential public services and law enforcement, pushing them to December 2027.
Yes, transparency obligations under Article 50 were not delayed and are already binding on public sector AI deployments today.
Yes, obligations on general-purpose AI model providers were untouched by the deferral, and many public sector AI tools rely on such models.
Prohibited practices remain banned, transparency duties are live, and governance infrastructure built now for documentation carries forward to future high-risk compliance.