Kuan Archer, Founder and Principal, Archer Innovative Solutions Group LLC.
Most U.S. technology leaders I talk with have filed the EU AI Act away as something happening in someone else’s jurisdiction. For any company with international reach, that is a costly assumption, and the August 2, 2026, milestone on transparency requirements is a good reason to revisit it.
The Act reaches many companies with no office and no staff in Europe. If your AI product touches EU users, or the output of your system is used inside the EU, you are likely a provider or deployer under the law regardless of where you are headquartered.
The recent move to delay parts of the Act has been reported almost everywhere as relief. For most U.S. companies, the delay did not cover the baseline transparency requirements that reach standard U.S. software first.
You Have Seen This Movie Before
If you run technology in California, you already know how a European regulation becomes your operating reality. The General Data Protection Regulation (GDPR) set the template in 2018, and within two years California had produced the first major U.S. analogue in the California Consumer Privacy Act (CCPA), later expanded by the California Privacy Rights Act (CPRA) and followed by a wave of state privacy laws built on the same European architecture.
The AI Act carries that reach through its extraterritorial scope. It applies to providers who place an AI system on the EU market and to providers and deployers outside the EU when the output their system produces is used within it.
A U.S. company serving EU customers does not opt out by pointing to its headquarters. When maintaining a separate, lightly regulated version for one market costs more than meeting the stricter standard everywhere, most teams meet the stricter standard everywhere.
What The Delay Actually Moved
The reporting on the delay has seemingly done readers a disservice by not giving enough scope about what was delayed.
The EU’s simplification package, the Digital Omnibus, defers the high-risk obligations that most compliance teams were racing toward. Under the amended timeline, standalone high-risk systems under Annex III, covering uses such as hiring, credit scoring, education and essential services, move to December 2, 2027, and high-risk AI embedded in regulated products under Annex I moves to August 2, 2028.
What did not move is the part that reaches the widest set of companies. The transparency obligations and the enforcement authority behind them still apply from August 2, 2026.
The headline that the EU delayed the AI Act points to a deadline that moved, while the one that applies to most U.S. companies did not.
The Obligation That Applies First Is A Product Decision
The transparency rules are not paperwork for your general counsel to file; they are serious engineering and product work.
If your application uses a chatbot or any conversational feature, EU users have to be told they are interacting with AI. If your product generates synthetic text, images, audio or video that reaches the EU, that content has to be marked in a machine-readable format, with a short grace window to December 2, 2026 for systems already on the market.
A common pattern I see is a governance document that promises transparency while the product ships without the disclosure logic or the content-marking pipeline to deliver it. Closing that gap takes design and release cycles, which is why it belongs on an engineering roadmap now rather than in a compliance memo later.
The Clock Moved, The Work Didn’t
The deferral to 2027 and 2028 is real breathing room, but that doesn’t mean you should spend the time waiting.
The hard part of high-risk compliance is finding every AI system in your organization and classifying it, and that inventory does not get easier by starting it in 2027.
The underlying liability does not wait either. AI that causes harm in 2026 is still exposed to GDPR and to product-liability and antidiscrimination law that never paused because the AI Act’s high-risk clock did.
The domestic picture is filling in alongside it. Colorado repealed its original AI Act and replaced it with a narrower framework that takes effect January 1, 2027, so a U.S. company will have state AI rules to meet at home while it is still mapping its exposure abroad.
The Bottom Line
Even with these delays, the approach should be to re-baseline rather than pause. Confirm your EU-facing products meet the August 2, 2026, transparency requirements, then use the recovered time to do the high-risk work properly.
California learned with GDPR that a European framework has a way of becoming everyone’s framework. The AI Act is early in that same arc, and the companies reading it correctly today will not be the ones scrambling in 2027.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
