What the EU AI Act Delay to December 2027 Means for M&A Deals

Last reviewed: November 5, 2026.

This article is for general information only. It is not legal advice. Deal teams should take advice from counsel qualified in the relevant jurisdictions before relying on any of the rules discussed here.

Short answer

In the EU, the heavy high-risk duties for Annex III AI systems, including employment and worker-management tools, now apply from 2 December 2027, not August 2026. That comes from Regulation (EU) 2026/1744 (the Digital Omnibus on AI), in force since 27 July 2026, which amended the AI Act (Regulation (EU) 2024/1689). The delay gives vendors and deployers more time. It does not pause GDPR, pre-close competition limits, or the AI Act prohibitions and GPAI rules already in force. For deals, the question is whether the target's AI stack and compliance path will be ready by December 2027, and what that gap is worth at signing.

What exactly was delayed under the AI Omnibus?

The Digital Omnibus on AI is Regulation (EU) 2026/1744 of 8 July 2026. It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. The European Commission's AI Act overview and its 27 July 2026 notice summarise the same timeline.

What moved is Chapter III, Sections 1-3 of the AI Act, the main high-risk obligations (risk management, data quality, logging, documentation, deployer transparency, human oversight, robustness and cybersecurity), for:

• Annex III systems (standalone high-risk use cases, including employment): to 2 December 2027
• Annex I / Article 6(1) systems (AI as a safety component in regulated products): to 2 August 2028

What did not move matters as much. Most Article 5 prohibitions have applied since February 2025. GPAI model rules have applied since August 2025. The AI Act's general application date of 2 August 2026 still sits on the calendar. And none of this displaces the GDPR.

Annex III, point 4 covers AI intended for recruitment or selection; decisions on promotion or termination; task allocation based on individual behaviour or traits; or monitoring and evaluating performance and behaviour at work. That is the category deal partners and HR-AI vendors need to read carefully.

What does the delay mean for vendors of AI used in employment, HR or people contexts?

If you build or sell AI intended to recruit, select, promote, terminate, allocate tasks on individual traits, or monitor and evaluate individual performance and behaviour, you are looking at an Annex III high-risk system. The Omnibus gives you until 2 December 2027 before full Chapter III obligations apply. That is real runway for standards, documentation, human oversight and conformity work that was not ready for an August 2026 cliff.

It is not a reason to stop. Buyers and sophisticated deployers already ask for the artefacts the Act will require: intended purpose, risk files, logging, human review, bias testing and clear use limits. Vendors that wait until late 2027 will look late in every 2026 diligence questionnaire.

Classification turns on intended use, not on the marketing label. A tool sold for individual hiring, flight-risk scoring, pay banding or performance ranking is in a different place from a tool designed for aggregated, team-level analysis that is contractually barred from selection, retention, pay or performance decisions. The first is the Annex III employment pattern. The second may sit outside that pattern, but that is a counsel question, not a slogan.

Between now and December 2027, the useful work is the boring work: a one-page intended purpose (and what the system is not for), logging and human-oversight design, and GDPR discipline on every training and storage choice. Waiting until the rule applies is how vendors fail diligence questionnaires in 2026.

What does the delay mean for AI adoption in general?

The Omnibus is a simplification and sequencing measure, not a retreat from AI regulation. The Commission's own framing is that high-risk rules should apply when standards and support tools are actually available. For most organisations, that means three things in practice.

First, adoption can continue, and in many categories it should. Document review, drafting assistance, meeting summarisation and scoped diligence Q&A are not automatically Annex III employment systems. They still need governance: approved tools, no public-model uploads of confidential deal data, human verification of outputs, and clear ownership of exceptions.

Second, the compliance clock is visible. December 2027 is close enough that any multi-year AI roadmap in Europe has to land high-risk employment and worker-management use cases in a compliant state by then. Boards that treat the delay as "we can ignore this until 2028" will create a backlog that shows up as remediation cost, contract renegotiation and delayed product launches.

Third, other law did not wait. GDPR, sector rules, employment law and the AI Act provisions already in force all apply today. The Omnibus answers one calendar question. It does not answer whether you can put a target's employee files into a consumer chatbot.

What does the delay mean for deals and M&A?

This is where the calendar becomes a deal issue.

Diligence on AI-using targets

If the target uses or sells AI that touches hiring, workforce management, performance, task allocation or individual behavioural monitoring in the EU, map those systems against Annex III point 4 now. For each system: documented intended purpose; individual HR decisions or aggregated insight only; controller/processor and lawful basis; path (people, budget, vendors) to Chapter III readiness by 2 December 2027; and which customer or employment contracts would break if the product had to change.

A target with no inventory, no intended-purpose statements and no budgeted plan is not "early". It is carrying a known compliance project into the hold period. Price it.

Compliance readiness as valuation and integration risk

Between signing and December 2027, someone finishes that work. In a platform roll-up, that is often the operating partner. Cost shows up as product delay, customer renegotiation, restricted EU go-to-market, or a forced redesign away from individual decisioning. Those are IC-memo items. Integration plans should name the owner, the in-scope systems, and what "done" means before 2 December 2027. Combining two HR-tech stacks inherits the worse gap.

GDPR still applies now, including in the data room

Sharing target employee personal data in a virtual data room is processing under the GDPR. Typical diligence practice, reflected in firm guidance and in the UK ICO's data-sharing discussion of mergers, is a lawful basis (often legitimate interests under Article 6(1)(f), with a recorded balancing test); minimisation, redaction and aggregated packs; avoiding special-category data unless an Article 9 condition clearly applies; a DPIA where risk is high; Article 28 terms for the VDR and any AI vendor; and need-to-know access. The AI Act delay does not soften any of that.

Pre-close limits: gun-jumping and clean teams

Separately from privacy law, EU merger control still treats the parties as independent until closing. Sharing competitively sensitive information outside a properly designed clean team can contribute to gun-jumping findings, a theme in the Commission's Altice/PT Portugal approach and later competition commentary. Clean teams should be named, non-operational where buyer staff are included, bound by protocol, and limited to what valuation and legitimate integration planning require. If the data should not reach operational staff, it should not reach an unscoped model either.

Vendor contracts, MSAs and people risk

Sellers and buyers are already rewriting NDAs around AI: ban public-tool uploads; allow only named enterprise tools with no training on inputs; treat submission to an AI system as a disclosure. Silence in a vendor DPA on training, retention or subprocessors is the risk.

Separately, customer MSAs that restrict AI on the customer's work can break an AI-cost-out synergy before close. Read those clauses against the thesis, not only for classic legal risk.

And AI still does not show whether teams below the C-suite can deliver the plan. Where people AI is used around a deal, the safer design, and the one further from Annex III employment decisioning, is team-level analysis in groups large enough to protect anonymity, with nobody named, findings as associations not causes, and a ban on selection, retention, pay or performance use. That is how I think about the problem at HumanaQ. The delay does not change that design; it makes the design harder to ignore.

Timeline at a glance

Date	What applies
2 Feb 2025	Most AI Act prohibited practices; AI literacy duty (later softened by the Omnibus)
2 Aug 2025	GPAI model obligations and governance rules
27 Jul 2026	Digital Omnibus on AI (Regulation (EU) 2026/1744) enters into force
2 Aug 2026	General application of the AI Act, including many transparency rules
2 Dec 2026	Additional Omnibus prohibitions on certain non-consensual intimate / CSAM generative systems
2 Dec 2027	Chapter III high-risk obligations for Annex III systems (incl. employment)
2 Aug 2028	Chapter III high-risk obligations for Annex I product-embedded systems

Sources for the table: Commission AI Act page, Commission Omnibus notice, EUR-Lex Regulation (EU) 2026/1744, EUR-Lex summary of the AI Act as amended, Annex III Service Desk.

This analysis is part of the Under the Hood of M&A newsletter.