The EU moved the AI deadline that governs hiring. It did not move the one that governs your output.

Regulation (EU) 2026/1744 — the Digital Omnibus on AI — was signed on 8 July 2026, published in the Official Journal on 24 July and entered into force on 27 July, days before the AI Act reached its main application date. Bright Defense's compliance timeline records what it did: the high-risk obligations covering stand-alone Annex III systems moved from 2 August 2026 to 2 December 2027, and product-embedded Annex I systems to 2 August 2028. What it did not do is move 2 August 2026 itself. The Article 50 transparency obligations became applicable on that date, Commission enforcement of general-purpose AI model obligations began, and the Commission published its final Article 50 guidelines on 20 July 2026. One grace period closes on 2 December 2026.

The delay covers the systems that rank you

DLA Piper's employment briefing is precise about what sits inside Annex III: recruitment tools, candidate selection, performance evaluation, task allocation, worker monitoring, and decisions on promotion or termination. Those are the systems that were due to carry technical documentation, a risk management process, human oversight design and EU database registration from 2 August 2026. They now carry none of it until 2 December 2027.

Gibson Dunn notes the reason the deadline slipped at all: implementation was visibly off track by late 2025, with national competent authorities undesignated and harmonised standards unfinished. The agreed text replaced the Commission's original conditional trigger with fixed dates — no standards test, just a new calendar.

The consensus reading is that Brussels blinked and European business got relief. That is the employer's reading. The operator's reading is different. The layer of software that screens your CV, scores your output and feeds the next restructuring list has been granted sixteen additional months of running without a documented file, without mandated human oversight, and without a public register entry. If that system misreads you in 2027, there is no conformity dossier to point at.

What switched on lands on a named human

Article 50 applies now, to systems at every risk level. Providers of interactive systems must disclose that a user is dealing with AI where that is not obvious. Providers of generative systems must mark synthetic audio, image, video and text in a machine-readable format. Deployers must disclose deepfakes, and must disclose AI-generated or manipulated text published to inform the public.

Read the exception to that last one carefully, because it is the whole point. The public-interest text disclosure falls away when the material has undergone human review or editorial control and a natural or legal person holds editorial responsibility for it. The regulation's escape hatch is a person willing to put their name on the output.

Enforcement is not theoretical. Bright Defense sets out the exposure: up to 35 million euros or 7% of worldwide annual turnover for prohibited practices, and up to 15 million euros or 3% for other operator violations, including Article 50 transparency failures. Systems placed on the market before 2 August 2026 have until 2 December 2026 for the machine-readable marking requirement under Article 50(2). That is the last dated obligation before the end of the year.

The literacy duty got softer, which moves the cost to you

The Article 4 AI literacy obligation has applied since 2 February 2025. Gibson Dunn reports that the Omnibus softened it: providers and deployers are now required to support the development of AI literacy among staff rather than to ensure a specific level of it.

Support is not outcome. A budget line and a link to a course satisfies support. Nobody in the chain is now obliged to certify that you can operate these systems competently — the duty stops at making training available. Every skills gap that follows is priced as your problem, not your employer's compliance failure.

What the employer must tell you is one of the three employer checks in the afternoon method for your own role; Meta's grading of AI use and the hiring filter moving into the room are the other two, seen from the company's side.

For the person being rated, the guide to reviews that grade your AI use sets out which rules apply now, while these obligations wait: the GDPR on automated decisions, the right to your own data and the ban on reading emotions at work.

Your Next Move

Build the Annex III inventory before you are asked to. List every system in your organisation that touches recruitment, performance evaluation, task allocation, worker monitoring, promotion or termination. For each, write three lines: vendor, whether your employer is provider or deployer, and who currently reviews its output. Send it to your manager and legal. December 2027 is a real date and somebody will have to own that file; the person who wrote the first version owns it.

Name the editorial owner before 2 December 2026. If your team publishes AI-drafted text that informs the public, establish documented human review and a named person holding editorial responsibility now. Ask every generative vendor in your stack whether their outputs carry machine-readable marking and when it was placed on the market.

Book your own training this quarter. The obligation on your employer is support, not competence. Treat their programme as a subsidy, not a plan.