Juan Piaggio · 2026-08-13 · 7 min read · ai · governance · compliance
This month was supposed to be the reckoning. On 2 August 2026, the EU AI Act's high-risk obligations were set to bite for exactly the systems finance has been shipping fastest: credit scoring, creditworthiness assessment, insurance risk pricing. Instead, the Digital Omnibus pushed the date to 2 December 2027, and the industry exhaled.
That exhale is the mistake. Not because the delay isn't real, but because of what teams typically do with sixteen months of runway.
The deferral was narrower than the relief suggests. It targeted the high-risk regime specifically and left the rest of the timeline alone.
| Obligation | Applies from | Changed? |
|---|---|---|
| GPAI models (Arts. 51–56) | 2 Aug 2025 | No |
| Transparency (Art. 50) | 2 Aug 2026 | No |
| Annex III high-risk — credit, insurance | 2 Dec 2027 | Deferred from 2 Aug 2026 |
| Annex I high-risk — embedded in products | 2 Aug 2028 | Deferred from 2 Aug 2027 |
So if you deploy a credit scoring model, your Annex IV documentation, conformity assessment, and EU database registration slid by sixteen months. But your Article 50 disclosure duties did not, the AI literacy obligation has been live since February 2025, and the exposure when the high-risk rules do land is up to €15 million or 3% of global turnover, whichever is greater.
The scope is also wider than most teams assume. Annex III point 5(b) covers any system that evaluates the creditworthiness of a natural person — not just the scorecard. Behavioural models, affordability engines, and the agent that drafts the recommendation a human then signs all sit inside it.
Most compliance work is retroactive-friendly. You can write technical documentation in November 2027 for a model you shipped in 2026. You can commission a conformity assessment late. You can register in the database the week before.
Record-keeping is different. Article 12 requires high-risk systems to log automatically over their lifetime, and Article 72 requires post-market monitoring that draws on real operational data. On 2 December 2027 you do not need a system that starts logging. You need a system that has been logging. The same is true of Article 14 human oversight: proving that a person could meaningfully intervene means producing the decisions where they did.
There is no way to generate that history in arrears. Sixteen months of evidence either exists or it doesn't.
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 800 200" role="img">
<title>The records you need in December 2027 come from the system you are running today</title>
<text x="4" y="14" font-size="11" fill="var(--text-muted)">August 2026</text>
<text x="636" y="14" text-anchor="middle" font-size="11" fill="var(--ink-1)">2 Dec 2027</text>
<path d="M636 22 V182" stroke="var(--text-muted)" stroke-width="1.5" stroke-dasharray="5 4" fill="none" />
<rect x="4" y="36" width="624" height="48" rx="8" fill="var(--primary-50)" stroke="var(--primary-600)" />
<text x="316" y="57" text-anchor="middle" font-size="11" fill="var(--primary-600)">INSTRUMENT NOW</text>
<text x="316" y="76" text-anchor="middle" font-size="14" fill="var(--ink-1)">16 months of logs, oversight decisions, monitoring data</text>
<rect x="646" y="36" width="150" height="48" rx="8" fill="var(--sand-1)" stroke="var(--success)" />
<text x="721" y="65" text-anchor="middle" font-size="14" fill="var(--ink-1)">Evidence exists</text>
<rect x="4" y="120" width="624" height="48" rx="8" fill="var(--sand-1)" stroke="var(--border)" stroke-dasharray="6 4" />
<text x="316" y="141" text-anchor="middle" font-size="11" fill="var(--text-muted)">WAIT FOR THE DEADLINE</text>
<text x="316" y="160" text-anchor="middle" font-size="14" fill="var(--ink-1)">Nothing recorded</text>
<rect x="646" y="120" width="150" height="48" rx="8" fill="var(--sand-1)" stroke="var(--warning)" />
<text x="721" y="149" text-anchor="middle" font-size="14" fill="var(--ink-1)">Starts from zero</text>
</svg>
Here is the part that makes the delay genuinely good news rather than an invitation to drift. Strip the legal framing from the Annex III requirements and you are left with a list most teams would build anyway to keep an AI system in production honest:
None of that is regulatory overhead bolted onto a working system. It is the instrumentation that tells you whether the system works at all. Adoption numbers make the point: roughly 56% of finance leaders now report using AI, but only around 17% have it in core workflows. The gap between pilot and production is almost entirely a trust gap, and trust is built from exactly these four artifacts.
We built Meshworq's governance layer on that premise before any deadline applied to us. Every agent decision is written to an append-only ledger tagged with a correlation identifier, so the inputs, the action, the confidence, and the human steps that followed can be pulled up as one record. Proposals are risk-scored, and anything scoring HIGH routes to a human approval queue with an SLA timer and automatic escalation rather than applying itself. That wasn't a compliance project. It was the only way to let agents touch real work without losing the thread.
Treat the deferral as budget, not amnesty. A reasonable sequence:
The Digital Omnibus bought finance teams sixteen months, and the temptation is to spend them not thinking about this. The better read is that the deadline moved but the evidentiary requirement didn't: on 2 December 2027 you will need to show a history, and histories are only ever written forward. Start the ledger, make the human approval step meaningful, and let the documentation wait. Do that and the deadline arrives as a formality rather than a scramble — and you get a system you can actually trust in the meantime, which was the point before any regulator said so.