EU AI Act High-Risk Deadlines Move to December 2027. Agentic AI Gets Its First Code.

Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and enters into force on 27 July. Coverage has settled on the deferral, which moves full high-risk obligations to 2 December 2027 for standalone Annex III systems and to 2 August 2028 for AI embedded in Annex I products. That is the operative fact for a bank's credit scoring roadmap. For anyone building agentic systems, the more consequential change is a new Annex XIV, where code AIH 0401 carries the phrase "Agentic AI."

The code imposes no obligation on agentic systems. It sets the scope of what a conformity assessment body may be designated to assess. Reading it as regulation of agentic AI would repeat a mistake this publication has made before with permissive regulatory language. What the code does is give the term legal residency in the AI Act, and Annex XIV is amendable by delegated act under the revised Article 30(2).

The dates are now unconditional

The Commission's November 2025 proposal tied the high-risk deferral to an assessment that standards and support tools were ready, which would have left the calendar contingent. The adopted text drops that mechanism. Article 113, third paragraph, point (c) now reads as two fixed dates: 2 December 2027 for systems classified high-risk under Article 6(2) and Annex III, and 2 August 2028 for systems classified high-risk under Article 6(1) and Annex I.

For financial services that is the operative sentence. Annex III point 5(b) covers AI used to evaluate the creditworthiness of natural persons or establish their credit score, with fraud detection carved out. Point 5(c) covers risk assessment and pricing for natural persons in life and health insurance. Both are Article 6(2) systems. Consumer lending models and life and health underwriting models have until 2 December 2027, and the date no longer depends on a Commission readiness finding.

What the agentic code actually covers

Annex XIV organises AI systems into three code families. AIP codes are vertical reference codes linking to the Union harmonisation legislation in Section A of Annex I. AIB codes are new codes for biometric systems under point 1 of Annex III. AIH codes are horizontal technology codes applied alongside the vertical ones, running from symbolic AI and expert systems through machine learning by data modality to generative AI and general-purpose model based systems.

AIH 0401 is the fourth and final horizontal family: "AI systems based on other emerging AI technologies not covered by other codes, including Agentic AI." Agentic AI is named inside the residual bucket, and the regulation supplies no definition of it anywhere in the operative text or the recitals.

The mechanical reach of that code is narrower than the naming suggests. Under Article 43(2), providers of Annex III systems in points 2 through 8 follow the internal control procedure in Annex VI, which does not involve a notified body at all. Annex XIV confirms the boundary by construction, listing AIB codes only for point 1 of Annex III, and recital 43 states that the Annex III side of the code list currently concerns only biometric systems. A bank's agentic credit assistant sits in Annex III point 5. It self-assesses under Annex VI, never engages a notified body, and therefore never engages AIH 0401.

Assessor capacity and delegated powers

The code matters for two reasons. The first is assessor supply. Conformity assessment bodies must use these codes when specifying the types of AI systems in their application for designation under Article 29. Every body that wants to assess agentic systems has to claim AIH 0401, which means the count of bodies claiming it becomes an observable measure of whether third-party assessment capacity for agentic AI exists in Europe. Right now that number is zero, and Article 43(3) as amended gives notified bodies already operating under Section A of Annex I until 28 January 2028 to apply for AI Act designation.

The second reason is the delegated act structure. The revised Article 30(2) empowers the Commission to amend Annex XIV by adding codes, withdrawing codes, or moving a code from one category to another. Article 43(6) of the AI Act as originally enacted already empowers the Commission to subject Annex III points 2 through 8 to the Annex VII notified body procedure by delegated act. Both powers now sit in the Article 97 delegation list. Pulling agentic AI out of the residual bucket into its own code, and moving credit scoring systems into third-party assessment, are each achievable without a new legislative act.

The Omnibus is being read as deregulatory, and on literacy, documentation and timelines it is. On conformity assessment architecture, the Commission holds two delegated-act powers: amending Annex XIV under Article 30(2), and moving Annex III points 2 through 8 into third-party assessment under Article 43(6).

Financial supervisors keep the file

Article 75(1) as amended gives the AI Office exclusive supervisory competence over AI systems built on general-purpose AI models where the model and the system come from the same provider or the same undertaking. Point (iii) of the first subparagraph carves out AI systems provided by law enforcement authorities, border management authorities and financial institutions, insofar as those systems fall under Article 74(6), which assigns market surveillance for financial institutions to the authority responsible for their financial supervision.

A bank that becomes a provider of a general-purpose model based agentic system therefore answers to its prudential and conduct supervisors, not to the AI Office in Brussels. The carve-out is drafted around systems "provided by" financial institutions. Where a bank deploys a vendor's general-purpose model based system and does not cross into provider status under Article 25, the allocation is less clear on the face of the text, and the closing sentence of the amended Article 75(1) extends the AI Office's competence to deployers only where they are also the provider or part of the same undertaking. Firms should treat that as an open interpretive question and raise it with their national competent authority before assuming their supervisor holds the file.

What did not move

The Article 50(2) obligation to mark synthetic audio, image, video and text content still applies from 2 August 2026. The new Article 111(4) gives providers who placed such systems on the market before that date until 2 December 2026 to comply, and that is the only date relief on the transparency track.

The Article 5 prohibitions as originally enacted are untouched and have applied since 2 February 2025. The two new prohibitions, covering AI systems generating non-consensual intimate material and child sexual abuse material, apply from 2 December 2026 under the amended Article 113. The Article 4a legal basis for processing special categories of personal data for bias detection applies from 2 August 2026 per recital 9, though the operative text places Chapter I at an earlier date. The Omnibus extends it to deployers of high-risk systems and to providers and deployers of other AI systems and models. Articles 102 to 110 apply from 27 July 2026.

Relief aimed at SMEs and small mid-caps

Article 4 changes from an obligation to ensure a sufficient level of AI literacy to an obligation to take measures supporting its development, with an express statement that providers and deployers are not required to guarantee any specific level of literacy for any individual. Article 63 extends the simplified quality management system route from microenterprises to all SMEs including start-ups, provided they have no partner or linked enterprises. Article 11(1) requires the Commission to establish a simplified technical documentation form for SMEs and small mid-cap enterprises, and obliges notified bodies to accept it. Points 7 and 9 of Annex VIII Section B are deleted, thinning the registration payload for Article 6(3) systems, though the provider must still document the Article 6(3) assessment before placing the system on the market and national competent authorities may demand it. Article 99(6a) caps fines for small mid-caps at the lower of the percentage or the fixed amount.

None of these provisions reaches a large bank directly, and all of them reach the vendors selling into one. A compliance software provider that qualifies as an SME or small mid-cap may now file simplified technical documentation and run a simplified quality management system, which changes what a buyer receives in a due diligence pack. The correct response is to ask suppliers whether they are claiming SME or SMC treatment under the amended Articles 11 and 63, and to price the documentation gap accordingly.

What's next

The Commission must adopt delegated acts under the new Article 2(13) by 2 August 2027 specifying where Chapter III requirements may be limited because Section A of Annex I already provides equivalent protection. Guidelines on the practical implementation of Articles 8(2), 9(10) and 17(3) are due by 1 August 2027 under the new Article 96(1)(g). Post-market monitoring guidance including a voluntary template is due by 2 September 2027 under the amended Article 72(3), replacing the removed empowerment to mandate a harmonised template. National regulatory sandboxes must be operational by 2 August 2027, and the AI Office may now establish a Union-level sandbox under the new Article 57(3a) with priority access for SMEs and SMCs.

If the Commission exercises Article 30(2) to lift agentic AI out of the residual code and give it a family of its own, that would be the first substantive signal that Brussels treats agentic systems as a distinct assessment problem. Any such delegated act would take effect through the Article 97(6) non-objection procedure, not a Parliamentary vote.