The AI Act Deadline Didn’t Move — Not the Part That’ll Bite You Link to heading

Half my DACH customers relaxed last month. They read “EU AI Act high-risk rules delayed to 2027” and quietly stood their compliance programs down.

That’s a mistake, and it’s worth being precise about why.

The Digital Omnibus split the August 2, 2026 deadline into two piles. One moved. The other — the one most likely to touch a mainstream business — did not. And this is no longer a proposal: the Council gave the amendments final green light on June 29; the delay is binding law, not a rumor you can plan around.

Annex III high-risk obligations slid to December 2, 2027. But Article 50 transparency duties still land on August 2, 2026 — along with the power to fine you up to €15M or 3% of global turnover for breaching them. Same day the enforcement switch flips.

So if you run a chatbot, publish AI-generated content, or ship a product that produces synthetic text, images, audio or video into the EU market, your clock is measured in weeks — not eighteen months.

One nuance worth getting right: if your generative system was already on the market before August 2, the machine-readable marking of synthetic output (Article 50(2)) gets a transitional runway to December 2, 2026. Anything launched on or after August 2 complies from day one. Either way, that’s not much room.

The EU AI Act Evidence Stack: AWS Artifact Assurance Assistant covers the platform you build on, watsonx.governance covers the AI system you build, and Article 50 obligations sit in the gap that’s yours to close Figure: The evidence stack — the platform you build on (AWS Artifact), the AI system you build (watsonx.governance), and the Article 50 gap in the middle that no tool closes for you, all against the August 2, 2026 / €15M–3% deadline.

Here’s the part nobody frames correctly: the AI Act deadline was never a reading problem. Everyone knows roughly what the rules say. The bottleneck is producing auditable evidence fast enough — the SOC reports, the ISO attestations, the model-side control documentation a conformity file or a customer DDQ actually demands. That’s the work that doesn’t fit in four weeks when it’s done by hand.

Two things shipped recently that collapse different halves of that evidence chore. Neither is “AI Act compliance in a box” — anyone selling you that is lying — but stacked together they take a real bite out of the manual work.

The cloud-assurance half: AWS Artifact Assurance Assistant. Announced July 1, it generates citation-backed answers to security and compliance questions about AWS services, grounded in verified AWS documentation — SOC reports, ISO certifications, C5 packages. Two modes: single question, or bulk upload of a questionnaire (it handles CAIQ, SIG, and custom DDQ formats in XLSX). Every answer carries citations you can verify against source material, and it’s free through the Artifact console in all commercial Regions. In plain terms: the “is your underlying infrastructure compliant” evidence you used to raise with your account team and wait days for is now self-serve.

Be honest about its scope, though. This answers questions about AWS’s controls — your cloud substrate. It does not assess your AI system, your model, or your use case. Confusing the two is how you build a false sense of done.

The model-governance half: IBM watsonx.governance. This is where your side of the shared-responsibility line lives — model risk assessment, use-case onboarding, controls mapped to the EU AI Act, ISO 42001, and NIST AI RMF via built-in compliance accelerators. It governs the AI assets you build and deploy — exactly what Article 50, and later Annex III, ask you to document.

Put them side by side and the pattern is clean:

  • AWS Artifact Assurance Assistant → evidence about the platform you build on.
  • watsonx.governance → evidence about the AI system you build.
  • The gap in the middle → your Article 50 obligations: first-contact AI disclosure, machine-readable marking of synthetic output, deepfake and public-interest-text labelling. No tool auto-satisfies these. They’re design and process work.

For a regulated DACH customer running a 60–90 day pre-deadline sprint, the play is straightforward. Use the Assurance Assistant to knock out the cloud-assurance questionnaire in an afternoon instead of a fortnight. Stand up watsonx.governance for the model-side control record. Spend the reclaimed weeks on the Article 50 work that actually requires human judgment — the disclosure design, the marking mechanism, the editorial paper trail.

The uncomfortable takeaway for anyone who stood down: the hardest-to-engineer, broadest-reaching part of the Act is the part that stayed on schedule, fines included. The deferral is real. It just isn’t yours.

The AI Act deadline isn’t a reading problem. It’s an evidence problem — and the evidence tooling just got materially better. What’s the one Article 50 obligation your team hasn’t mapped yet?