The Deadline Moved. The Requirement Didn't.
On 27 July 2026 the EU's Digital Omnibus moved the AI Act's high-risk obligations from 2 August 2026 to 2 December 2027. The requirement did not change — only its date. Software that stores a deadline as a field survives that. Software that hard-codes the date has to be rebuilt. That difference is what we mean by compliance as infrastructure.
What actually happened
The Digital Omnibus on AI entered into force on 27 July 2026, amending the AI Act before its most consequential deadline arrived. Obligations for standalone high-risk systems under Annex III slipped from 2 August 2026 to 2 December 2027. High-risk AI embedded in products already covered by EU product-safety law, under Annex I, slipped to 2 August 2028.
Two things did not slip. The Article 50 transparency duties — tell people when they are talking to a machine, mark content that a machine generated or altered — became applicable and enforceable on 2 August 2026 as originally scheduled, and the 2 December 2026 marking deadline inside them is untouched. And on the same day the European AI Office gained the power to actually enforce the general-purpose-model obligations that had been nominally binding since August 2025, with penalties reaching the greater of €15 million or 3% of worldwide turnover.
So the headline is "delay," and the substance is a split: the duties about capability got a longer runway; the duties about disclosure and provenance did not.
Two ways to read a moved deadline
The first reading is relief — sixteen extra months, defer the work. The second is that a regime willing to move its dates by sixteen months on four months' notice is a regime whose dates are the least stable thing about it. Anyone who spent 2026 building toward 2 August as an event now has a system pointed at a date that no longer exists.
We think the second reading is the operating one, and it generalizes well past Brussels. Every regulated business we build for lives with this. California's legislature reopens the compliance surface annually. Cannabis regulators revise track-and-trace rules mid-cycle. Evidence law is being rewritten around digital records right now. The specific rule you comply with today is a snapshot; the fact that there is a rule, with a citation, a jurisdiction, an effective date and a deadline, is the durable part.
A deadline is data. If your product treats it as code, every amendment is a release.
The requirement was never the date
This is the practical form of an argument we've made before: an operating system for an industry is the thing that captures the work, proves it, schedules it, routes it, and holds up under scrutiny. Scheduling is the part everyone underestimates, because scheduling looks like a calendar feature until the calendar's contents are legislated by someone else.
LegiOS is built on that separation. It generates a compliance snapshot for a specific California business — entity type, headcount, locations, what you do — and every obligation in it carries its citation, jurisdiction, effective date and deadline as fields, not as prose. When Sacramento moves a date, that is an edit to a record, and the calendar of what's due re-derives from it. LegiOS does not cover the EU AI Act; it covers California small businesses. The architectural point is the transferable one: an obligation modeled as a dated, cited record absorbs an amendment. An obligation modeled as a hard-coded milestone does not.
The same property shows up in LeafIQ, where the compliance trail rides along with routes, orders, deliveries and AR rather than living in a separate binder that someone has to remember to update. The record of the work and the record for the regulator are the same record. That is what makes them survive a rule change together.
Article 50 is the tell
Of everything on the AI Act's calendar, the obligations Europe declined to defer were the ones about disclosure and provenance. That is not an accident of drafting. Capability requirements — risk management systems, conformity assessments — are expensive to build and reasonable to phase in. Provenance requirements are closer to a property of the record itself, and they are getting harder to postpone everywhere, from the AI side and from evidence law simultaneously.
LeoLog is our direct bet on that convergence. Every entry is hashed with SHA-256 and encrypted on the device before anything leaves it, then anchored on-chain — Base for fast confirmation, Bitcoin via OpenTimestamps for durable finality. The content never touches the chain; only the fingerprint does. Each anchored entry exports a Certificate of Existence and a proof bundle that anyone can check at verify.leolog.io without a LeoLog account, and the records are built against FRE 902(13)–(14) and eIDAS 2.0. Different statute, same shape of demand: show that this existed, in this form, at this time, and let someone else verify it without trusting you.
Rules you can watch refuse to break
The strongest version of this is not a field in a record — it's a constraint in the schema. Casebound, our matter and drafting system for small law firms, is built so that a matter cannot open without a cleared conflicts check, and a draft produced by its Lexwright engine cannot reach a client without a recorded attorney disposition. Every mutation is audited, including from an admin. Those are not policies documented in an onboarding deck; they are conditions the database enforces, which means they hold on the Friday afternoon when someone is in a hurry.
That discipline is the same one we've written about as bounded scope and database-enforced rules, and it's the reason MagenticOS governs agents with typed capabilities rather than instructions — argued at length in Inspectable by Default. It's the same instinct MacroSavant applies to markets on its weekly Substack: a rule you wrote down beforehand beats a confident judgment made under pressure.
What to do with sixteen months
Not wait. The organizations that will find December 2027 easy are the ones that spend the interval turning obligations into records — citation, jurisdiction, effective date, owner, evidence — and turning the load-bearing ones into constraints their systems enforce. The date will probably move again. The requirement to know what applies to you, prove you did it, and show your work to someone who doesn't trust you has not moved once in this entire cycle, in any jurisdiction, in any of the industries in transition we build for.
Build for the requirement. Store the date.
We publish here as we learn. Subscribe by RSS, or write to hello@mutagenic.io.