The EU AI Act delay comes with a catch most organisations have missed. 

The EU AI Act delay is real. The hard deadline is not.  

Most people reading this will have seen the headline by now. The EU AI Act’s high-risk system obligations have been pushed back by up to 16 months depending on how your systems are configured. Standalone systems now have until December 2027. Those embedded into products have until August 2028. After months of pressure from industry and several EU member states, the European Parliament and Commission reached a provisional agreement this week under the Omnibus VII package. 

If you felt some relief, that is a reasonable response. But one part of the Act just moved closer, not further away. 

The AI content disclosure deadline just moved to 2 December 

While the high-risk deadline extended, the obligation to label AI-generated content tightened. Providers now have until 2 December this year to ensure that content predominantly generated by AI is identifiable as such, and the grace period that previously gave six months has been cut to three. 

Think about what that looks like inside your company. The LinkedIn post your communications team drafted in ChatGPT and sent to a client. The regulatory briefing written with Copilot. The proposal where someone used Gemini to structure the argument, tidied it up and put the company name on it. By 2 December, content that is predominantly AI-generated needs to be identifiable as such at the point it reaches an audience. Eight months away, and for most companies there is currently no process to track which content was AI-produced, by whom, using which tool, or where it ended up. 

What “predominantly AI-generated” means for your team 

Here is where that phrase becomes important. The Commission has not yet defined where the threshold sits, and the guidance has not caught up with how your people are actually working. 

A post written entirely in ChatGPT and published unchanged is clearly in scope. A compliance officer who uses Copilot for a first draft, rewrites the structure and applies fifteen years of regulatory judgment before publishing is somewhat harder to define. The intent behind the obligation is transparency to the audience, not a trap for teams using AI thoughtfully as part of a human editorial process. But intent is not a compliance defence, and the threshold question will not stay undefined for long. 

The practical question is not whether each piece of content needs a disclaimer at the bottom. It is whether you could evidence, if a regulator asked, which content your company published was AI-generated, which tool produced it, who had oversight of it and where it ended up. That evidence either exists or it does not, and right now, for most companies, it does not. 

The European Parliament wrote the AI Act. Then switched off its own AI tools. 

In February 2026, the European Parliament disabled AI features on the work devices of its own lawmakers and staff. The reason given by its IT department was that it could not guarantee the security of data being sent to AI tools, and that the full extent of what information is shared with those tools was, in its own words, “still being assessed.” 

This is the institution that enacted the EU AI Act acknowledging that it did not have sufficient visibility into what its own people were doing with AI tools to be confident about the data flows involved. The Parliament’s response was to switch things off. That is one answer. Building the infrastructure to govern AI use properly is another, and it is the one that serves your people and your obligations. 

The SEC collected $2 billion for the same governance gap in a different channel 

The governance gap underneath all of this is not new. It is the same pattern that cost financial firms over $2 billion in SEC penalties since 2021, applied to a channel growing faster than any that came before it. Firms that could not produce records of what their people were doing in off-channel communications found that regulators were not interested in the explanation. They were interested in the evidence. AI interactions are now that channel, and the absence of a record will be treated the same way.

Those firms were not careless companies. Many had policies and training programs. What they did not have was infrastructure that captured what their people were actually doing in channels that had grown faster than their governance had. Employees were conducting business over WhatsApp and personal messaging apps, nobody could produce the record when asked, and the channel that had been invisible to compliance turned out to be the violation. The rules did not change. The channel changed, and the governance did not keep up. 

Your employees are using ChatGPT, Microsoft Copilot, Claude and Google Gemini today, and 73% of companies in regulated industries have already paused or slowed Copilot rollouts because of data exposure concerns. The ones that pressed ahead without governance infrastructure are carrying the same exposure the WhatsApp firms carried before their examinations arrived. The EU AI Act will ask for the same kind of evidence, and the companies that cannot produce it will find that the extended timeline made no difference to their exposure. 

The two questions your company cannot currently answer 

There are two questions a regulator will ask when EU AI Act enforcement arrives. What data is your AI operating on, and what are your people doing with it. Most companies cannot answer either cleanly right now, and the gap between those two questions is where genuine AI governance lives. 

The first is a data problem. Copilot and other AI tools ground their responses in what sits inside your governed estate. If years of email history, decisions, advice and client correspondence remain in a legacy archive outside Microsoft 365, those tools are working from a partial picture and presenting it as complete. That is a governance failure, not just a productivity gap, and if Copilot is informing regulatory submissions or compliance decisions on incomplete data, the incompleteness is part of the risk. Transvault Intelligent Migrator brings that history into the governed estate compliantly, with full chain of custody and metadata preserved throughout, so the foundation the AI is working from is accurate, auditable and complete. 

The second is an evidence problem. Those AI interactions your people are having every day are happening in channels that carry no capture, no attribution and no audit trail, and Transvault Intelligent Ally captures them across ChatGPT, Microsoft Copilot, Claude and Google Gemini, attributing every interaction to a named user with full metadata and retaining that record on your own infrastructure. When 2 December arrives and the question shifts from “should we label AI content” to “can you show us which content was AI-generated, by whom and where it went,” that record is the answer. When December 2027 arrives and high-risk system obligations come into force, the companies with two years of captured, attributed AI interaction records will be in a fundamentally different position from those who started building them the month before enforcement. 

The European Parliament’s IT team concluded it could not guarantee where data was going when its people used AI tools. Together, these two products answer both questions that conclusion leaves open. 

The window is open. It will not stay open. 

The extended timeline is a genuine opportunity, but 2 December is eight months away and the governance infrastructure most companies need does not yet exist. Getting AI governance right means getting both sides right: the historical data your AI tools are operating on, and the new interactions your people are having with those tools every day. Companies that address one without the other are solving half the problem and calling it done. 

The ones that come through this well are building now, on both fronts. The evidence you put in place over the next eighteen months will look very different from what you scramble to produce under pressure. 

That is a much simpler conversation to have today than in December 2027.