AI Compliance Trends 2027: What the EU AI Act Delay Does and Doesn't Change for PE Portfolios

Key Takeaways

• The delay is real, and it is narrow. The Digital Omnibus moved the high-risk rules to December 2027 and August 2028. Transparency, prohibitions, AI literacy and the model rules kept their dates.
• Transparency already applies. Article 50 has applied since 2 August 2026. Customer chatbots and AI-generated content are in scope today, and they are common in portfolio companies.
• Being American does not take a company out of scope. The Act reaches providers and deployers outside the EU when their AI output is used in the Union.
• Thirteen months is a short runway for high-risk work. Hiring tools and credit scoring are on the Annex III list, and the evidence the Act asks for takes time to build.
• Build governance into deployment. A portfolio that knows what AI it runs, who owns it and what it touches can absorb the next rule change. A portfolio that does not will pay for discovery twice.

"Delayed" was the most misread word in AI compliance this year.

When the EU agreed to push back parts of the AI Act, the headline that reached most boardrooms was some version of "Europe hits pause." I understand why. Compliance teams are stretched, and a delay sounds like permission to work on something else.

The actual change is much smaller than that headline. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026. It moves the high-risk rules for Annex III systems (things like hiring tools and credit scoring) from 2 August 2026 to 2 December 2027, and the rules for AI inside regulated products to 2 August 2028. That is the delay.

What it did not move: the transparency duties in Article 50, which applied on 2 August 2026 as planned. Jones Walker's read of the deal called it a reprieve rather than a repeal, which is the right frame. The bans on prohibited practices and the AI literacy duty have applied since February 2025. Rules for general-purpose AI models have applied since August 2025.

And most companies are not set up to tell the difference. In a PEX Network survey of 220 professionals, only 43% said they have an AI governance policy at all. That is a small sample, so I hold the exact number loosely. The direction is the point.

For a PE operating partner, the question is simple. Across a dozen portfolio companies, which ones are already on the hook, and which ones just bought time? Most firms can't answer that today. That gap is the real 2027 trend.

The Delay Moved One Part of the Act, Not the Whole Act

Start with the timeline, because the headline flattened it.

The EU AI Act was always phased. Different obligations switch on at different dates. The Omnibus changed some of those dates, added two new prohibited practices, and softened a few rules. It left the structure alone.

Two dates matter most for a portfolio this winter. 2 August 2026 already passed, and with it came transparency duties for chatbots and AI-generated content. 2 December 2026 is weeks away, and it brings two new prohibited practices plus a marking deadline for generative systems that were already on the market.

The high-risk regime is where the delay lives. That regime is the heavy part of the Act: risk management, technical documentation, logging, human oversight, conformity assessments. Pushing it back makes sense. The standards and guidance it depends on were not ready.

Read the timeline by obligation, not by headline

When someone at a portfolio company says "the AI Act got delayed," ask them which obligation they mean. If they can't name it, they are probably treating the whole Act as paused. Write the six dates on one page and check each company against each date. It takes an afternoon, and it ends the confusion.

Transparency Rules Already Touch Ordinary Portfolio Tools

Article 50 sounds niche until you list what it covers.

Providers of AI systems that talk to people have to make sure people know they are talking to an AI, unless that is obvious from context. Providers of generative systems have to mark outputs in a machine-readable way so they can be detected as AI-generated. Deployers who use emotion recognition or biometric categorization have to tell the people exposed to it. Deployers who publish deepfakes, or AI-written text meant to inform the public on matters of public interest, have to disclose that, unless a human reviewed the text and someone holds editorial responsibility.

Now think about a typical mid-market portfolio. A support chatbot on the website. A sales team generating outbound copy and images. A marketing team producing video. A software company that built an AI assistant into its own product and sells it to EU customers. That last one is the easy miss. The moment a portfolio company builds AI into what it sells, it is likely a provider, and the provider duties land on it.

None of this is exotic. It's the AI that portfolio companies adopted fastest, because it was easy to adopt.

And the penalty tier is not trivial. Under Article 99 of the AI Act, breaching the Article 50 transparency duties can bring fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher. For SMEs the cap is whichever of the two is lower, which helps, but it does not make the duty go away.

Inventory every customer-facing AI touchpoint

Ask each portfolio company for one list: every place a customer, candidate or member of the public interacts with AI or sees AI-generated content. Then mark which of those the company built and which it bought. Built means provider. Bought and used means deployer. That one column decides who owns which duty.

An American Portfolio Company Is Still in Scope

The easy assumption for a US-based sponsor goes something like this: "Our companies are in Ohio. The EU AI Act is Europe's problem."

The Act says otherwise. Article 2 covers providers that place AI systems on the EU market wherever they are based, and providers and deployers outside the EU where the output of the AI system is used in the Union. A website being reachable from Europe is not the trigger. Selling to EU customers, serving EU users, or hiring in the EU can be.

So the scope question is a fact pattern, company by company. A US manufacturer with a German distributor, a software business with French customers, a services firm with a Dublin office. Each one needs its own answer.

Map EU exposure per company, then per AI system

Run it in two passes. First, which portfolio companies have EU customers, users, employees or subsidiaries? Second, inside those companies, which AI systems produce output that reaches the EU? Most portfolios end up with a short list. Short lists are manageable. Unknown lists are not.

Thirteen Months Is a Short Runway for High-Risk Work

The delayed rules still arrive. As I write this, 2 December 2027 is about thirteen months out.

That sounds like plenty. It isn't, if a portfolio company is running an Annex III system. The Annex III list includes AI used to recruit and select candidates, filter applications, and evaluate people, plus AI used to assess the creditworthiness of individuals. Those are common tools in HR tech stacks and in consumer finance and lending businesses.

Deployers of high-risk systems carry real duties. They must keep the logs the system generates for at least six months where those logs are under their control. Before using a high-risk system at work, employers must inform workers' representatives and the affected workers. They need human oversight from people with the competence and authority to do it. Each of those takes a process, an owner and a paper trail. None of it gets built in a December sprint.

Providers have it harder. If a portfolio company built its own hiring or credit model, it is looking at risk management, data governance, technical documentation and a conformity assessment.

Start with HR and credit tools

If you only do one thing on high-risk this quarter, find every AI system that touches hiring, worker management or credit decisions across the portfolio. Those are where the Annex III exposure concentrates for most PE-backed companies. Everything else can follow.

Exit Diligence Will Ask Before Regulators Do

Here's my honest view on enforcement. Article 50 and the high-risk rules are enforced by national market surveillance authorities across 27 member states. Early enforcement will be uneven. I would not bet a hold-period plan on being the company a regulator picks first.

The question I'd plan around comes from a different direction: the buyer.

A buyer's diligence team in 2027 or 2028 is going to ask what AI the company runs, what data it touches, and what the company can show about how it is governed. That question arrives on a deal timeline, with a price attached. A company that can hand over an inventory, policies, access controls and audit logs closes cleanly. A company that has to reconstruct all of that during the process looks riskier than it is.

This is the part of the trend I'm most confident about. Regulation sets the floor. Diligence sets the price.

Build the evidence file now

Treat AI governance like any other exit-readiness workstream. Keep a current inventory, written policies, records of AI literacy training, and logs that show the controls work. The AI literacy duty in Article 4 was softened by the Omnibus to "take measures to support" literacy, and an internal training record can show you did. Cheap to keep. Expensive to fake later.

Governance Has to Live Inside the Deployment

The mistake I'd most like PE firms to avoid is treating the AI Act as a legal project that runs separately from AI adoption. Legal writes a memo. Ops keeps deploying tools. Six months later the memo describes a company that no longer exists.

Governance holds up when it is built into how AI gets deployed. That is how we approach it in PressW's AI Security, Compliance & Governance work: access controls, data policies, audit trails and agent guardrails go in with the deployment, and every control is documented and mapped to a requirement. We took the same approach with Encore, building AI that flags potential MNPI disclosures in expert calls with auditable reasoning and rigorous testing.

Here's the triage I'd run across a portfolio. Four buckets, each with its own clock.

Give every bucket an owner

A bucket without an owner is a bucket nobody checks. At the portfolio level, the operating team owns the triage. Inside each company, one named person owns each AI system. That's the whole structure. Simple enough that it actually gets followed.

Delayed Rules Still Arrive

I don't think the Omnibus will be the last change to this Act. Guidance and harmonized standards for the high-risk rules are still being finalized, and enforcement will look different in Dublin than it does in Munich. Anyone who tells you exactly how 2027 plays out is guessing. I'm guessing too, on some of it.

What I'm sure of: the companies that know what AI they run, and can prove how it's governed, will handle whatever comes next with a spreadsheet update. The ones that read "delayed" as "off" will spend 2027 catching up, probably during a sale process.

If you want a second set of eyes on where your portfolio stands, start with the four buckets above and see how many you can fill in today. We help firms do that through AI Security, Compliance & Governance, and if you want to compare notes on what you're seeing across your companies, Book a Discovery Call.

FAQ