# AI Act: what is the revised timeline and what must the leadership team do?

> The AI Act, in force since 1 August 2024, sorts AI systems by level of risk, and the Digital Omnibus postponed the high-risk obligations until the end of 2027. This delay does not excuse a leadership team from mapping its AI uses, training people (Article 4), keeping records and naming an owner.

## 01 The answer in plain terms

The **AI Act** is Regulation (EU) 2024/1689 of 13 June 2024. It entered into force on 1 August 2024, with a phased application. Its principle is simple. The more an AI system can harm people, the stricter the obligations around it.

The text sorts AI systems by level of risk: unacceptable, high risk, limited risk, minimal risk. This is the risk-based approach. It applies to the providers of AI systems as well as to the organizations that use them.

The regulation was then amended. Regulation (EU) 2026/1744, called the “Digital Omnibus on AI”, is dated 8 July 2026. It entered into force on 27 July 2026. It shifted part of the AI Act timeline. The obligations on high-risk systems are postponed until the end of 2027.

For a leadership team, the useful reading comes down to three points. The text remains in force. The timeline moved for high risk. The governance steps that prepare future compliance do not depend on this postponement.

WYP reading A postponed deadline is not an exemption. It gives time to those who use it to map, train and decide. It costs those who read it as a signal to wait.

## 02 Why this is a leadership-team issue

The AI Act is not aimed only at AI providers. It also concerns organizations that use AI systems in their business. A leader does not need to know every article. A leader needs to know which AI uses exist in the company, who answers for them, and what evidence can be produced if asked.

On this point, the gap between the text and practice is documented. The ESSCA and Forvis Mazars barometer, published on 1 October 2026 with 826 respondents (IT and digital professionals in France, the United Kingdom, Germany and Spain), gives three markers:

- two thirds of organizations observe unsupervised AI use, known as shadow AI
- only 44 % have formalized ethical rules on AI
- 28 % of respondents believe their company knows the AI Act well
These three markers describe a gap. The uses are there. Written rules and knowledge of the text remain a minority. This is precisely the leadership team's ground, because neither IT, nor legal, nor the business units can decide alone.

WYP reading A regulation that requires training, oversight and records presupposes that you first know what is in use. Without an inventory, a leadership team can neither decide nor answer a question from a regulator, a client or an insurer.

## 03 What the text asks for, in three markers

These three markers are enough to steer. They come from the regulation itself and from the European Commission's overview page.

1
### The risk-based approach

The regulation sorts AI systems into four levels. Unacceptable risk corresponds to prohibited practices. High risk carries the heaviest obligations. Limited risk is mostly about transparency. Minimal risk calls for no specific requirement. Your first question is therefore: which level does each of our uses fall into?

2
### AI literacy (Article 4)

Article 4 sets an AI literacy obligation. It means training the people who use AI, with a level of understanding suited to their role. The AI literacy obligation is not aimed only at specialists. It concerns the leader who approves a use as much as the employee who drafts with an assistant.

3
### Human oversight (Article 14)

Article 14 deals with human oversight of high-risk systems. The idea is that a high-risk system must be able to be supervised by people. For a leader, the question is practical. Who oversees, with what competence, and with what power to correct or stop?

The text also distinguishes roles, notably the one who provides a system and the one who uses it. The exact scope of each obligation depends on your role and on the system's level of risk. It should be checked in the text, with your legal counsel. Some uses in recruitment or staff evaluation, for example, may fall under high risk. That is qualified case by case.

## 04 The AI Act timeline after the Digital Omnibus

The AI Act timeline can be read through three dated markers, all taken from the official texts.

- **1 August 2024**: entry into force of the AI Act, with a phased application.
- **8 July 2026**: date of Regulation (EU) 2026/1744, the Digital Omnibus on AI, which amends Regulation 2024/1689.
- **27 July 2026**: entry into force of the Omnibus. It shifted part of the timeline. The obligations on high-risk systems are postponed until the end of 2027.
The point to keep is a distinction. The postponement concerns part of the obligations, those on high-risk systems. It says nothing against the usefulness of preparing the inventory, the training and the records now.

We do not give other dates here. A text with phased application has just been amended, and a wrong date in a compliance plan does more damage than a missing one. For any precise deadline, refer to [Regulation 2024/1689 on EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/1689/oj), to the [Omnibus 2026/1744](https://eur-lex.europa.eu/eli/reg/2026/1744/oj) and to the [European Commission page](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai).

## 05 Four reflexes for a leadership team

The obligations of the AI Act weigh first on the organization, according to its role. For a leadership team, they translate into four reflexes. They are useful whatever the timeline.

1
### Map your AI systems

List everything that involves AI in the company. Include purchased tools, AI features built into existing software, and individual uses that nobody has declared. For each use, note the purpose, the data involved, the provider and an owner. Then place each use in one of the four risk levels. A simple table is enough to start.

2
### Train, in the sense of Article 4

Plan a path by role. The leadership team needs the stakes, the responsibilities and the right questions. Managers need the rules of use and the way to check an output. Users need to know what they may enter into a tool, and how to review. Keep a record of who was trained, on what, and when. The [AI glossary](/en/glossary/) details AI literacy.

3
### Keep records

Keep a record of what is authorized, by whom and why. Hold a register of systems, a log of authorization decisions and, for sensitive uses, the proof of human oversight: who reviewed, who approved, what was corrected. This traceability serves Article 14 for high risk. It also serves to answer a question from a client or a regulator.

4
### Name an owner

Name one person who answers for the subject before the leadership team. It is not necessarily a new position. It is a name, a mandate and a review date. This person keeps the inventory up to date, follows changes to the text, including postponements, and reports at fixed intervals.

WYP reading These four reflexes do not require a large program. They fail when the subject stays a delegated task without a mandate, or when it waits for the last deadline to be opened.

## 06 Frequent mistakes

1
### Reading the postponement as a general pause

The postponement concerns part of the timeline, the one for obligations on high risk. It does not suspend the GDPR, which is a separate text. The CNIL publishes recommendations on using AI in line with the GDPR, in its [Artificial Intelligence file](https://www.cnil.fr/fr/intelligence-artificielle). Nor does it suspend the risks of data leaks, reputation or contracts.

2
### Handing the subject to a single function

The AI Act cuts across human resources, finance, customer relations and IT. If the subject is given to one function, the others keep adopting tools without knowing. The leadership team is the only place where these decisions meet.

3
### Confusing training with one-off information

A single talk does not show a skills increase adapted to each role. Article 4 speaks of training the people who use AI. A path by role, with a written record, answers this requirement better than a general message sent to the whole company.

4
### Looking only at purchased tools

The inventory must cover what is not in the catalog: AI features added by a vendor to existing software, personal accounts, free tools. The ESSCA and Forvis Mazars barometer finds that two thirds of organizations observe unsupervised use. What you do not see does not appear in the map.

## 07 What WYP does, and what it does not do

WYP.agency is a strategy consulting firm for executives, leadership teams and boards of directors. On the AI Act, we prepare the decision. We cross several AI models (Claude, ChatGPT, Gemini, Perplexity, Mistral, Grok), we cross-check their answers, we spot blind spots and contradictions, then a person reviews and signs. AI sharpens the decision, it does not make it.

**What we do.** [The Cadrage IA](/en/cadrage-ia/) is a fixed-scope package delivered in ten working days. It includes an audit of uses, a written AI policy, a validated tool and a presentation to the leadership team. The audit of uses feeds the map directly. The written policy can set the rules for training, traceability and responsibility.

**What we do not do.** We are not a law firm and we do not give legal opinions. We do not certify the compliance of a system. We are neither a tool vendor, nor a development company, nor a marketing agency. To classify a high-risk system in law, you need your legal counsel.

## 08 Where to start

Start by knowing where you stand. [The AI maturity diagnostic](/en/ai-diagnostic/) is free and short. It gives a first reading of your organization's maturity. Then browse [the AI glossary](/en/glossary/) for the entries on the AI Act, AI literacy, the GDPR and AI, and guardrails. Finally, if the subject must be decided in leadership team session, [the Cadrage IA](/en/cadrage-ia/) turns it into a deliverable.

For the reference texts, the CNIL publishes its [Artificial Intelligence file](https://www.cnil.fr/fr/intelligence-artificielle) and the European Commission its [overview page of the regulatory framework](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai).

## FAQ

**What are a leader's obligations under the AI Act?**
They weigh first on the organization, according to its role (provider or user of a system) and the level of risk. Keep three markers: the risk-based approach, the AI literacy obligation of Article 4, and human oversight under Article 14 for high risk. The leadership team decides the means: map, train, keep records, name an owner.

**What does the Digital Omnibus on AI change?**
Regulation (EU) 2026/1744 of 8 July 2026 amends Regulation 2024/1689. It entered into force on 27 July 2026 and shifted part of the timeline. The obligations on high-risk systems are postponed until the end of 2027.

**Should teams still be trained if the timeline has been postponed?**
Yes, it is the prudent choice. Article 4 sets the AI literacy obligation, meaning training the people who use AI. The postponement described by the Omnibus concerns the obligations on high-risk systems. Check the exact scope in the text with your legal counsel. Training remains in any case the first lever against unsupervised use.

**What are the risk levels of the AI Act?**
Four levels: unacceptable risk, high risk, limited risk and minimal risk. The higher the risk, the stricter the obligations. The European Commission's overview page describes this risk-based approach.

**Is my company concerned if it only uses off-the-shelf AI tools?**
Probably, if you use AI in the European Union. The text also targets organizations that use AI systems, and Article 4 concerns the people who use AI. Your exposure depends on the use and on the level of risk. Start with the mapping.

**Are companies ready for the AI Act?**
The ESSCA and Forvis Mazars barometer published on 1 October 2026 (826 respondents) indicates that 28 % of respondents believe their company knows the AI Act well, and that only 44 % have formalized ethical rules on AI.

## See also

- [AI Act](https://wyp.agency/en/glossary/ai-act/)
- [AI literacy (Article 4)](https://wyp.agency/en/glossary/ai-literacy/)
- [ISO/IEC 42001](https://wyp.agency/en/glossary/iso-42001/)
- [GDPR and AI](https://wyp.agency/en/glossary/gdpr-ai/)
- [Guardrails](https://wyp.agency/en/glossary/guardrails/)
- [Making generative AI legally safe](https://wyp.agency/en/glossary/secure-generative-ai/)
- [Claude vs ChatGPT security](https://wyp.agency/en/glossary/claude-vs-chatgpt-security/)

## Sources

- Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 (AI Act) (https://eur-lex.europa.eu/eli/reg/2024/1689/oj)
- Regulation (EU) 2026/1744 “Digital Omnibus on AI” of 8 July 2026, amending Regulation 2024/1689 (https://eur-lex.europa.eu/eli/reg/2026/1744/oj)
- AI Act, European Commission, official overview page (https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai)
- ESSCA and Forvis Mazars, 2nd AI Barometer: Business and Sustainability, 826 respondents (IT and digital professionals in France, United Kingdom, Germany, Spain), published 1 October 2026 (https://www.essca-knowledge.fr/en/all-posts/ai-sustainability/ai-barometer-2026-companies-sustainability-europe/)
- CNIL, thematic file “Artificial Intelligence” (AI and GDPR recommendations) (https://www.cnil.fr/fr/intelligence-artificielle)

---
Entry from the WYP.agency AI glossary · https://wyp.agency/en/glossary/ai-act-for-leaders/ · Last updated : 2026-10-16