The EU AI Act deadline moved to 2027. What still applies now?

It also, more quietly, changed what Article 4 asks of you. Where providers and deployers previously had to ensure, to their best extent, a sufficient level of AI literacy, they must now take measures to support the development of AI literacy, with an explicit clarification that this does not require them to guarantee any specific level for any individual. That is a shift from an obligation of result to an obligation of effort.

Read either change as permission to stand down and you have misread which law was ever going to reach you first. Human oversight of automated decisions, prohibited-practice screening and transparency are all live today, under the General Data Protection Regulation and under Articles 5 and 50 of the AI Act. The conformity-assessment machinery is what moved. Build the first, re-plan the second.

Do these now

All three conditions are already true for each one: the law applies, regulators are enforcing it, and the fines are large.

• Inventory every automated decision that affects a person's money, work or access to a service.

  Not every AI system. Every consequential automated decision, hand-coded rules included. GDPR Article 22 does not care whether the logic was learned or written.

• Put a named human with authority to reverse in the loop, and tell the affected person they can contest.

  Uber was fined 824,990,000 euro in August 2026 for deactivating driver accounts without it.

• Screen your existing estate against the Article 5 prohibitions.

  In force since February 2025. Workplace emotion recognition is the one most organisations forget they own.

• Train the people who operate the systems, not the whole company.

  The Garante's own remedy language is that decisions be verified by adequately trained operators. That is a small, specific population.

Re-sequence these

Conformity assessments, technical documentation and registration for Annex III systems now sit against December 2027. Annex I product-embedded systems sit against August 2028. So does anything whose cost is dominated by harmonised standards that do not yet exist.

Do not defer these, even though they feel like paperwork

Article 50 transparency obligations for AI-generated content still applied from 2 August 2026, with only a short grace period for watermarking existing systems, running to 2 December 2026.

The useful axis is not high-risk or not. It is enforced today or not, crossed with deferred by the Omnibus or not.

Expand

That is the obvious alternative, and two pieces of evidence say no.

First, the file is contested rather than settled. Parliament adopted the agreement on 16 June 2026 by 423 votes to 57, with 174 abstentions. Planning on the assumption that deferral is the direction of travel is a bet on politics, not on law.

Second, and this is where the usual talent framing comes apart, the skills gap is real but it is being measured on a very small base. Eurostat reports that among EU enterprises which considered AI and decided against it, 70.9 percent cited lack of relevant expertise, the single largest obstacle, ahead of legal uncertainty at 52.5 percent and data-protection concerns at 48.8 percent. But only 19.95 percent of EU enterprises used AI at all in 2025. Measured across all enterprises in scope rather than that subgroup, Eurostat puts the same expertise barrier at 7.76 percent. Anyone quoting the first number as though it describes European industry is inflating a subgroup share into a population one.

There is a more uncomfortable reading of the skills data, and our view is that it is closer to true. Deloitte’s 2026 survey of 3,235 director-to-C-suite respondents states flatly that insufficient worker skills are seen as the biggest barrier to integrating AI into the business, and attaches no percentage to it at all. The same survey found that 84 percent of companies have not redesigned jobs or the nature of work around AI capabilities, and only 25 percent have moved 40 percent or more of their experiments into production. That is an operating-model failure being reported as a skills failure, and training will not fix a workflow nobody redesigned.

Deutsche Telekom has run AI training since 2018, and the numbers are staged rather than announced all at once: 66,000 employees took AI training courses in 2023; 30,000 were trained in prompting in 2024 and again in 2025; its growth hub platform had 110,000 registered users at its November 2025 launch; and there were 52,000 participations in AI sessions through its Learning from Experts programme in 2025 alone.

The targets are the interesting part. Ninety percent of employees using AI tools regularly by 2026. One hundred percent with the skills to use AI confidently, responsibly and in a way that adds value by 2028, which is the year the Annex I obligations bite.

But the training is not the governance. Separately, Telekom built a risk-classification process with clear rules for the classification, evaluation and assessment of its AI systems, signed the EU AI Pact, and audited its estate against Article 5, publishing the result: no evidence of prohibited AI within the company or its products. Literacy at scale on a 2028 clock. Prohibited-practice screening, already done, against a 2025 clock. Two programmes, two deadlines, and that is the shape to copy.

Bosch has a harder number on the training side. Around 100,000 associates have completed AI Academy training, and its 18-month expert programme, a mid-five-figure investment per participant, returns ten times its cost in project value within five years on Bosch’s own internal analysis. That is company-reported and not audited: direction, not a business case you can lift.

On 5 July 2021, Italy’s data protection authority fined Foodinho, the Glovo subsidiary, 2.6 million euro. Among the orders: give riders ways to challenge decisions made using the algorithm, and guarantee procedures protecting the right to obtain human intervention.

On 13 November 2024, the same authority fined the same company 5 million euro, affecting more than 35,000 riders. Riders still lacked the right to obtain human intervention, express their opinion and contest the decision. Automatic account blocks were communicated by a single standard message that did not tell riders they could contest it. The excellence score governing shift-booking priority had no human review. The remedy ordered was that algorithmic decisions be verified by adequately trained operators.

Three years, one instruction, nearly double the fine. That remedy, trained operators with authority to overrule a model, is Article 4 literacy plus Article 14 human oversight, arriving in 2021 through the GDPR. It has been enforceable in Europe the entire time.

The scale of what comes through this channel is now unmistakable. On 21 August 2026 the Dutch data protection authority fined Uber 824,990,000 euro for deactivating driver accounts through fully automated processes without adequate human review, the second largest GDPR fine ever issued. The conduct ran from 2018 to 2022. The case began with one French driver, deactivated in 2019, who gathered testimony from 170 others. Deputy chair Monique Verdier: a computer should not make decisions on its own that have such major consequences. Uber is appealing.

Not one euro of that was levied under the AI Act.

The direction of travel runs the other way too. In April 2022 Hungary’s authority fined a bank roughly 670,000 euro for running emotion analysis over recorded customer service calls. The bank had done a Data Protection Impact Assessment and had correctly identified the processing as high-risk profiling, but the assessment failed to present substantial solutions to address those risks. Workplace emotion recognition is now prohibited outright under Article 5. A 2022 fine became a 2025 ban, and it is worth assuming the same trajectory for anything sitting near the prohibition line today.

Two cases show what competent governance actually produces, and it is not always a launch.

Amsterdam spent roughly 535,000 euro, about 500,000 in-house plus a 35,000 euro Deloitte contract, building Smart Check, a welfare-application risk model. It did everything the responsible-AI playbook asks: excluded 15 demographic characteristics, avoided proxies such as postcode, reweighted training data to correct historical caseworker bias, consulted external groups. Pre-deployment testing in May 2022 showed the model was nearly twice as likely to wrongly flag applicants of non-Western nationality, and reweighting equalised that. Then the live pilot ran from March to November 2023 over about 1,600 applications, and the bias reversed. The system now wrongly flagged applicants with Dutch nationality, women, and applicants with children, and it did not beat caseworkers at finding actual fraud. Amsterdam stopped it.

Norway’s labour and welfare administration, NAV, took a sick-leave prediction model into the data protection authority’s regulatory sandbox. The exit report concluded NAV had a legal basis to use AI as decision support, but faced unresolved uncertainty over whether that basis permitted using personal data to develop the algorithm at all, and that proceeding would require a clear and explicit supplementary legal basis founded in legislation.

Both reached a no. Both reached it cheaply, early, and with a documented reason. The 535,000 euro no is the cheapest outcome in this article. That capability, stopping a project on evidence, is what the skills conversation is actually about, and no amount of prompting training delivers it.

The softening of Article 4 will be read by a lot of boards as the regulator conceding that AI literacy was overreach. It was not a concession about whether people need to understand these systems. It was a concession about whether a regulator can audit a level of understanding.

The requirement that someone competent reviews a consequential automated decision did not come from Article 4, has never depended on it, and is currently generating the largest privacy fines in Europe. Deutsche Telekom is training toward 2028 and audited against February 2025. That is the correct shape.

Sprint for the obligations that are already live. Walk, deliberately and with a written plan, toward December 2027.