EU AI Act Deferral: Fifteen Months of Oversight Evidence
A Quarter-by-Quarter Plan From the Digital Omnibus to December 2, 2027
This article is for educational purposes and does not constitute legal advice. Organizations subject to the EU AI Act should consult qualified counsel about their specific obligations.
The Omnibus moved the human oversight date, and every month spent waiting for the next deferral is a month of evidence you will not have.
What the Deferral Actually Bought
Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on July 27, 2026 and moved the Annex III high-risk block from August 2, 2026 to December 2, 2027. That block contains Article 14 (human oversight), Article 26 (deployer obligations), risk management, logging, and conformity assessment. Annex I product-safety high-risk moved to August 2, 2028. The Commission's AI Act Service Desk timeline shows the full roll-out completing by August 2, 2028.
Two dates sit inside the gap. On December 2, 2026 the new Article 5 prohibitions on non-consensual intimate imagery and child sexual abuse material begin to apply, and the Article 111(4) transitional period for pre-existing generative systems to meet Article 50(2) marking runs out. On August 2, 2027 the Article 6(1) classification rules become applicable and Member States must have at least one regulatory sandbox operating under amended Article 57(1). Provision-by-provision status is tracked at EveryAILaw, the source for the dates in this piece.
We've covered the Article 4 rewrite and how to audit oversight once the records exist elsewhere on this blog. This piece is the planning layer between the two: what to do, in what order, in the roughly fifteen months from September 2026 to the Annex III date. Most planning decks read the deferral as relief. I read it as a clock.
Why Oversight Evidence Has a Lead Time
Article 14(4) lists what the natural persons assigned to oversight must be enabled to do: understand the system's capacities and limitations and monitor for anomalies, dysfunctions, and unexpected performance; remain aware of automation bias; correctly interpret output; decide not to use the output or to disregard, override, or reverse it; and intervene or halt the system. Article 26(2) requires deployers to assign oversight to natural persons who have the necessary competence, training, and authority, plus the necessary support. Article 26(5) requires deployers to monitor operation on the basis of the instructions for use.
Read as a compliance checklist, each of those items is a document. Read as an audit target, each is a question about a named person's demonstrated behavior over time. Which person? Assigned when? On what evidence of competence? How many times did they override the system, and what happened when they did?
Here's where the lead time comes from. An assignment with a competence basis needs a measurement before the assignment. An override and escalation history needs months of live operation with context logging switched on. A remediation record needs a baseline, an intervention, and a second measurement. The deferral didn't change what the evidence is. It set the clock on how much of it we can have by December 2027.
The Quarter-by-Quarter Plan
The table below assumes an organization that deploys, or expects to deploy, at least one Annex III system and hasn't yet named its oversight persons. Each quarter produces an artifact the next quarter depends on.
| Quarter | Regulatory marker | Evidence to produce | Carry forward |
|---|---|---|---|
| Q4 2026 | Dec 2: new Art. 5 prohibitions; Art. 50(2) marking deadline for pre-existing generative systems | Annex III exposure inventory. Roles mapped to systems. Decision-context logging turned on for every review step. Provisional oversight assignments under Art. 26(2). | A named person per system and a log that retains what the reviewer saw. |
| Q1 2027 | None on the EU calendar | Baseline behavioral measurement of every provisionally assigned person against the Art. 14(4) capabilities. Gap list by role, not by name. | A competence basis for each assignment, or a decision to reassign. |
| Q2 2027 | None on the EU calendar | Remediation: targeted training where the gap is knowledge, role changes where it is not. Escalation path exercised at least once per system. | Remediation records and a live escalation history. |
| Q3 2027 | Aug 2: Art. 6(1) classification rules; national sandboxes operational | Second measurement. Reconcile assignments against provider instructions for use and Art. 14(3)(b) deployer-side measures. Dry-run oversight audit. | Before-and-after evidence and an audit finding you wrote yourselves. |
| Q4 2027 | Dec 2: Annex III high-risk obligations apply | Freeze the evidence pack: assignments, competence basis, override and escalation counts, remediation, second-measurement results. | The record an authority asks for on day one. |
Three planning notes.
The December 2026 markers aren't oversight work, and they'll absorb the same governance staff. Sequence the marking review and the prohibition check into October so the Annex III inventory isn't pushed into January.
The two empty quarters are where the plan usually fails. There's no external deadline in Q1 or Q2 2027, which makes them the quarters most likely to get reallocated to whatever's on fire that week. They're also the only quarters in which a baseline and a remediation can both happen with time left to re-measure.
A dry-run audit in Q3 is cheaper than the real one in Q4. An adverse finding we write ourselves in September 2027 leaves a quarter to fix it.
Two Records We Can't Backfill
Policies, role descriptions, training curricula, and instructions-for-use reconciliations can all be written in the last quarter if they've got to be. Two records can't.
The first is the operational history: override counts, rejection counts, escalation records with outcomes, and the decision context stored at each review step. A workflow that logs the approval and discards what the approver saw produces a timestamp, and no amount of Q4 effort recovers the missing context. Logging switched on in October 2026 yields fourteen months of history. Logging switched on in October 2027 yields two.
The second is the competence basis for each assignment. Training completion records show that a program was delivered. They don't show that the person can detect an anomaly in the system's output, notice their own automation bias, or choose to override under time pressure. That showing comes from observing the person against known-wrong material, and a single observation in Q4 proves a point in time. A baseline in Q1, a remediation in Q2, and a re-measurement in Q3 prove a trajectory, which is the shape an authority will find credible.
Organizations outside the EU that use the Article 14 list as their oversight standard face the same lead time without the date. The shared vocabulary for describing those duties the same way across jurisdictions is the Obligation First schema, which is a record format rather than a statement of what any law requires; the organizational readiness layer sits with AI Posture.
Where the Behavioral Half Comes From
PAICE (People + AI Collaboration Effectiveness) produces the competence basis in the table's Q1 and Q3 rows. It presents realistic work containing seeded errors and measures whether the person detects them, verifies the claim that carries the decision, rejects or corrects the output, and escalates when a source can't be confirmed. Those are the Article 14(4) capabilities expressed as observed behavior. Not what they report, what they do.
The privacy architecture matters for a deployer planning assignments. Scores attach to hashed identifiers, no conversation text is retained, and individual results are structurally unavailable to the organization. A governance team sees cohort reliability by role and decides where remediation and reassignment are needed. The individual sees their own result. The regulator eventually sees an assignment process with a measurement behind it.
Counting from September 2026, fifteen months is enough time to build that. It's also exactly enough time to spend waiting for the next Omnibus.
Want the competence basis for your oversight assignments before December 2027? Learn about PAICE for organizations or take an individual assessment to see it firsthand.
Recommended Reading
- EU AI Act Article 4 AI Literacy After the Digital Omnibus - What the softened literacy duty requires and what it never proved
- How to Audit Human Oversight in AI-Enabled Workflows - The six-question checklist once the records exist
- Regulatory Readiness Is Not AI Literacy - Why training certificates and regulatory evidence are different artifacts
- The Proof Gap - Why AI collaboration risk lacks an evidence system
Curious but short on time?
Take the 3-minute PAICE Pulse — a quick confidence check that maps how you see your own AI collaboration posture. No login required.