BRIDLEUpdated August 2026. The high risk deadline moved to 2 December 2027. Deferred, not cancelled.
The AI Act gave you more time.
Your logs cannot be backdated.
On 7 May 2026 the EU institutions agreed the Digital Omnibus, moving the obligations for Annex III high risk AI systems from 2 August 2026 to 2 December 2027. That is relief on paper. In practice the duties that take longest, automatic logging, six months of retained history, working human oversight, arrive exactly as written. And the transparency rules in Article 50 already apply today. If your agents call APIs, send emails, or move money, that action layer is what the Act's record keeping and oversight expectations are about.
Where the law actually stands
The Act entered into force on 1 August 2024 and switches on in stages. Here is the timeline as amended by the Digital Omnibus agreement.
The AI Act enters into force. Nothing enforceable yet.
Prohibited practices banned: social scoring, harmful manipulation, untargeted facial image scraping, emotion recognition at work and school. AI literacy duties begin.
General purpose AI model obligations apply: training data transparency, copyright policy, extra duties for models with systemic risk.
General application date. Article 50 transparency obligations now enforceable: chatbots must disclose they are AI, synthetic content must be labelled. Governance structures and the penalty framework are live.
Deferred deadline for Annex III high risk systems (hiring, credit, insurance, education, essential services, law enforcement): full compliance programme including logging, oversight, registration, and conformity assessment.
Deferred deadline for Annex I high risk AI embedded in regulated products such as medical devices and machinery.
Scope has not changed: the Act is extraterritorial. It covers providers placing AI systems on the EU market and deployers using them in the EU, wherever the company is based, and output used in the EU brings a system into scope. Penalties have not changed either: up to 35 million euros or 7 percent of global annual turnover for prohibited practices, up to 15 million euros or 3 percent for breaching most other obligations, and up to 7.5 million euros or 1 percent for supplying misleading information to authorities.
What teams running agents must have working by December 2027
For systems in the high risk categories, hiring, credit, insurance, education, essential services, law enforcement, these are the duties that touch the engineering team rather than the legal team. Chains of agents make each one harder: the compliance boundary follows every agent performing a high risk function, so if you cannot say which agent did what, on whose behalf, at what cost, you cannot meet the record keeping duty.
Article 12
Automatic record keeping
High risk systems must automatically record events over their entire lifetime: what ran, when, on what input, with results traceable to the natural persons involved. Manual note keeping does not qualify. The logging has to be built into the system itself.
Articles 12 and 26
Six month log retention
Deployers must keep the logs under their control for at least six months and hand them to market surveillance authorities on request. Longer periods can follow from other law, and many teams keep more.
Article 14
Human oversight
A person must be able to understand what the system is doing, intervene while it runs, and stop it entirely. For agents that means approval steps in front of consequential actions and a stop mechanism that does not depend on the agent cooperating.
Article 26
Deployer obligations
Use the system as its provider intended, assign oversight to people with the competence and authority to exercise it, monitor operation, and keep the records. If your company runs agents built on someone else's models, this is your article.
Article 49
Registration
Providers of Annex III high risk systems must register them in the EU database before placing them on the market, with the information listed in Annex VIII. Certain public sector deployers register too.
Article 15
Accuracy and cybersecurity
High risk systems must be resilient against attempts to manipulate them. For agents that means defending against prompt injection, jailbreaks, and data exfiltration. Bridle scores every request and response and can block the malicious ones, with each attempt on the record.
Article 73
Serious incident reporting
Report serious incidents without undue delay and at most within 15 days of awareness. Ten days if a death may have been caused. Two days for widespread infringements or serious, irreversible disruption of critical infrastructure. You cannot reconstruct an incident report without logs.
Why the deferral is not a reason to wait
Three of the duties above cannot be produced at the deadline. They accumulate.
Logs are the obvious one. An auditor asking for six months of records in early 2028 is asking about systems that must have been logging since mid 2027. Retrofitting logging into an agent stack is a real engineering project: request paths change, identities have to be attached to calls, storage and retention need owners.
Oversight is the second. Article 14 expects humans who understand the system and can actually stop it. That is a working muscle, approval flows people use, a kill switch that has been tested, not a paragraph in a policy document.
Incident readiness is the third. A two day reporting deadline for the worst incidents is only meetable if the record of what happened already exists when the incident does.
The readiness data says most companies are betting on the deadline anyway: a Cloud Security Alliance research note found 78 percent of organisations had taken no meaningful steps toward compliance as of spring 2026. The deferral will thin the urgency further. Teams that build the evidence habit now get compliance as a side effect instead of a 2027 fire drill.
Compliance documents describe controls. Bridle is the control.
Questionnaire tools produce a PDF saying you keep logs and oversee your agents. An auditor's next question is: show me. Bridle sits in your agents' request path, so the evidence is generated by the act of running.
- Article 12: every model call and risky action is logged automatically against a named agent identity: timestamp, model, tokens, cost, outcome. Retained and exportable.
- Article 14: agents pause before risky actions and wait for a named person to approve or deny. The decision, the decider, and the time are on the record. Budget caps are a stop mechanism that works even when the agent misbehaves.
- Article 26: one click exports the evidence pack for any agent and period, mapped to the articles your reviewer will ask about.
- Article 73: when something goes wrong, the incident timeline is already written: what the agent did, what was held, what was stopped, minute by minute.
The evidence pack
One export per agent, per period. What it did, what it cost, what was held for approval, who decided, what was stopped. Hand it to legal, your auditor, or your biggest customer's procurement team.
The log is tamper evident. Every event is hash chained to the one before it, so a deleted or edited record breaks the chain and the break is provable. Retention that an auditor cannot quietly rewrite is the difference between a log and evidence.
{
"title": "Agent activity evidence pack",
"period": { "days": 30 },
"agent": { "name": "invoice-bot" },
"summary": {
"modelCalls": 1841,
"totalCostUsd": 74.02,
"budgetKills": 3,
"approvalsRequested": 12,
"approvalsApproved": 11,
"approvalsDenied": 1
},
"euAiActMapping": { ... },
"events": [ ... ]
}Common questions
Was the August 2026 deadline delayed?
Yes. The Digital Omnibus agreement of 7 May 2026 moved Annex III high risk obligations to 2 December 2027 and Annex I product embedded systems to 2 August 2028. Prohibitions, general purpose AI rules, and Article 50 transparency obligations were not deferred.
Do the rules reach AI agents specifically?
Risk tier follows the use case, not the technology. But an agent that calls APIs, internal services, or MCP servers is performing actions, and for in scope systems that action layer is what the logging, cybersecurity, and oversight expectations are about. In agent chains, the boundary follows every agent performing a high risk function.
We are a US or UK company. Does this apply to us?
If your AI system is placed on the EU market or its output is used in the EU, yes. Where the company is registered does not matter, the same way it does not matter for the GDPR.
What should we do during the deferral?
Inventory your AI systems and agents, classify them against the risk tiers, turn on automatic logging in the request path, give agents named identities, budgets, and a stop mechanism, put human approval in front of risky actions, and keep evidence exports ready. Those steps also happen to be what a security review asks for, deadline or not.
Sources: Regulation (EU) 2024/1689 (the AI Act), Articles 12, 14, 26, 49, 50, 73, and 99; the Digital Omnibus provisional agreement of 7 May 2026; Cloud Security Alliance research notes on high risk readiness. General information, not legal advice. Background: what is the EU AI Act.
December 2027 is an engineering deadline.
Routing an agent through Bridle takes about ten minutes. From that point on, your compliance evidence writes itself.