Although the European Union has provisionally delayed the application of certain high-risk AI Act requirements, businesses should not assume they have extra time before demonstrating AI compliance. According to the International Association of Privacy Professionals (IAPP), the first significant challenge for many AI vendors—especially those outside the EU—is likely to come from customers rather than regulators. Enterprise buyers are continuing to send detailed AI due diligence and procurement questionnaires to assess whether vendors can responsibly develop, deploy, monitor, and govern their AI systems.
The article explains that, under the EU's proposed AI Omnibus simplification package, rules for many Annex III high-risk AI systems are expected to move from 2 August 2026 to 2 December 2027, while high-risk AI embedded in regulated products could shift to 2 August 2028, subject to formal adoption. However, procurement teams are not waiting for those legal deadlines. Organizations renewing contracts or evaluating new AI suppliers still require evidence of AI governance, risk management, transparency, human oversight, documentation, and monitoring before purchasing AI-enabled products or services.
Companies that cannot provide clear evidence may struggle to win enterprise contracts, even if the relevant legal obligations have not yet taken effect. The article argues that procurement processes are effectively becoming an early enforcement mechanism for responsible AI.
The article concludes that the postponement of certain EU AI Act deadlines should not be interpreted as a pause in AI compliance efforts. Enterprise customers are already demanding proof that AI systems are trustworthy, well governed, and suitable for deployment. As a result, organizations developing or selling AI solutions should continue building documentation, governance frameworks, and evidence of responsible AI practices now, because customer due diligence is moving faster than the regulatory calendar.
