On August 2, 2026, the EU AI Act's toughest obligations were supposed to click on for "high-risk" AI systems: conformity assessments, human oversight, and automatic record-keeping of every decision the system made. It didn't happen. In July 2026, the European Parliament and Council finalized the Digital Omnibus on AI, pushing the deadline for stand-alone high-risk systems (Annex III, things like biometric identification, credit scoring, hiring screens, and access to essential services) to December 2, 2027, and the deadline for high-risk AI embedded in regulated products (Annex I, medical devices, machinery) to August 2, 2028. Source: Pinsent Masons, "Law delaying EU high-risk AI rules finalised," July 2026. Sixteen months of runway just appeared for anyone who was staring down that date.
Before anyone exhales: this delay is scoped narrowly. It applies to Annex III and Annex I high-risk AI systems, a specific, enumerated list, not "any product that calls an LLM." A customer support agent, a coding assistant, or an internal chatbot doesn't become a regulated high-risk system just because it's built on a frontier model. And the delay changes nothing for General-Purpose AI (GPAI) model providers, the OpenAIs and Anthropics and Googles of the world, whose transparency and documentation duties under the Act have been in force since August 2, 2025 and were left untouched by the Omnibus. Source: European Commission, AI Act implementation timeline. If your product isn't screening loan applicants or scoring job candidates, the legal clock that just moved was probably never ticking for you.
What Article 12 actually asked for
The part worth reading, delay or no delay, is what the record-keeping requirement actually specifies, because it's a clean description of what "knowing what your AI system did" looks like in practice. Article 12 requires high-risk systems to automatically log events across their operating life, specifically the ones relevant to spotting a risk condition, a substantial modification, or an anomaly during post-market monitoring. For the systems the Act singles out for the strictest logging, remote biometric identification, the minimum record is spelled out to the field: the exact start and end time of each use, which reference database was queried, which input produced a match, and the identity of the human who verified the result. Source: artificialintelligenceact.eu, "Article 12: Record-Keeping".
Strip out the biometric specifics and the underlying ask is generic: for every decision your AI system made, be able to answer which model handled it, on what input, what it produced, and whether a human or a check verified the output before anything downstream relied on it. That's not a compliance quirk. It's the same question a finance lead asks after a surprise invoice, and the same question most engineering teams currently cannot answer per request, only per month, in aggregate, after the bill has already landed.
The gap the deadline was pointing at doesn't move
That's the part the sixteen-month extension doesn't touch. 2026 has been the year enterprise AI bills stopped being predictable: one company reportedly ran up over $500 million in Claude spend in a single month after skipping usage limits, Source: Yahoo Finance, "Client Accidentally Burns $500 Million on Claude AI in One Month," May 2026 and Uber's CTO told The Information the company's entire 2026 AI budget was exhausted by April, months ahead of projections. Source: The Information, "Uber CTO Shows How Claude Code Can Blow Up AI Budgets," May 2026. Every one of those stories has the same root cause: nobody had a per-request record of which model ran, why, and what it cost, until finance asked and someone had to reconstruct it from a raw usage export. Article 12 describes the fix for a legal problem. The same fix happens to be the fix for a budgeting problem that has nothing to do with any regulation.
The industry is converging on this even outside the Act. ISO/IEC 24970, the international standard specifically for AI system logging, reached Final Draft International Standard stage in May 2026 and is in its last approval ballot. Source: Cloud Security Alliance, "EU AI Act High-Risk Deadline: Enterprise Readiness Gap". Whether or not your product ever falls under Annex III, "log which model handled this, on what basis, at what cost" is turning into table stakes, not a regulatory edge case.
Two timelines, not one
| Before the Omnibus | After the Omnibus (finalized July 2026) | |
|---|---|---|
| GPAI model provider duties (transparency, documentation) | Aug 2, 2025 | Unchanged, Aug 2, 2025 |
| Annex III high-risk systems (stand-alone: hiring, credit, biometric ID, essential services) | Aug 2, 2026 | Dec 2, 2027 |
| Annex I high-risk systems (embedded: medical devices, machinery) | Aug 2, 2026 | Aug 2, 2028 |
| Labeling pre-Aug-2026 generative AI outputs | Aug 2, 2026 | Dec 2, 2026 |
| Independent estimate, large-enterprise compliance cost | N/A | $8-15M initial, $1-5M/yr ongoing, per one industry research note |
What to log per request, deadline or not
You don't need a lawyer to decide this list is worth keeping. You need it the first time someone asks why the bill moved:
- Which model handled the request, by name and version, not just "the LLM."
- What it cost, the actual price paid after cache discounts, not a blended monthly average.
- Why that model was chosen, the routing or classification decision, ideally versioned so a change in behavior is traceable to a change in logic.
- Whether the output was checked, by a verifier, a human, or neither, before anything downstream trusted it.
- A timestamp and a request or workflow ID, so any one answer can be reconstructed on demand instead of estimated after the fact.
That list is a smaller version of what Article 12 asks a biometric system to keep. It is also close to what a model router tracks internally. Complete non-streaming Nadir responses expose model, nadir_metadata.cost.total_cost_usd, nadir_metadata.complexity_analysis, and nadir_metadata.response_time_ms; a configured, priced benchmark adds nadir_metadata.benchmark_comparison.savings_usd. None of that makes a regulated high-risk system compliant on its own—Article 12 asks for much more—but it creates a per-request audit record instead of leaving reconstruction to a monthly invoice.
The deadline moved. The question "which model answered this, and what did it cost" did not get any easier to answer without logging it, and it is cheaper to build that habit now than in a hurry after a regulator, auditor, or CFO asks for it. Start free and inspect the record on complete non-streaming responses and in the dashboard.
Sources: [Pinsent Masons, "Law delaying EU high-risk AI rules finalised," July 2026](https://www.pinsentmasons.com/out-law/news/law-delaying-eu-high-risk-ai-rules-finalised). [artificialintelligenceact.eu, "Article 12: Record-Keeping"](https://artificialintelligenceact.eu/article/12/). [Cloud Security Alliance, "EU AI Act High-Risk Deadline: Enterprise Readiness Gap"](https://labs.cloudsecurityalliance.org/research/csa-research-note-eu-ai-act-high-risk-compliance-deadline-20/). [Holland & Knight, "US Companies Face EU AI Act's Possible August 2026 Compliance Deadline," April 2026](https://www.hklaw.com/en/insights/publications/2026/04/us-companies-face-eu-ai-acts-possible-august-2026-compliance-deadline). [Help Net Security, "What the EU AI Act requires for AI agent logging," April 2026](https://www.helpnetsecurity.com/2026/04/16/eu-ai-act-logging-requirements/). [Yahoo Finance, "Client Accidentally Burns $500 Million on Claude AI in One Month," May 2026](https://finance.yahoo.com/sectors/technology/articles/client-accidentally-burns-500-million-105400717.html). [The Information, "Uber CTO Shows How Claude Code Can Blow Up AI Budgets," May 2026](https://www.theinformation.com/newsletters/applied-ai/uber-cto-shows-claude-code-can-blow-ai-budgets). Figures current as of August 2026; the Omnibus text was finalized by Parliament and Council in July 2026 and formal publication in the Official Journal was pending at time of writing.