Does the EU AI Act delay mean you can skip AI agent certification?

Why this question is being asked now

For most of 2026, enterprises evaluating AI agent certification were doing so with 2 August 2026 in view as the forcing function: the date Article 26 deployer obligations and the associated Article 99 penalty regime would apply to Annex III high-risk systems. That date is no longer operative for Annex III. The Digital Omnibus on AI reached political agreement on 7 May 2026, received Council final approval on 29 June 2026, and entered into force on 27 July 2026, pushing the relevant obligations to 2 December 2027. An enterprise that had scoped a certification engagement to be complete by August is now, reasonably, asking whether the same engagement can be rescoped to a slower timeline, or shelved for a year.

The honest answer requires separating two things this site's earlier coverage sometimes treated as more closely linked than they actually are: the EU AI Act's Annex III compliance calendar, and the broader set of reasons an organisation pursues certification in the first place. The delay changes the first. It does not change the second.

What the Omnibus actually changed

The Digital Omnibus deferred two application dates. Annex III high-risk obligations, covering the provider duties in Articles 9 through 17 and the deployer duties in Article 26, move from 2 August 2026 to 2 December 2027. Annex I obligations, for AI embedded in already-regulated products such as medical devices and machinery, move from 2 August 2027 to 2 August 2028. Nothing about what those obligations require once they activate has changed, and the Article 99 penalty regime that attaches to non-compliance is unaffected.

What was not touched matters as much as what was. Article 5 prohibited practices have been enforceable since 2 February 2025. General-purpose AI model obligations under Articles 53 and 55 have applied since 2 August 2025. Article 50 transparency duties, requiring disclosure that a person is interacting with an AI system and labelling of synthetic content, apply to systems first placed on the market after 2 August 2026 regardless of the Omnibus, with only a narrow grace period for content marking on systems already on the market. None of these obligations were part of the deferral, and none of them are the primary subject of a typical certification engagement in any case, since certification work concentrates on the governance evidence Article 26 and insurers both ask for.

The deadline that actually got closer, not further away

The most consequential fact for this question is one the Annex III headline tends to obscure. The revised Product Liability Directive, Directive 2024/2853, requires every Member State to transpose strict liability for defective products, now including AI software, into national law by 9 December 2026. This deadline is not part of the AI Act, was never subject to the Omnibus negotiation, and did not move at all. As of this article's publication, it is now closer in calendar time than the deferred Annex III date, arriving a full year before 2 December 2027.

Once the Product Liability Directive's standard applies, a claimant harmed by a defective AI system does not need to prove negligence, only that the system was defective and caused harm, with the burden of proof shifting toward the defendant in specific circumstances. Certification-grade documentation, the same risk record, oversight evidence, and testing history a certification assessment reviews, is precisely the evidence base that helps a defendant demonstrate a system was not defective, or that reasonable care was exercised in its design and deployment. An enterprise deferring certification because Annex III moved to 2027 is, in effect, deferring preparation for a strict liability standard that arrives in 2026.

Why insurers and procurement teams did not wait for Annex III either

Certification's value has never come exclusively from AI Act compliance. It comes substantially from two other sources covered in more detail in how certification feeds insurance underwriting and certification and enterprise procurement requirements on this site, and neither source was ever timed to the Annex III calendar.

On the insurance side, AIUC placed the first AIUC-1-backed AI agent insurance policy, for ElevenLabs, in February 2026, following more than 5,000 adversarial simulations against the deployment. That placement happened months before the Digital Omnibus was even formally adopted, let alone in force, which is direct evidence that underwriters were pricing AI agent risk against the system's actual governance evidence, not against a regulatory deadline that had not yet arrived and, as it turned out, would later move. Munich Re's aiSure writes AI performance cover entirely independent of AI Act timing.

On the procurement side, an increasing number of enterprise buyers ask AI vendors for governance or certification evidence as a condition of signing, driven by their own risk management and, increasingly, their own regulatory exposure as deployers, not by the vendor's compliance deadline. A vendor that cannot produce this evidence risks losing the deal regardless of whether its own Annex III obligations activate in 2026 or 2027, because the buyer's own risk calculus does not depend on the vendor's regulatory calendar.

What has genuinely changed, and how to use it

None of this means the Omnibus changed nothing of practical relevance. An organisation now has substantially more calendar time to build Annex III-specific evidence to a high standard, and that additional time is real and worth using well. The mistake is treating additional time on one deadline as a reason to deprioritise work that several other, unmoved deadlines and demand sources still require. The seven-dimension methodology this site publishes, and the certification levels it produces, were built to satisfy AI Act evidence requirements, Product Liability Directive preparedness, and insurer and procurement evidence requests simultaneously, precisely because those three demand sources overlap substantially in what they actually ask an organisation to demonstrate.

A practical response to the Omnibus, for an organisation partway through or about to begin a certification engagement, is to use the additional Annex III runway to deepen the evidence base, closing governance gaps properly rather than under August-deadline time pressure, while keeping the December 2026 Product Liability Directive date as the actual forcing function for having a baseline file ready. The Agent Certified intake process remains the starting point for that work regardless of which deadline is driving it. For the fuller regulatory picture behind this article, including the confirmed Omnibus timeline in full, see the Digital Omnibus explainer on agentliability.eu, and for how the European insurance market is actually responding, see what the Digital Omnibus means for AI agent insurance on agentinsured.eu.