Delayed, Not Cancelled: The AI Compliance Calendar for 2027

2 August 2026 was supposed to be the day the EU's rules for AI in hiring, credit and similar decisions took effect. They did not arrive. Enforcement did: from that day the European Commission's AI Office and national authorities could apply the AI Act, and new transparency rules for chatbots and AI-generated content took effect16.

That pattern runs through 2026. The EU delayed. Colorado repealed and replaced. California signed narrower bills than unions wanted17. It is tempting to read this as permission to wait. Our read: the deadlines did not disappear. Most now land between December 2026 and December 2027, and the work they require (notices, human review, documentation) takes longer to build than people expect.

Europe: the delay is real, and so is enforcement

The delay came through the "Digital Omnibus on AI," published in the Official Journal as Regulation (EU) 2026/1744 on 24 July 2026 and in force from 27 July35. It was proposed on 19 November 2025 and agreed politically on 7 May 20262.

Stand-alone high-risk uses listed in Annex III, such as employment and education, now apply from 2 December 2027 instead of 2 August 202623. High-risk AI built into regulated products such as lifts and toys (Annex I) applies from 2 August 202823.

For a US company, Annex III is the list to read. It covers AI used to recruit and screen candidates or to decide promotions, terminations, task allocation and performance monitoring9. It also covers AI that scores the creditworthiness of individuals (fraud detection excepted) and AI used for risk assessment and pricing in life and health insurance9. Being based outside the EU does not take you out of scope: the Act reaches providers that place systems on the EU market, and providers and deployers abroad whose system's output is used in the Union8.

Much was not delayed:

• Prohibited practices have applied since 2 February 20252.
• General-purpose AI model obligations have applied since 2 August 2025. Models placed on the market before that date must comply by 2 August 202727. These duties sit with model providers, not companies building on their models7.
• Enforcement powers apply from 2 August 2026. The ceiling for prohibited practices is €35 million or 7% of worldwide annual turnover. Other breaches, including of general-purpose AI obligations, can reach €15 million or 3%67.
• Transparency: chatbots must tell people they are dealing with AI, deepfakes must be labelled, and AI-generated content must carry machine-readable marks1. Systems already on the market before 2 August 2026 have until 2 December 2026 for the marking requirement34.
• A new ban: AI systems that generate non-consensual sexual content or child sexual abuse material are prohibited from December 202624.

Colorado and California: notices and human review, not audits

Colorado's 2024 AI Act never took effect. After one delay it was scheduled for 30 June 202613. In April, xAI sued to block it and the US Department of Justice moved to intervene, arguing it violates the Equal Protection Clause1214. A stipulated order of 27 April paused enforcement and set xAI's injunction motion for 28 days after final rules under that law or a replacement12.

The replacement, SB 26-189, was signed on 14 May 2026, with main duties from 1 January 20271011. It covers automated decision-making technology (ADMT) that materially influences consequential decisions in education, employment, housing, lending and financial services, insurance, health care and essential government services10. Deployers must give notice at the point of interaction. After an adverse decision they must explain the ADMT's role in plain language within 30 days, and consumers can correct their data and ask for meaningful human review10. Developers must give deployers documentation on intended uses, training data categories, limitations and human review10. Both must keep compliance records for at least three years10. The Attorney General enforces, with a 60-day cure period that runs until 1 January 20301011. Gone are the 2024 law's impact assessments, risk-management programs and duty of care against algorithmic discrimination1112.

The detailed rules are not final. An interim draft issued on 6 October proposes a presumption for when an output "materially influences" a decision; the public hearing is on 26 October 20261516.

On 30 September 2026, California's governor signed several workplace AI bills1718:

• SB 947, the "No Robo Bosses Act", bars employers from relying solely on an automated decision system to discipline or fire employees. Where a system is the primary basis, a person must corroborate its output and the employee gets written notice1819. It is operative from 1 July 2027, with a $500 civil penalty per violation, enforced by the Labor Commissioner and public prosecutors1920. Contractors are not covered1719.
• SB 951 requires Cal/WARN layoff notices to disclose when a layoff is caused wholly or substantially by AI or automation, from 1 January 20271820.
• AB 1883 bars AI workplace surveillance that infers emotional states or collects neural data, from 1 January 202720.

Separately, the California Privacy Protection Agency's ADMT regulations require pre-use notices, opt-out rights and access for significant decisions, including employment, from 1 January 20271821. Risk assessments for processing that began before 2026 are due by 31 December 202721.

Two older state laws are already in force. Illinois has required notice and barred discriminatory AI use in employment decisions under its Human Rights Act since 1 January 202625. Texas's TRAIGA took effect the same day, though it places few duties on private employers24.

Washington: pressure on the states, no preemption law

No federal statute preempts state AI law as of October 2026. Executive Order 14365 (11 December 2025) created a DOJ AI Litigation Task Force, ordered a Commerce review of "onerous" state laws and tied some broadband funding to state AI policy, but it preempts nothing itself22. In Congress, the Great American AI Act, which would preempt some state AI regulation for three years, was released in June as a discussion draft, not an introduced bill23.

Our read: federal attention is on model makers. On 29 September, leading developers signed a White House accord on internal controls and external audits26, and the FTC confirmed an investigation of OpenAI, Anthropic and other AI companies over consumer risks2728.

Fig. 01Art · Regulation

The calendar

• 26 Oct 2026: Colorado rulemaking hearing on ADMT rules15.
• 2 Dec 2026: EU content-marking deadline for existing generative systems; new EU prohibition applies23.
• 1 Jan 2027: Colorado SB 26-189; California ADMT regulations, SB 951 and AB 1883102021.
• 1 Jul 2027: California SB 94719.
• 2 Aug 2027: EU deadline for general-purpose AI models placed on the market before August 20257.
• 2 Dec 2027: EU Annex III high-risk rules, including hiring, credit and life and health insurance pricing29.
• 31 Dec 2027: California risk assessments for pre-2026 processing21.
• 2 Aug 2028: EU Annex I high-risk rules for AI in regulated products2.

Still pending: Colorado's final rules, the xAI case, and any preemption bill.

What to do now

• Build an AI inventory. List every system that touches a hiring, firing, credit, insurance, pricing or eligibility decision, including AI features inside HR, CRM and ERP software you already license. Note which produce output used in the EU.
• Classify each system. Record which rules could apply and from what date. Questions for counsel: does a tool "materially influence" a decision in Colorado, and does a use fall within Annex III?
• Update vendor contracts. Ask for the documentation Colorado requires, notice of material updates, and support for EU content marking. Ask counsel how Colorado's fault allocation affects your indemnities.
• Design human review now. Name the reviewer, give them authority to override, and let them see the inputs. Both California and Colorado expect more than a sign-off.
• Draft the notices. Point-of-interaction notices, 30-day explanations and California's pre-use and post-use notices take time to write and wire in.
• Keep the paper trail. Colorado requires three years of records. Log what each system did, who reviewed it and why.

Olympas's management consulting team helps companies build the inventory and review workflows in their own systems, alongside counsel, who make the legal calls.