The EU AI Act and your law firm: what August 2026 actually requires

For most of this year, every EU AI Act explainer aimed at lawyers said some version of the same thing: get ready, because August 2, 2026 brings high-risk obligations to AI systems used in "administration of justice," and that phrase covers legal research and drafting tools. Law firm compliance memos got written. Vendors updated their marketing decks. Then the European Parliament and the Council of the EU quietly moved the deadline, and most of that content never got updated.

The short version: the deadline moved. The obligation didn't disappear. And a handful of things genuinely do still land on August 2, whether or not your practice ever touches Brussels.

What actually happened to the deadline

On 19 November 2025, the European Commission tabled a "Digital Omnibus" proposal aimed at simplifying parts of the AI Act, largely because the regulatory infrastructure needed to make the high-risk rules workable, standards, conformity bodies, guidance documents, wasn't ready. Trilogue talks stalled in April, then produced a provisional agreement on 6 May 2026. The European Parliament formally endorsed it on 16 June, and the Council gave its final green light on 29 June, according to the Council's own press release. Publication in the Official Journal was expected within weeks of that vote.

The result, laid out in detail by Gibson Dunn's client alert: compliance obligations for stand-alone Annex III high-risk systems, the category that includes AI used to research and interpret facts and law, move from 2 August 2026 to 2 December 2027. AI embedded in already-regulated products, medical devices, machinery, vehicles, moves further still, to 2 August 2028. That's a sixteen-month reprieve on the provision that actually worried legal-tech vendors and the firms buying from them.

What still lands on August 2, 2026

Not everything got pushed. Article 50's transparency obligations stayed on schedule. If your firm runs a client-facing AI chatbot, it has to disclose that users are talking to a machine, unless that's already obvious from context. If you publish AI-generated content that could be mistaken for something a human wrote, produced, or recorded, and it's aimed at the public, that content needs a disclosure too. A four-month grace period, until 2 December 2026, applies specifically to the machine-readable watermarking piece for systems already on the market. The disclosure duty itself doesn't get that grace period.

Article 4's AI literacy obligation also stays in force. It's been live since 2 February 2025, and the Omnibus softens the wording from requiring firms to "ensure" a level of staff literacy to requiring them to "support the development of" it, a lower bar, but still a documented duty. If your firm has never written down what training or guidance staff received on the AI tools they use, that gap is worth closing regardless of what happens with high-risk systems. Our AI policy template is built to cover exactly this.

Does any of this actually reach a UK or US solo practice?

Sometimes. The AI Act follows a GDPR-style jurisdictional model: it doesn't care where your firm is registered, it cares where the output lands. If your AI system's output is used in the EU, or you're making an AI-enabled tool available to EU users, you can fall in scope even with zero EU employees and zero EU offices. A domestic conveyancing or personal injury practice with no EU-facing work has close to no exposure today. A cross-border immigration practice, an IP firm prosecuting EU patents, or any US firm advising a company with EU subsidiaries should read this differently.

This mirrors the disclosure question we covered in when lawyers actually have to tell clients they're using AI. The trigger usually isn't "did I use AI." It's "does the specific use touch a specific regulated category," and that category differs by rule.

Why the "administration of justice" label still matters

Annex III's high-risk list explicitly names AI systems intended to assist judicial authorities in researching and interpreting facts and law, and systems used in alternative dispute resolution, according to Holland & Knight's analysis. That classification hasn't been repealed, it's been rescheduled. Providers of legal research tools with EU ambitions will still need conformity assessments, technical documentation, and registration in the EU's public database, just starting December 2027 instead of this August. If you're evaluating a legal AI vendor and they claim the high-risk rules "don't apply to them," ask whether they mean never, or just not yet. Those are different answers, and only one of them is honest.

What to actually do before August 2

1. List every AI tool your firm uses that could touch an EU client, an EU-based opposing party, or output published where an EU audience might see it.
2. If you run a client intake chatbot or any AI-enabled tool that talks to the public, add a plain disclosure that it's AI. Our piece on AI for client intake covers where this fits into the workflow.
3. Write down, even briefly, what AI training or guidance your staff have had. It doesn't need to be elaborate. It needs to exist.
4. Don't build a compliance program around December 2027 as if it were distant. Eighteen months disappears fast, and the firms that waited for the original August 2026 deadline to start thinking about this were already behind.

None of this replaces checking the Official Journal text once it publishes, or the guidance your own bar or law society issues on cross-border AI use. Rules that get formally adopted in June can still carry technical wrinkles that only show up once regulators start applying them. Treat this as the current state of play, not the last word.

Get a working AI policy and a disclosure checklist mapped to both US and UK obligations in The Lawyer's AI Starter Kit, free. And if you're choosing an AI research or drafting tool and want to know which ones actually build in the kind of documentation trail this Act rewards, the best AI tools for lawyers page tracks that alongside confidentiality practices.

FAQ