The AI Act Deadline Moved. Your Accountability Didn’t.

For senior leaders trying to understand their personal accountability for artificial intelligence, the summer of 2026 appeared to bring some welcome breathing room.

The EU AI Act timetable changed. Following the AI Omnibus, the rules for high-risk AI systems listed in Annex III will now apply from 2 December 2027, while the requirements for high-risk systems embedded in regulated products under Annex I move to 2 August 2028.

For organisations that had been working towards a much nearer compliance date, that matters. Implementation plans can be recalibrated, some technical work can be rescheduled and resources can be allocated differently.

What senior leaders should not do is confuse a later deadline with later accountability.

The regulatory timetable has become more fragmented, not less relevant. Some AI Act obligations are already live. Existing UK financial services obligations continue irrespective of the European timetable. Meanwhile, increasingly autonomous AI systems are creating accountability questions that regulators, government and firms are already having to confront.

The result is a different governance problem from the one many boards were preparing for earlier this year.

There is no longer one AI deadline around which an accountability programme can conveniently be organised.

There are several clocks running at once.

One deadline moved. Others did not

The first important distinction is within the EU AI Act itself.

Article 50 transparency obligations have applied since 2 August 2026. These include requirements affecting certain systems that interact directly with people, AI-generated or manipulated content, deepfakes, emotion recognition and biometric categorisation.

There is a limited transitional period until 2 December 2026 for the Article 50(2) marking and detection obligation for certain systems placed on the market before 2 August, but the wider transparency regime is already part of the current compliance landscape.

That matters because it breaks the increasingly dangerous shorthand that “the AI Act has been delayed”.

Parts of it have. Parts of it have not.

For a senior leader, that distinction should change the governance question. Instead of asking when the AI Act applies to the organisation, the better question is which obligations apply to each AI system today, which will apply later, and who is accountable for ensuring the organisation is ready for both.

That is a much more demanding question.

UK accountability never depended on the AI Act

For UK regulated financial services firms, the position is more complicated still because accountability for AI did not begin with the EU AI Act.

The FCA has repeatedly made clear that it does not currently intend to create an entirely separate regulatory regime for artificial intelligence. Its approach is principles-based and outcomes-focused, relying on existing frameworks to address many of the risks AI introduces.

Two of those frameworks are particularly important: Consumer Duty and the Senior Managers and Certification Regime.

Consumer Duty does not stop applying because a customer outcome was influenced by an algorithm. A firm remains responsible for delivering good outcomes for retail customers, including appropriate products and services, fair value, understandable communications and suitable support.

Nor does the use of AI remove senior management accountability.

The FCA’s position on SM&CR is important here. Its existing framework places responsibility on senior managers for activities, business areas and management functions within their remit. The FCA’s own AI guidance has made clear that AI used within those areas does not somehow sit outside that responsibility simply because a machine is involved.

This creates an important principle for boards.

Delegating a decision to technology does not necessarily delegate accountability for the consequences of that decision.

That principle becomes increasingly important as AI moves from assisting employees to performing tasks with greater autonomy.

Agentic AI changes the accountability conversation

Much of the first wave of enterprise AI involved systems that generated information, summarised documents, analysed data or assisted people in making decisions.

Agentic systems move the discussion further.

An AI agent can potentially execute a sequence of actions towards an objective, interacting with systems, information and potentially other agents with varying degrees of human intervention.

In financial services, agentic payments provide an obvious example.

The Financial Services AI Adoption Plan, published on 14 July 2026, identifies agentic payments as a practical near-term example of a broader class of autonomous financial systems. It also identifies uncertainty around legal and regulatory accountability, liability and consent when autonomous agents operate across complex value chains.

One of its recommendations is the development of legal constructs and dispute mechanisms capable of assigning accountability when autonomous agents transact.

The Plan is not itself a new regulatory rulebook. But boards should pay attention to what it reveals.

The accountability problem is moving beyond whether an organisation is permitted to deploy AI. The harder question is what happens when AI is permitted to act.

If an agent makes a decision that causes customer harm, initiates an inappropriate transaction, acts on incorrect information or operates beyond the intended parameters, where does responsibility sit?

• With the technology provider?

• With the firm deploying it?

• With the executive responsible for the business function?

• With risk?

• With the person who approved the use case?

The answer will depend on the circumstances and applicable regulatory framework. “The AI did it”, however, is unlikely to constitute a governance model.

The accountability map needs to follow the system

This is why firms should resist organising AI governance solely around regulatory implementation dates.

The more useful approach is to create an accountability map around the systems themselves.

For every material AI system, the organisation should be able to establish what the system does, what decisions it influences or makes, which customers or stakeholders may be affected, what regulatory obligations apply, who owns the system, who owns the risk and who has authority to intervene.

That map should also identify what happens when the technology behaves differently from expectation:

• Can somebody stop it?
• Who receives the alert?
• What evidence is retained?
• How quickly can a decision be reconstructed?
• Who determines whether affected customers require remediation?

Those questions may sound operational, but they are also governance questions because they determine whether the named individuals responsible for an activity can demonstrate meaningful control.

This is where documentation becomes particularly important.

A policy stating that a senior manager owns AI risk is not evidence that the risk is being controlled. Neither is a governance chart showing committees and reporting lines.

The more important evidence is what happens underneath them: testing, monitoring, escalation, exception handling, decision records, customer outcome data, audit trails and evidence that identified problems resulted in action.

The board should ask a different set of questions

The fragmented timetable therefore gives boards an opportunity to reconsider how AI is being governed.

Rather than asking, “Are we ready for the AI Act?”, boards may get more useful answers by asking:

Which AI systems are currently operating across the organisation?

Which of them influence regulated activities or customer outcomes?

Which obligations apply to each system now, and which are approaching?

Which named individuals are accountable for those activities?

Where are the boundaries between technology ownership, business ownership and risk ownership?

What evidence would those individuals produce if challenged tomorrow?

And, increasingly, what decisions or actions can the AI take without a human approving each step?

That last question will become more important as agentic technologies mature.

An organisation may be comfortable with AI recommending an action while a person decides whether to take it. It may need a substantially different control environment when the system can initiate the action itself.

The governance model therefore has to evolve with the capability of the technology, not simply with the date printed in legislation.

Delay can create its own risk

There is another danger in the extended timetable.

When a major compliance deadline moves, organisational attention tends to move with it. Budgets are reconsidered; programmes lose urgency and senior attention shifts towards whatever appears more immediate.

For some elements of AI Act implementation, adjusting the timetable will be entirely sensible.

Allowing the wider governance programme to lose momentum is harder to justify.

AI adoption is not standing still while the regulatory calendar catches up. Firms are experimenting with increasingly capable systems, employees are finding new applications for readily available tools, and AI is becoming embedded in operational processes and customer journeys.

The gap between technological capability and governance maturity can therefore widen even while the formal compliance deadline becomes more distant.

For senior managers, that may be the most important consequence of the delay.

More time to comply does not necessarily mean less risk to manage.

From regulatory calendar to accountability framework

The AI Act timetable will almost certainly continue to attract attention because deadlines are easy to communicate and relatively easy to plan around.

Accountability is messier.

It crosses regulatory regimes, organisational boundaries, technology providers, business functions and individual responsibilities. It changes as systems become more capable and as their use within an organisation changes.

That is why the most useful governance question for senior leaders is no longer simply:

When does the AI Act apply?

It is:

Which obligations apply to this system today, what will apply next, and who can demonstrate that it is under control?

The firms best prepared for the next phase of AI regulation will not necessarily be those with the most detailed countdown to December 2027.

They will be those that already know where their AI is operating, what it is doing, whose decisions it affects, who is accountable for it and what evidence demonstrates that accountability in practice.

The deadline moved.

The responsibility did not.

The DPG perspective

At The DPG, our AI governance framework is designed around that changing accountability landscape rather than a single regulatory date. We help organisations map AI systems, regulatory obligations, ownership, controls and evidence so that governance remains current as technology and regulation evolve.

For senior leaders, the objective is not simply to prepare for the next deadline. It is to be able to demonstrate, at any point, who is accountable, what they are accountable for and how they know the organisation’s AI systems remain under meaningful control.