Most infrastructure teams read the deferral headline, filed the whole regulation under 2027, and went back to work. That is the expensive mistake of this quarter.
On 2 August 2026 the EU AI Act reached full applicability. Six days earlier, Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force and pushed the high-risk obligations back by 12 to 16 months. Most infrastructure teams read the second headline, filed the whole regulation under 2027, and went back to work.
That is the expensive mistake of this quarter.
The deferral was real, but it was narrow. It moved the standalone high-risk regime to 2 December 2027 and the product-embedded regime to 2 August 2028. It did not touch the transparency duties in Article 50. It did not touch the Commission's power to fine providers of general-purpose AI models. And it did not touch the penalty regime, which is now operative across the bloc at up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher.
More to the point: almost none of the work that got deferred is legal work. Automatic event logging, six-month retention floors, ten-year documentation custody, tamper-evident audit records, and jurisdictional control of where all of it sits are storage and platform problems. They take quarters to build, not weeks to draft. A compliance team that reads the deferral as permission to stop is handing its infrastructure team a 2027 deadline with a 2027 start date.
Here is what actually landed, what it costs to hold, and the checklist to work through before the December 2027 clock gets short.
The sequence matters because a lot of vendor guidance still circulating was written before it finished. The European Parliament approved the Omnibus amendments on 16 June 2026 by 423 votes to 57, with 174 abstentions. The Council gave final approval on 29 June. The regulation was published in the Official Journal on 24 July and entered into force on 27 July, six days ahead of the original deadline it was rewriting.
| Obligation | Original date | Status as of August 2026 |
|---|---|---|
| Prohibited practices (Article 5) | 2 Feb 2025 | In force since Feb 2025 |
| AI literacy obligations | 2 Feb 2025 | In force since Feb 2025 |
| GPAI model obligations (Chapter V) | 2 Aug 2025 | In force since Aug 2025 |
| Transparency duties (Article 50) | 2 Aug 2026 | LIVE NOW, not deferred |
| Commission fining power over GPAI (Article 101) | 2 Aug 2026 | LIVE NOW, not deferred |
| Penalty regime (Article 99) | 2 Aug 2026 | LIVE NOW, not deferred |
| High-risk, standalone (Annex III) | 2 Aug 2026 | Deferred to 2 Dec 2027 |
| High-risk, embedded in products (Annex I) | 2 Aug 2027 | Deferred to 2 Aug 2028 |
The substance of the high-risk regime was not softened. Conformity assessment, risk management, data governance, human oversight and technical documentation all survive intact. Morgan Lewis put the point to clients plainly: treat the amendments as an extension of time to finish the work rather than a relaxation of what the work is.
There is a second reason not to relax. Article 111 gives systems already on the market a transition path, but only if they undergo no substantial modification. Every model swap, every retraining run, every material change to a decision pipeline risks resetting that clock. For an AI system under active development, which is most of them, the grandfathering is thinner than it looks.
Article 50 is the obligation that surprised people, because it reads like a product and marketing concern and is enforced like an engineering one. It requires that anyone interacting with an AI system be told so in plain language, and that synthetic audio, image, video and text be marked in a machine-readable format. Deepfakes must be labelled. Non-compliance sits in the same penalty tier as high-risk violations: 15 million euros or 3 percent of global turnover.
Two words carry the infrastructure weight: machine-readable. The marking is not a caption in the UI. It is metadata that has to be present in the artifact that reaches the end user, which means it has to survive every transformation between the model and the browser.
That is where it breaks. Provenance metadata attached at generation time gets stripped by the thumbnail service, dropped by the transcode step, discarded on a multipart re-upload that does not preserve user-defined object metadata, and flattened by the CDN image resizer that rewrites the file to WebP. Every one of those is a normal, sensible piece of infrastructure doing exactly what it was built to do. None of them were built with a regulatory obligation attached to the metadata block.
The test is not whether your generation service writes the marking. It is whether the object your user downloads still carries it. Run one file end to end through the real delivery path and inspect what comes out the other side. Most teams doing this for the first time find the marking is gone by the second hop.
This is the part that was deferred, and the part you should start anyway, because the architecture takes longer to build than the deadline suggests.
Article 12 requires high-risk AI systems to technically allow the automatic recording of events over their lifetime. Automatic means the system generates the records itself; a runbook and a screenshot folder do not satisfy it. Lifetime means from deployment to decommissioning, across every release in between.
Article 19 and Article 26(6) set the retention floor: logs must be kept for a period appropriate to the intended purpose and in any case at least six months, unless other Union or national law says otherwise. Article 18 goes considerably further for providers, requiring technical documentation, quality management system records, change approvals, notified body decisions and the EU declaration of conformity to be kept at the disposal of national authorities for ten years after the system is placed on the market.
Six months and ten years are very different storage problems, and they land on different data. The first is a high-volume operational stream. The second is a low-volume archive that has to stay legible and provable for a decade, most likely outliving the team that created it and possibly the vendor that supplied the system.
The regulation does not prescribe a schema, which is why so many teams assume their existing application logs will do. They will not. Article 19 names the fields the record has to support: the period of use, the reference databases consulted, the input data that led to a match, and the identity of the natural persons involved in verifying the result.
That last field is the one that breaks existing stacks. Most application logging carries a service account, a trace ID and a latency number. It does not carry the identity of the human reviewer, the policy state in force at the moment of the decision, or a reference to the exact input that produced the output. Retrofitting identity propagation into a logging layer that was never designed to carry it is a multi-quarter project in any organisation of size.
Build the audit trail at the request layer, not inside the application. Store references and content hashes rather than raw payloads, so the audit record and the personal data it points at can be governed on separate retention clocks. That separation is what lets you satisfy a six-month regulatory floor without colliding with the GDPR storage limitation principle, which requires personal data to be erased once its purpose is served.
Take a single high-risk system serving 5 million inference calls a day. Once the record carries reviewer identity, policy state, reference lookups and input hashes, roughly 8 KB per event is realistic. That is 40 GB a day, or about 7.3 TB held on a rolling six-month window.
Storing 7.3 TB is not the problem. Producing it on demand is.
| Storage approach | Monthly cost, 7.3 TB | Producing six months of logs on a regulator request |
|---|---|---|
| Hyperscaler standard object tier | About $170 | Roughly $660 in egress at list rates, available immediately |
| Hyperscaler deep archive tier | About $7 | Restore first, up to 12 hours standard or 48 hours bulk, then retrieval fees plus roughly $660 in egress |
| Zero-egress provider (Backblaze B2, Wasabi, Cloudflare R2) | $35 to $50 | Egress is free or capped, available immediately |
The deep archive row is the trap. Tiering audit logs to the cheapest possible storage is the obvious FinOps move, and it saves about $160 a month. Then a market surveillance authority sends a documentation request, and the restore window collides with a response deadline measured in days. You have optimised the cost of the thing you will do every month and ignored the cost of the thing that determines whether the evidence arrives on time.
This is the egress toll booth applied to compliance rather than to migration. The cheapest place to put an audit trail is somewhere you can pull it out of for free, because unlike most stored data, the entire point of this data is that someone else will eventually demand all of it at once.
Two more architectural requirements follow from the evidentiary purpose. Logs that can be silently edited are weak evidence, so write them to immutable storage with object lock in compliance mode, retention set at write time, and the signing keys held outside the trust boundary of the service producing the records. And where sector law imposes longer retention, that clock wins: financial institutions under MiFID II style obligations and healthcare deployers under six-year baselines should treat six months as a floor they will never actually use.
Article 18 puts a decade of compliance evidence somewhere, and requires it to be available to competent authorities on request with its integrity intact. That turns a question most teams answered in a vendor questionnaire into an architecture decision.
The distinction that matters is between residency and sovereignty. Residency is geographic: your data physically sits in Frankfurt. Sovereignty is jurisdictional: it concerns which country's law governs the legal entity operating the infrastructure and therefore who can compel access to it. Selecting a European region from a US-headquartered provider gives you the first and not necessarily the second, because the US CLOUD Act reaches the operating company regardless of where the servers are.
The market has already priced this in. Gartner forecasts worldwide sovereign cloud IaaS spending at $80 billion in 2026, a 35.6 percent increase over 2025, with Europe recording 83 percent growth and set to overtake North America in 2027. Gartner also estimates that geopatriation will shift 20 percent of current workloads from global to local cloud providers. That is not a compliance footnote. That is a structural reallocation of infrastructure spend, and it is happening in the same window as the AI Act rollout, DORA's concentration risk rules and the Data Act's switching provisions.
Hyperscalers have responded with sovereign offerings, and they close part of the gap. AWS European Sovereign Cloud reached general availability in January 2026 with EU-resident operational staff and separate governance. Whether that resolves the residual jurisdictional exposure is a question for your counsel, not your architect. The architect's job is to know which tier each workload sits in and to be able to say so in a sentence.
Two AI Act mechanisms reach into infrastructure procurement in ways that are easy to miss.
The first is Article 101 and the AI Office enforcement toolkit that activated on 2 August. The Commission can now request information from general-purpose model providers, demand model access, order mitigations, and require withdrawal from the EU market. If a foundation model your inference stack depends on becomes restricted in Europe, you inherit the disruption immediately. Model portability, which most teams treat as an abstract architectural virtue, is now a concrete regulatory dependency. The practical mitigation is unglamorous: keep the abstraction layer between your application and the model provider real, and test it.
The second is the interaction between GPU capacity and compliance evidence. GPU availability moves. Enterprises train on one provider this quarter and another next quarter depending on capacity, price and contract length, and this is the correct strategy in a market where supply is loosening. But the audit trail, the training data documentation and the model checkpoints have to move too, or they end up split across three providers and two jurisdictions with no single place a regulator's request can be answered from.
As Sunny Smith of Massed Compute put it on the DataStorage.com podcast, the first question to ask any GPU provider is whether they own the GPU. That question now has a compliance dimension attached. A broker reselling capacity it does not own cannot tell you which legal entity operates the facility, cannot commit to where your logs are written, and cannot sign a data processing agreement that means anything. Support tickets that get copy-pasted between companies are an annoyance during an outage. They are a serious problem when the request comes from a market surveillance authority.
Work through these in order. The first item is the one most organisations fail, and failing it makes every other item unanswerable.
The AI Act's August 2026 deadline did not disappear. It got smaller and sharper, and the part that moved is the part that takes longest to build. Sixteen months sounds generous until you price identity propagation into a logging layer that never had it.
Compare AWS, Google Cloud, Azure, and alternatives like Backblaze B2 Discover how much you could save in seconds
