AI product management · Industry brief

The EU AI Act compliance deadlines have shifted significantly. High-risk system obligations (Annex III) moved from 2 August 2026 to 2 December 2027, and product-embedded systems (Annex I) moved from 2 August 2027 to 2 August 2028, following the Digital Omnibus on AI (Regulation (EU) 2026/1744) which entered into force on 27 July 2026. However, prohibited practices, general-purpose AI model duties, transparency requirements, and penalty enforcement remain on their original timelines and are already live as of August 2026. The Act applies extraterritorially to non-EU companies placing systems on the EU market or whose AI output reaches EU users, requiring compliance across provider, deployer, importer, and distributor roles regardless of company location. For SaaS product managers, high-risk systems typically involve hiring tools, education scoring, credit eligibility assessment, and biometric identification—requiring risk management systems, data governance, technical documentation, human oversight design, and conformity assessment by the applicable deadline. Penalties reach EUR 35 million or 7% of worldwide turnover for prohibited practices, with lower caps for SMEs. Practitioners warn against using the deadline delays as justification to defer compliance work, and ISO 42001 certification, while helpful for documentation structure, does not confer legal compliance with the AI Act itself. The six-step startup plan prioritizes inventorying all AI features and tools, determining operator roles, flagging prohibited practices, classifying risk tiers, implementing transparency and literacy measures, and building documentation evidence trails.

AI is becoming part of M&A conversations in financial services, with acquirers focusing on three key assets: data (legitimately and exclusively sourced), model IP (built in-house versus dependent on third-party licensing), and talent retention against competition from deep-pocketed AI labs. Diligence must also examine black-box regulatory risk and computer-driven economics that don't always scale, weighing the deal thesis against evolving legal, regulatory and operational considerations. This reflects a broader trend where technology spending and efficiency gains are making consolidation more compelling, with a favorable regulatory climate potentially supporting a larger wave of strategic M&A heading into 2027 (Mayer Brown Financial Services M&A Summit, Chicago).