What applies
On 2 August 2028, the AI Act reaches its final stage: the high-risk duties then also apply to AI embedded in regulated products (Annex I), and the last transition periods run out. Since the Digital Omnibus Regulation, grandfathering for legacy systems is tied to the same dates as for new systems: 2 December 2027 for Annex III, 2 August 2028 for Annex I (Art. 111, 113 AI Act).
This is the deadline that looks furthest away today and needs the most lead time: retrofitting or replacing legacy systems reliably takes longer than any new rollout.
Who it affects
Everyone already running high-risk AI in production — especially systems bought years ago whose providers have gone quiet.
Example (fictional): The legacy system without a provider
An energy utility has used an AI system from a since-acquired vendor to run load forecasting since 2022. Years later, the supervisory authority requests the technical documentation — the acquirer no longer supports the legacy product.
The utility has to migrate within months what a calm two-year timeline would have covered. The migration succeeds — at three times the cost, with a summer spent in crisis mode.
The risks, plainly stated
Fines despite the end of grandfathering
Once the deadline passes, legacy systems face the same sanctions as new ones: up to €15 million or 3% of worldwide annual turnover.
Forced rapid migration
Anyone who discovers late that a legacy system can't be retrofitted migrates under time pressure — the most expensive mode there is.
Lost negotiating position
The closer the deadline, the weaker your position against providers selling conformity as a paid upgrade.
Your next steps
- 01Take stock: which legacy AI is running where, and who is the provider?
- 02Clarify retrofit feasibility system by system — now, while time is still leverage
- 03Build a migration plan with buffer — the deadline is closer than it sounds
In Compliverse
The compass turns exactly these steps into measures in your plan automatically — with deadlines, owners, and evidence.
Plain-language product content, not legal advice · Case studies are fictional · Fine amounts as stated in the legal act (“up to”)