[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"blog-faqs-eu-ai-act-omnibus-deferral-ai-feature-inventory-en":3,"blog-post-eu-ai-act-omnibus-deferral-ai-feature-inventory-en":28},[4,8,12,16,20,24],{"answer":5,"id":6,"question":7},"No, according to the secondary sources we read. What moved are the obligations for two groups of high-risk systems: stand-alone Annex III systems to 2 December 2027, and AI embedded in Annex I products to 2 August 2028. The Article 50 transparency duties and the GPAI provider duties were reported as not postponed. We did not read the legal text itself.","wqi4qc3b31vqmqu","Did the EU postpone the whole AI Act?",{"answer":9,"id":10,"question":11},"They come from two secondary sources that agree, Legal 500 and Gibson Dunn. The Gibson Dunn note was written before final adoption. We could not open the regulation on EUR-Lex, so check the published text before putting any date in a contract or governance document.","apsk3xts7a3ptyi","How reliable are the dates in this article?",{"answer":13,"id":14,"question":15},"One table answering which parts of the systems an organization uses or delivers use AI, what for, where the output goes, which model or service sits behind it, whether users can see it is AI, what data goes in, and who owns it. It is an operating document for the IT team, not a legal document.","h786mu9d81a2p83","What is an AI feature inventory?",{"answer":17,"id":18,"question":19},"This article does not decide that. Scope depends on whether you are a provider, deployer or importer, and whether your system or its output is used in the EU. That needs legal counsel who knows your facts.","p699tis0wfpfzwo","Does the EU AI Act apply to our Thai organization?",{"answer":21,"id":22,"question":23},"Ask every department what tools they use, go through the settings pages and release notes of key software, and have someone who can read network logs check outbound traffic for calls to external AI services that are not on the list.","hyqs5zvor7sadaw","How do we find AI that came inside software we bought?",{"answer":25,"id":26,"question":27},"Not one built to fit this law. A short one-page list is still useful, because whoever takes over the system will know what calls external services and what data leaves.","g1r3a0fs4szpyus","If we have no European customers, do we still need an inventory?",{"id":29,"parentId":30,"title":31,"excerpt":32,"content":33,"image":34,"date":35,"isoDate":36,"views":37,"tag":38,"categorySlug":39,"slug":40,"to":41,"readTime":42,"isHighlight":43,"sortOrder":44,"video":45,"video_id":45,"keywords":46},"htvudqeeg8xgxw8","oxqvm50nm4b4b8s","The EU Delayed Its High-Risk AI Rules, but Not All of Them: Build an AI Feature Inventory Now","Regulation (EU) 2026\u002F1744 postponed the high-risk obligations of the EU AI Act, according to secondary sources, but not the transparency duties. This article separates what was deferred from what was not and explains an AI feature inventory an IT team can build now.","\u003Cp>A European customer sends a vendor questionnaire to your sales team. One item asks whether the system you delivered has any function that uses artificial intelligence and, if so, whether end users know they are talking to an AI. Sales forwards it to IT. IT opens the news, sees the headline that the EU has postponed the AI Act, and concludes there is no need to answer in this round.\u003C\u002Fp>\u003Cp>That conclusion is only half right. This article is written from the viewpoint of a team that designs and delivers systems, and it is not legal advice. We separate what was actually postponed from what was not, and describe the systems work you can do now without waiting for anyone: an inventory of which AI functions your organization's systems contain and where. Whether your organization falls within the scope of this law is not something we decide for you. That needs legal counsel who knows the facts of your business.\u003C\u002Fp>\u003Ch2>How far this news can be confirmed, and how far we read\u003C\u002Fh2>\u003Cp>Before the substance, we state the status of our information plainly, because this topic moves fast and the sources we could open include versions from before and after the vote.\u003C\u002Fp>\u003Cp>An article by Legal 500 dated 3 August 2026 reports that the Digital Omnibus on AI, Regulation (EU) 2026\u002F1744, was published in the EU Official Journal on 24 July 2026 and entered into force on 27 July 2026 (\u003Ca target=\"_blank\" rel=\"noopener noreferrer\" href=\"https:\u002F\u002Fwww.legal500.com\u002Fintelligence\u002Feuropean-union\u002Ftechnology\u002Feu-digital-omnibus-on-ai-enters-into-force\">see the Legal 500 article\u003C\u002Fa>). The Gibson Dunn note we opened was written before final adoption. It says a political agreement was reached on 6 May 2026 and publication in the Official Journal was still pending, so it can confirm the content of the agreement but not the status of publication (\u003Ca target=\"_blank\" rel=\"noopener noreferrer\" href=\"https:\u002F\u002Fwww.gibsondunn.com\u002Feu-ai-act-omnibus-agreement\">see the Gibson Dunn note\u003C\u002Fa>).\u003C\u002Fp>\u003Cp>What we could not do is open the regulation itself on EUR-Lex. The page we tried returned no content. Every date in this article therefore comes from two secondary sources that agree with each other, not from the legal text, and there are reports of wording corrections after publication. If you will put a date in a governance document or a contract, check the published text again first.\u003C\u002Fp>\u003Ch2>What was postponed, and what was not\u003C\u002Fh2>\u003Cp>As the secondary sources report, what was postponed are the obligations for two groups of high-risk AI systems.\u003C\u002Fp>\u003Cul>\u003Cli>\u003Cp>\u003Cstrong>Stand-alone high-risk systems under Annex III\u003C\u002Fstrong>, such as systems used to select employees, assess credit, or in education, moved from 2 August 2026 to 2 December 2027.\u003C\u002Fp>\u003C\u002Fli>\u003Cli>\u003Cp>\u003Cstrong>AI systems embedded in products already covered by EU safety legislation under Annex I\u003C\u002Fstrong>, such as medical devices and machinery, moved to 2 August 2028 (Gibson Dunn states the original date was 2 August 2027).\u003C\u002Fp>\u003C\u002Fli>\u003C\u002Ful>\u003Cp>What the same sources report was not postponed includes at least three things.\u003C\u002Fp>\u003Cul>\u003Cli>\u003Cp>\u003Cstrong>The transparency duties under Article 50\u003C\u002Fstrong>, such as telling users they are interacting with an AI system and labelling content generated by AI, still apply from 2 August 2026 as originally planned, a date that had already passed when this article was published.\u003C\u002Fp>\u003C\u002Fli>\u003Cli>\u003Cp>\u003Cstrong>The duties of providers of general-purpose AI (GPAI) models\u003C\u002Fstrong>, which have applied since 2 August 2025, with no change of date.\u003C\u002Fp>\u003C\u002Fli>\u003Cli>\u003Cp>\u003Cstrong>Two new prohibitions\u003C\u002Fstrong>, on systems that generate or manipulate realistic intimate imagery and on child sexual abuse material, effective from 2 December 2026 according to Legal 500.\u003C\u002Fp>\u003C\u002Fli>\u003C\u002Ful>\u003Cp>One detail the two sources tell differently: the grace period for machine-readable marking for generative AI systems placed on the market before 2 August 2026. Legal 500 describes a four-month grace period, while Gibson Dunn, written before adoption, gives 2 December 2026 as a proposal. We do not settle this and suggest checking the legal text.\u003C\u002Fp>\u003Ch2>Why a postponement does not mean nothing to do\u003C\u002Fh2>\u003Cp>The headline that the AI Act was postponed leads readers to think the whole law was delayed. But if the sources we read are right, what moved is the part that is heavy in documentation and assessment, while the lighter part, telling users they are talking to an AI, has already started to apply.\u003C\u002Fp>\u003Cp>From a systems viewpoint the difference matters, because transparency duties do not live only in contract documents. They live on the screen, in the messages a chatbot returns, in the audio the system synthesizes, and in the images an image-generation function outputs. If nobody knows which parts of your system use AI, nobody knows where to fix anything.\u003C\u002Fp>\u003Cp>Another point worth thinking about alongside: the date in the law is not the date the customer will ask. Enterprise customers in Europe with their own procurement or risk functions often put AI questions into vendor questionnaires before the actual date of application, because they have to prepare too. These questions may reach your organization before any rule directly applies to you. That is our opinion, not a fact we verified from any source.\u003C\u002Fp>\u003Ch2>What an AI feature inventory is and what goes in it\u003C\u002Fh2>\u003Cp>An AI feature inventory is one table that answers which parts of all the systems an organization uses or delivers use AI, what for, and who owns them. We do not see it as a legal document but as an operating document for the IT team, one that someone who has never touched the system can read and use to answer a questionnaire.\u003C\u002Fp>\u003Cp>For each function, we suggest recording at least the following.\u003C\u002Fp>\u003Cul>\u003Cli>\u003Cp>\u003Cstrong>The function name and the system it is in,\u003C\u002Fstrong> for example a customer-answering chatbot on the website, a document summarization function, a function that scores applications.\u003C\u002Fp>\u003C\u002Fli>\u003Cli>\u003Cp>\u003Cstrong>What the AI does and where its output goes next.\u003C\u002Fstrong> Is the output only shown to a person, or used for further automatic decisions?\u003C\u002Fp>\u003C\u002Fli>\u003Cli>\u003Cp>\u003Cstrong>The model or service behind it:\u003C\u002Fstrong> a model the team trained, an external provider's API, or a function that ships with off-the-shelf software.\u003C\u002Fp>\u003C\u002Fli>\u003Cli>\u003Cp>\u003Cstrong>Whether the end user can see that it is AI:\u003C\u002Fstrong> a notice, a label on generated content, or nothing at all.\u003C\u002Fp>\u003C\u002Fli>\u003Cli>\u003Cp>\u003Cstrong>What data goes into the function,\u003C\u002Fstrong> especially personal data, and whether that data leaves the system or the country.\u003C\u002Fp>\u003C\u002Fli>\u003Cli>\u003Cp>\u003Cstrong>The owner of the function,\u003C\u002Fstrong> as a named person, not a department name.\u003C\u002Fp>\u003C\u002Fli>\u003C\u002Ful>\u003Cp>A column not on that list but that we recommend adding is whether the function can be switched off and who can do it. If one day an auditor or customer asks you to stop using a particular function, a system designed so functions can be switched off one at a time is very different from one that has to stop as a whole.\u003C\u002Fp>\u003Ch2>AI hidden in what you bought\u003C\u002Fh2>\u003Cp>An inventory that starts from code the team wrote itself tends to miss things, because a lot of AI enters an organization other ways.\u003C\u002Fp>\u003Cp>Off-the-shelf software already in use may add a writing, summarizing or search assistant in one update without anyone in the organization choosing it. A content management plugin may call an external model service and send out text the user typed. A tool one department subscribed to on the company card may have an AI assistant switched on from day one. A previous contractor's system may have a model API wired into an undocumented part.\u003C\u002Fp>\u003Cp>The approach we think works is to ask in three ways. First, ask each department what tools it uses, not only the IT team. Second, go through the settings pages and release notes of key software. Third, check the system's outbound traffic for calls to external AI services that are not on the list. The third needs someone who can read network logs and may turn up things nobody prepared for, which is exactly why it is worth doing.\u003C\u002Fp>\u003Cp>For work delivered by external developers, we suggest adding a requirement to the handover documents that every function calling an external AI service be named in the architecture document, with the data sent out stated. That idea is part of what we wrote in our \u003Ca target=\"_blank\" rel=\"noopener noreferrer\" href=\"https:\u002F\u002Fwww.superdev.tech\u002Fblogs\u002Ftor-conditions-for-a-maintainable-system\">article on conditions in a TOR for a maintainable system\u003C\u002Fa>.\u003C\u002Fp>\u003Ch2>Transparency on screen: what a systems team can fix without waiting for the law\u003C\u002Fh2>\u003Cp>Once the inventory exists, the next job that belongs squarely to the systems team is to check whether end users can tell they are encountering AI. We have not read the text of Article 50 itself, so we do not say what notice is required or in which cases. Legal counsel should confirm that. But we can say that in practice there are questions a systems team can answer itself by opening the screens.\u003C\u002Fp>\u003Cul>\u003Cli>\u003Cp>Does a chatbot or voice assistant say it is an automated system, or is it dressed up as a staff member?\u003C\u002Fp>\u003C\u002Fli>\u003Cli>\u003Cp>Does AI-generated content, such as a reply, an image or a summary report, carry something that tells the reader, and does that survive in exported files or disappear when copied off the screen?\u003C\u002Fp>\u003C\u002Fli>\u003Cli>\u003Cp>If a human reviews the output before it is sent, does the system record who reviewed it and when?\u003C\u002Fp>\u003C\u002Fli>\u003C\u002Ful>\u003Cp>The last point ties to logging, which we wrote about in our \u003Ca target=\"_blank\" rel=\"noopener noreferrer\" href=\"https:\u002F\u002Fwww.superdev.tech\u002Fblogs\u002Flog-retention-audit-trail-thailand\">article on log retention and audit trails\u003C\u002Fa>. If an AI function leaves no trace of what went in, what came out and who approved it, you cannot answer questions after the fact, even on a day when no law requires it.\u003C\u002Fp>\u003Ch2>The case of AI agents working inside real systems\u003C\u002Fh2>\u003Cp>An AI function that differs from an ordinary chatbot is an agent that has permission to read or change data in a system, because its effect is not the text on a screen but the data that changes. We wrote about the gate to pass before granting that kind of permission in our \u003Ca target=\"_blank\" rel=\"noopener noreferrer\" href=\"https:\u002F\u002Fwww.superdev.tech\u002Fblogs\u002Fai-agent-readiness-before-system-access\">article on AI agents with access to real systems\u003C\u002Fa>. The AI feature inventory in this article is the step before that one: you must first know which agents and functions already exist before you can decide which should get which permissions.\u003C\u002Fp>\u003Ch2>Limits we should state plainly\u003C\u002Fh2>\u003Cp>If your organization has no customers or users in Europe, delivers systems to no one there, and has no plan to, building an AI feature inventory to fit this law may be more than you need. Our advice in that case is to keep it as a short one-page list, because its value does not rest on one law. Whoever takes over your systems will immediately know what calls external services and what data leaves.\u003C\u002Fp>\u003Cp>Also, this article does not decide when and how EU law applies to your Thai organization. The scope depends on whether you are a provider, deployer or importer, whether your system is placed on the market or its output is used in the EU, and other matters that need case-by-case facts. That is work for legal counsel. What we can do is help the IT team have the system information it needs to answer.\u003C\u002Fp>\u003Cp>Finally, our sources have gaps. We have not read the legal text on EUR-Lex, and on some details, such as the grace period for marking, the two sources differ. The inventory we recommend does not depend on those details, but if you will cite a date in a contract you must check the text first.\u003C\u002Fp>\u003Ch2>Objections we often hear\u003C\u002Fh2>\u003Cp>A common objection is that the rules were pushed to 2027, so we will do it closer to the date. The reasoning is sound, and for an organization whose AI system is genuinely high-risk under Annex III, the extra time reduces pressure considerably. We do not suggest anyone drop other work for this.\u003C\u002Fp>\u003Cp>But we see two reasons the inventory should start before that date. First, if the sources we read are right, the transparency duties have already started and did not wait for 2027. Second, the first inventory spends its time finding out what is where, and the later you start, the more systems and vendors have been added to trace, and the people who remember who wired which API may be gone. We wrote about continuity of vendors in our \u003Ca target=\"_blank\" rel=\"noopener noreferrer\" href=\"https:\u002F\u002Fwww.superdev.tech\u002Fblogs\u002Fvendor-continuity-due-diligence\">article on the risk that a vendor disappears\u003C\u002Fa>.\u003C\u002Fp>\u003Cp>Another objection is that this is a matter for the legal team, not IT. That is true for interpretation, but legal cannot say where the system has AI if IT has not made the inventory. Both sides need the same document.\u003C\u002Fp>\u003Ch2>Where to start\u003C\u002Fh2>\u003Col>\u003Cli>\u003Cp>\u003Cstrong>Ask each department which tools they use that have AI functions,\u003C\u002Fstrong> including ones that came with existing software without being chosen. Do not ask only the IT team.\u003C\u002Fp>\u003C\u002Fli>\u003Cli>\u003Cp>\u003Cstrong>Make a table with one row per function,\u003C\u002Fstrong> using the columns above, with owners as named people.\u003C\u002Fp>\u003C\u002Fli>\u003Cli>\u003Cp>\u003Cstrong>Open the real screen of each user-facing function\u003C\u002Fstrong> and note whether there is a message saying it is AI. Take screenshots with the date.\u003C\u002Fp>\u003C\u002Fli>\u003Cli>\u003Cp>\u003Cstrong>Check which functions send data outside the system\u003C\u002Fstrong> and whether that data includes personal data. We wrote separately about data location in our \u003Ca target=\"_blank\" rel=\"noopener noreferrer\" href=\"https:\u002F\u002Fwww.superdev.tech\u002Fblogs\u002Fcloud-region-data-residency-pdpa\">article on cloud regions and the PDPA\u003C\u002Fa>.\u003C\u002Fp>\u003C\u002Fli>\u003Cli>\u003Cp>\u003Cstrong>Send the table to legal counsel\u003C\u002Fstrong> with the question of which functions are in scope, and set a date to review it again when software is updated or new tools arrive.\u003C\u002Fp>\u003C\u002Fli>\u003C\u002Fol>\u003Cdiv data-type=\"horizontalRule\">\u003Chr>\u003C\u002Fdiv>\u003Ch2>Summary\u003C\u002Fh2>\u003Cp>The postponement of the EU's high-risk rules did not postpone the transparency duties, and it did not make customers' questions go away. If you take one thing from this article, make a one-page table showing which AI functions your organization's systems have, who owns them, and whether end users can see it is AI. That table works for answering customer questionnaires, for sending to legal counsel, and for handing to the team that takes over the system.\u003C\u002Fp>\u003Cp>If you would like to talk through the details of a project, you can reach us at 088-983-9386 or contact@superdev.tech. Our office is in Bang Kapi, Bangkok. For organizations still drafting a scope of work, we are glad to arrange a conversation to understand the problem first, without needing complete documents. And if we find that the problem is not yet at the point of needing a new system, we will say so plainly, because starting a project at the wrong time costs more than waiting another quarter.\u003C\u002Fp>","https:\u002F\u002Ftwsme-r2.tumwebsme.com\u002Fpbc_2128795511\u002Fhtvudqeeg8xgxw8\u002Fcover_cover_cu1yz8li39.webp","November 2, 2026","2026-11-02 04:26:36.211Z",117,"Enterprise","enterprise","eu-ai-act-omnibus-deferral-ai-feature-inventory","\u002Fblogs\u002Feu-ai-act-omnibus-deferral-ai-feature-inventory",12,false,0,"",[47,48,49,50,51],"EU AI Act","Digital Omnibus","AI feature inventory","AI transparency","vendor questionnaire"]