AI Act: Is Critical Energy & O&G Infrastructure Really Deferred to 2027?

Since 2 August 2026, the European Commission — through its AI Office and national authorities — has begun enforcing the AI Act, with new transparency rules applying from the same date. The Digital Omnibus simplification package, finalized on 29 June 2026, separately pushed back the heaviest obligations for 'certain high-risk use cases' under Annex III to 2 December 2027 — news widely read as blanket relief.

But the devil is in the enumeration. Public summaries of that deferral cite recruitment and worker management, credit scoring, access to essential services, education, and law enforcement — not, explicitly, critical infrastructure (Annex III, point 2: safety components in electricity, gas, heating, energy services). For high-risk-classified systems in O&G and energy — upstream blowout prevention, midstream SCADA leak detection, power-generation dispatch control — clarity is currently missing.

That grey zone carries a concrete price. AI Act penalties reach €15 million or 3% of global annual turnover, whichever is higher, for non-compliance on a high-risk system. Waiting for an official clarification therefore means accepting an asymmetric bet: the upside of waiting — deferred compliance spend — is capped; the downside is not.

Cardan-AI analysis: O&G and energy operators should map their safety-critical AI systems against Annex III point 2 now, formally document which assumption they are operating under, and start compliance work on the most critical use cases rather than wait for a clarification that may arrive after the exposure already has.