The EU AI Act is law, and the July 2026 Digital Omnibus pushed its high-risk deadlines to 2027 and 2028. The delay is the risk: the inventory, vendor terms, and technical files it requires take longer to build than the time it buys.