Europe has eased off. The "Digital Omnibus" regulation on AI, approved by the European Parliament on 16 June 2026 and by the Council on 29 June, was published in the Official Journal on 24 July. It postpones the heaviest obligations of the EU AI Act: for so-called high-risk AI systems, the deadline moves from 2 August 2026 to 2 December 2027.

Many leadership teams read the news as a relief. It is one, on one condition: not turning it into an excuse to wait. While the calendar slipped, AI adoption did not slow down. And in many companies, part of that adoption already happens outside France, in the nearshore team.

What moved, and what did not

The delay covers one specific block. The rest of the regulation already applies.

  • Prohibited practices: in force since 2 February 2025. Unchanged.
  • General-purpose AI models: rules applicable since 2 August 2025. Unchanged in substance.
  • Transparency (Article 50): applicable since 2 August 2026. Among other things, users must know when they are interacting with an AI.
  • Annex III high-risk systems (recruitment, access to credit, essential services, etc.): pushed back to 2 December 2027.
  • High-risk systems embedded in regulated products (Annex I): pushed back to 2 August 2028.

Another, quieter change: the "AI literacy" obligation for staff (Article 4) has been softened. Companies no longer have to ensure a sufficient level of literacy, but to take measures that support its development. The obligation remains. It simply becomes more realistic.

Why your team in Morocco is in scope

A common reflex is to assume European law stops at the border. For the AI Act, it does not. The regulation also covers providers and deployers established outside the EU whenever the output of the system is used in the EU.

In practice, if your team in Casablanca or Rabat screens applications for your French hires with an AI tool, or answers your customers through a chatbot, this concerns you. Where the team sits does not change the nature of the use.

The functions most often entrusted to a nearshore team are precisely those where AI is arriving fastest:

  • Customer service: chatbots, suggested replies, conversation analytics.
  • Recruitment and HR: CV pre-screening, job ad drafting, candidate sorting.
  • Finance and back office: invoice reading, reconciliations, anomaly detection.
  • Software development: coding assistants, test generation.

The first two are the most sensitive. Recruitment is on the list of high-risk uses. Customer service falls under the transparency rules, which already apply.

The real question: who knows what is running?

The main risk is not legal. It is operational. In most organisations, nobody has a full picture of the AI tools the remote team is using.

This is not bad faith. A high-performing team wants to move faster, and the tools are within reach. A local manager adopts an assistant to save two hours a day. An agent uses a browser extension to rephrase replies. None of this appears in the contract.

The day you need to document these uses, the hard part will be finding them. That is why the delay is an opportunity: it gives you time to do the work calmly, rather than in a rush at the end of 2027.

What to do during the reprieve

1. Take inventory, with the team

List the AI tools actually in use, by whom, for what, and on which data. Do it with the local manager, not for them. A list drawn up from Paris will be incomplete. Ask without looking for someone to blame: the goal is visibility, not sanctions.

2. Rank uses by stakes

Three levels are enough to start:

  • Prohibited uses: stop immediately if there are any.
  • Sensitive uses: recruitment, decisions that affect an individual, direct contact with your customers.
  • Everyday uses: help with writing, code, internal research.

Sensitive uses deserve a named owner and a written rule. Everyday uses mostly need a simple policy.

3. Write the rules into the contract

Whether your team is a subsidiary or a vendor, the contract should state who may introduce a new AI tool, who approves it, and how you are informed. Add a disclosure clause on the tools used and the data that flows through them. This connects with what you should already have handled for GDPR: the two topics are best prepared together.

4. Train, without waiting to be required

The AI literacy obligation was softened, not removed. A short, practical training for the nearshore team costs little: what the tool does well, where it gets things wrong, what you never hand over to it. It is also a retention lever. Skilled people stay where they keep learning.

5. Keep a human who signs off

For every sensitive use, define who reviews and who decides. AI-assisted candidate screening must be validated by an identified person. An automatically generated customer reply must be something an agent can take over. This is the principle the AI Act will impose on high-risk systems. You may as well put it in place now, on a small scope.

The delay rewards those who use it

The European calendar has slipped by sixteen months for Annex III systems. That time will not benefit everyone equally. Companies that wait for December 2027 will discover their AI uses in a hurry. Those that start now will reach the deadline with an inventory, clear rules and a trained team.

For a nearshore team, there is even an advantage in moving early. A team that can explain what it does with AI, and how it keeps it under control, earns trust. That is exactly what allows you to hand it more important work later on.

Do you have a team in Morocco, or are you building one, and want to frame its use of AI before it gets away from you? Write to us: we can start with the inventory.

This article offers an operational perspective and does not constitute legal advice.