---
title: "The AI Act's Delay Has a Catch: What Still Applies from 2 August 2026"
description: "The Digital Omnibus postpones high-risk obligations to 2027, but transparency duties and penalties apply from 2 August 2026: an updated map of what to do."
url: https://csidia.com/en/notes/ai-act-cosa-vale-dal-2-agosto-2026/
lang: en
date: 2026-07-03
label: "Regulation"
publisher: CSIDIA S.r.l. (https://csidia.com/)
italiano: https://csidia.com/note-operative/ai-act-cosa-vale-dal-2-agosto-2026/
---

# The AI Act's Delay Has a Catch: What Still Applies from 2 August 2026

> **Update (29 July 2026)** — This note is from 3 July, when the Omnibus had been approved but not yet published. It has since become **Regulation (EU) 2026/1744 of 8 July 2026**, published in the Official Journal on 24 July and **in force from the 27th**. The dates below hold, but the full picture — Article 113 in full, the two new prohibitions under Article 5 from 2 December 2026, and the Article 111(4) transitional rule for marking — sits in the [AI Act deadlines guide](https://csidia.com/en/guides/ai-act-deadlines/), which we keep current.

In June the European Union rewrote the AI Act's timetable: Parliament approved the simplification package (the so-called Digital Omnibus) on 16 June, and the Council gave its final green light on the 29th. Many companies read the headlines — “the AI Act has been postponed” — and filed the matter away. That is the most costly mistake to make this summer, because **not everything has been postponed**. Here is the map, updated to today.

## What has been postponed

The postponement concerns the **obligations on high-risk systems**, those that were due to take effect on 2 August 2026:

- for *standalone* high-risk systems (Annex III: personnel selection, credit, education, critical infrastructure, justice…) the new date is **2 December 2027**;
- for systems embedded in products already regulated by sector-specific rules (Annex I: medical devices, machinery, automotive…) the date moves to **2 August 2028**.

That's eighteen months of breathing room for anyone developing or adopting systems in those categories. But mind the flip side: the postponement does not cancel the obligations, it merely shifts them — and banks, public administrations and large procuring bodies are already writing AI Act requirements into their tender specifications *now*, because no one wants to buy a system in 2026 only to rebuild it in 2027.

## What still takes effect on 2 August 2026

Two things, both operational:

1. **Transparency obligations** (Article 50): anyone interacting with an AI system must be told; content generated or manipulated by AI (including deepfakes) must be labelled; chatbots must declare themselves as such. This affects virtually every company that exposes AI to customers or citizens.
2. The **penalty framework** becomes fully applicable: national authorities can bring enforcement action for breaches of the rules already in force.

It is also worth remembering what has **already been law since February 2025**, because penalties there are already possible today: the bans on unacceptable practices (manipulation, social scoring, emotion recognition in the workplace) and the **AI literacy** obligation under Article 4. On that one the Omnibus intervened from 27 July 2026: it is no longer about ensuring a sufficient level, but about taking measures that support its development, and the text specifies that no particular level has to be guaranteed for anyone. It remains the most widely ignored obligation in Italy, and it remains the evidence that is missing when it matters: [what changes in practice](https://csidia.com/en/notes/policy-ai-aziendale-obbligo-di-legge).

## What to do now, in order

1. **Take stock of your AI systems** — including those embedded in third-party software: many organisations do not realise they are using high-risk AI because it is buried inside their HR management software.
2. **Close out the transparency requirements by 2 August**: labels on generated content, chatbot self-declaration, updated notices. This is weeks of work, not months.
3. **Document the training** provided to staff on the use of AI: registers, materials, dates. In an inspection, this is the first thing you will be asked for.
4. **Use the time gained on high-risk systems to do things properly**: data inventory, governance, human oversight of critical decisions. These are the same requirements that make an AI system *useful*, not merely compliant — [it is the approach we have always taken](https://csidia.com/en/approach).

The European regulatory picture needs to be read as a whole: anyone who also falls within the scope of NIS2 faces [the same groundwork on data and processes](https://csidia.com/en/notes/nis2-aziende-settori-critici) — doing it once, for both sets of rules, is the smart move.

*Not sure whether your systems fall within high-risk scope, or what you need to do by August? [Half an hour with one of our experts](https://csidia.com/en/contact) is enough for an initial map.*

## Sources

- [Regulation (EU) 2024/1689 (AI Act) — official text (EUR-Lex)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)
- [European Commission — regulatory framework on AI](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai)
- [Gibson Dunn — analysis of the Digital Omnibus agreement](https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/)

Note by CSIDIA S.r.l. (Vignola, MO, Italy): https://csidia.com/en/notes/ai-act-cosa-vale-dal-2-agosto-2026/ · Who we are and what we do: https://csidia.com/en/at-a-glance/ · engagement@csidia.com