Start a trial

Operational notes Regulation

The AI Act's Delay Has a Catch: What Still Applies from 2 August 2026

4 min read

Hemicycle of the European Parliament
Brussels writes the calendar; the work still falls to those who operate.

Update (29 July 2026) — This note is from 3 July, when the Omnibus had been approved but not yet published. It has since become Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July and in force from the 27th. The dates below hold, but the full picture — Article 113 in full, the two new prohibitions under Article 5 from 2 December 2026, and the Article 111(4) transitional rule for marking — sits in the AI Act deadlines guide, which we keep current.

In June the European Union rewrote the AI Act’s timetable: Parliament approved the simplification package (the so-called Digital Omnibus) on 16 June, and the Council gave its final green light on the 29th. Many companies read the headlines — “the AI Act has been postponed” — and filed the matter away. That is the most costly mistake to make this summer, because not everything has been postponed. Here is the map, updated to today.

What has been postponed

The postponement concerns the obligations on high-risk systems, those that were due to take effect on 2 August 2026:

  • for standalone high-risk systems (Annex III: personnel selection, credit, education, critical infrastructure, justice…) the new date is 2 December 2027;
  • for systems embedded in products already regulated by sector-specific rules (Annex I: medical devices, machinery, automotive…) the date moves to 2 August 2028.

That’s eighteen months of breathing room for anyone developing or adopting systems in those categories. But mind the flip side: the postponement does not cancel the obligations, it merely shifts them — and banks, public administrations and large procuring bodies are already writing AI Act requirements into their tender specifications now, because no one wants to buy a system in 2026 only to rebuild it in 2027.

What still takes effect on 2 August 2026

Two things, both operational:

  1. Transparency obligations (Article 50): anyone interacting with an AI system must be told; content generated or manipulated by AI (including deepfakes) must be labelled; chatbots must declare themselves as such. This affects virtually every company that exposes AI to customers or citizens.
  2. The penalty framework becomes fully applicable: national authorities can bring enforcement action for breaches of the rules already in force.

It is also worth remembering what has already been law since February 2025, because penalties there are already possible today: the bans on unacceptable practices (manipulation, social scoring, emotion recognition in the workplace) and the AI literacy obligation under Article 4. On that one the Omnibus intervened from 27 July 2026: it is no longer about ensuring a sufficient level, but about taking measures that support its development, and the text specifies that no particular level has to be guaranteed for anyone. It remains the most widely ignored obligation in Italy, and it remains the evidence that is missing when it matters: what changes in practice.

What to do now, in order

  1. Take stock of your AI systems — including those embedded in third-party software: many organisations do not realise they are using high-risk AI because it is buried inside their HR management software.
  2. Close out the transparency requirements by 2 August: labels on generated content, chatbot self-declaration, updated notices. This is weeks of work, not months.
  3. Document the training provided to staff on the use of AI: registers, materials, dates. In an inspection, this is the first thing you will be asked for.
  4. Use the time gained on high-risk systems to do things properly: data inventory, governance, human oversight of critical decisions. These are the same requirements that make an AI system useful, not merely compliant — it is the approach we have always taken.

The European regulatory picture needs to be read as a whole: anyone who also falls within the scope of NIS2 faces the same groundwork on data and processes — doing it once, for both sets of rules, is the smart move.

Not sure whether your systems fall within high-risk scope, or what you need to do by August? Half an hour with one of our experts is enough for an initial map.

Sources