AI Act: What Applies Since August 2, 2026 and What Was Delayed

Since August 2, 2026, the transparency obligations of Article 50 of the AI Act (Regulation (EU) 2024/1689) apply: chatbots, deepfakes, AI-generated content and emotion recognition systems must be disclosed. High-risk obligations, however, did not start on that date: they were delayed to December 2, 2027 (Annex III) and August 2, 2028 (Annex I). Prohibited practices, AI literacy, GPAI rules and the penalty regime remain fully applicable.

This delay results from the Digital Omnibus on AI, adopted as Regulation (EU) 2026/1744, published in the Official Journal on July 24, 2026 and in force since July 27, 2026. It is no longer a proposal — it is binding law. This article sets out, as of October 1, 2026, what the law requires today and what remains to be prepared.

What Already Applied Before August 2, 2026

To understand what changed in August, it helps to recall what already applied. The AI Act did not enter into force in one block — it has been rolling out progressively since August 2024:

• February 2, 2025: prohibition of unacceptable-risk practices (Article 5) — social scoring, subliminal manipulation, certain real-time biometric uses. These rules are already in force and enforceable.
• February 2, 2025: AI literacy obligation (Article 4) — providers and deployers must take measures for the AI literacy of their staff (wording softened by the AI Omnibus).
• August 2, 2025: obligations for general-purpose AI models (GPAI, Articles 51–56) — applicable to providers of models such as LLMs. The penalty regime (Article 99) has applied since the same date.

This phased calendar is deliberate: it gives organisations time to adapt to the most complex obligations. The AI Omnibus stretched it further for high-risk systems, without touching the transparency deadline.

August 2, 2026: What Applies and What Was Delayed

High-risk AI systems (Annex III): delayed to December 2, 2027

This was meant to be the heart of August 2, 2026, but the AI Omnibus delayed these obligations to December 2, 2027. Annex III lists eight domains in which AI systems are automatically classified as high-risk:

• Biometrics: remote biometric identification, biometric categorisation, emotion recognition
• Critical infrastructure: management of electricity, water, gas and transport networks
• Education and training: systems determining access to institutions, student assessment
• Employment and HR: recruitment tools, performance management, candidate evaluation
• Essential services: credit scoring, insurance, social benefit assessment
• Law enforcement: criminal profiling, evidence reliability assessment, recidivism risk evaluation
• Justice and democratic processes: judicial decision support
• Border management: risk assessment of individuals at borders, document verification

If your organisation develops or uses an AI system in any of these domains, the Chapter III obligations of the AI Act will apply to you from December 2, 2027 — whether the tool is developed in-house or sourced from a SaaS provider. The delay gives you time, not an exemption.

Transparency obligations for everyone (Article 50): applicable since August 2, 2026

Article 50, which the AI Omnibus did not delay, does not only concern high-risk systems — since August 2, 2026 it applies to all AI systems that interact with humans or generate synthetic content:

• Chatbots and conversational agents (Art. 50§1): any system interacting with a human must clearly inform them they are talking to an AI. Exceptions: professional contexts where this is obvious, or legitimate fictional character use cases.
• Deepfakes and manipulated content (Art. 50§4): audio or visual content manipulated to resemble real people must be clearly identified as such.
• Emotion recognition (Art. 50§3): any person subject to an emotion recognition system must be informed.

Important note: Article 50§2 (machine-readable marking of AI-generated content) has applied since August 2, 2026 to systems placed on the market from that date; systems already on the market before August 2, 2026 have a grace period until December 2, 2026. The Commission published its final guidelines on Article 50 on July 20, 2026, and a voluntary code of practice on marking and labelling AI-generated content on June 10, 2026.

What This Means for Providers

If you develop and commercialise a high-risk AI system, you are a provider under Article 3. Your obligations, applicable from December 2, 2027 (Annex III) or August 2, 2028 (Annex I), are substantial:

• Technical documentation (Art. 11 + Annex IV): a complete file covering system description, architecture, data governance, risk management, performance metrics, instructions for use, post-market monitoring, quality management and declaration of conformity.
• Risk management system (Art. 9): a continuous process of identifying, evaluating and mitigating risks throughout the system's lifecycle.
• Data governance (Art. 10): training datasets must be documented, representative and subject to bias analysis.
• Human oversight (Art. 14): the system must be designed to allow a human to monitor, understand and intervene in its operation.
• CE marking + declaration of conformity (Art. 47–49): formal attestation of compliance before placing on the market.
• EU database registration (Art. 71): mandatory registration before deployment for most high-risk systems.

Preparing this documentation is estimated to take between 40 and 80 hours for a complex system. AiActo structures this process section by section with a contextual AI assistant, significantly reducing that preparation time.

What This Means for Deployers

If you use a high-risk AI system developed by a third party, you are a deployer under Article 3. Your obligations, subject to the same deadlines, are distinct but equally real:

• Effective human oversight (Art. 26§2): you must put in place procedures allowing a qualified person to monitor the system, interpret its outputs and intervene or stop it if necessary.
• Log retention (Art. 26§6): automatically generated logs must be retained for at least six months.
• Informing affected individuals (Art. 26§6 + Art. 50): any person subject to a decision influenced by a high-risk system must be informed.
• Use in line with provider instructions (Art. 26§1): you cannot repurpose the system beyond its intended use without assuming provider-level responsibility.
• Fundamental rights impact assessment — FRIA (Art. 27): mandatory for public bodies and certain essential services operators before deployment.

The Applicable Penalties

The AI Act establishes a progressive and dissuasive penalty regime (Article 99), applicable since August 2, 2025:

• Up to €35 million or 7% of global turnover for prohibited practices (Article 5) — already enforceable since February 2025
• Up to €15 million or 3% of global turnover for breaches of transparency obligations (Article 50), enforceable since August 2, 2026, and, from December 2, 2027, of high-risk system obligations
• Up to €7.5 million or 1% of global turnover for providing inaccurate information to authorities

For SMEs, the regulation requires authorities to account for organisational size and available resources. But there is no blanket exemption — an SME may benefit from proportionate enforcement, not from a waiver.

What to Do Now

1. Classify your AI systems — identify which fall under Annex III, which are subject to Article 50, and which are minimal risk. This is the prerequisite for every other step.
2. Determine your role — provider, deployer, or both? Your role determines the entirety of your obligations.
3. Audit your SaaS vendors — ask your AI providers whether they are compliant, whether they have technical documentation and whether they are registered in the EU database.
4. Build your documentation file — even as a deployer, you must be able to demonstrate your human oversight processes and control procedures.
5. Inform your users — this is the priority: Article 50 transparency obligations have applied since August 2, 2026. Update your legal notices, interfaces and communications, and prepare machine-readable marking before December 2, 2026 if your system was already on the market.

The free AiActo diagnostic lets you complete steps 1 and 2 in under 3 minutes — and get a personalised summary of your obligations before the next deadlines.

Frequently Asked Questions

Did the Digital Omnibus delay the August 2, 2026 obligations?

Partly. The AI Omnibus, adopted as Regulation (EU) 2026/1744 and in force since July 27, 2026, delayed obligations for Annex III high-risk systems to December 2, 2027 and those for Annex I products to August 2, 2028. It did not delay Article 50: transparency obligations have applied since August 2, 2026, with a grace period until December 2, 2026 for machine-readable marking (Art. 50§2) of systems already on the market before that date.

My AI system was already deployed before August 2, 2026 — am I exempt?

Not from transparency: Article 50 applies to your system; only machine-readable marking (Art. 50§2) benefits from a grace period until December 2, 2026 for systems placed on the market before August 2, 2026. For high-risk obligations, Article 111 provides a transitional regime for systems already on the market, provided they undergo no significant modification. If your system evolves, the new obligations apply. Check this regime in the text as amended by the AI Omnibus.

How do I know if my system is high-risk?

Classification rests on two criteria: the domain of application (Annex III) and the nature of the system. An AI-powered CV screening tool is high-risk by definition. A marketing text generator generally is not. When in doubt, the AiActo diagnostic applies Annex III logic to your specific case in a few questions.

Do obligations apply to AI tools used only internally?

Yes, from December 2, 2027, provided the system falls under Annex III and the individuals affected by its decisions are people — employees, candidates, clients. An AI-powered employee performance management tool falls within the AI Act's scope even if it is never commercialised.

What are the next deadlines after August 2, 2026?

December 2, 2026: end of the grace period for machine-readable marking (Art. 50§2) of systems placed on the market before August 2, 2026. December 2, 2027: Annex III high-risk systems. August 2, 2028: high-risk systems embedded in products regulated by other EU legislation (Annex I — medical devices, machinery, radio equipment). The latter benefit from additional time because their compliance involves more complex sectoral certification procedures.

August 2, 2026 was not an abstract deadline: transparency is now enforceable, and the high-risk delay is set out in a regulation published in the Official Journal of the European Union. Organisations that structure their compliance now, without waiting for December 2027, will be better protected, better documented, and better positioned in a market where trust in AI is becoming a competitive advantage. Check the complete AI Act timeline to visualise all steps in the regulatory calendar.