Did the EU delay the entire AI Act?

No. Regulation (EU) 2026/1744 delayed the high-risk rules for providers and deployers of high-risk AI systems. Article 50 transparency rules (chatbot disclosure, deepfake labeling, AI-generated content marking) still apply from August 2, 2026. GPAI provider obligations have applied since August 2, 2025 and remain in force.

Does the AI Act delay apply to US companies?

The delay and the remaining obligations both apply equally to non-EU companies if they deploy AI systems that affect EU users or employees. A US company running an AI chatbot for EU customers must still comply with Article 50 transparency requirements from August 2, 2026.

What is Article 50 of the EU AI Act?

Article 50 covers transparency for certain AI systems. Chatbots must disclose they are AI unless obvious, generative AI outputs must be machine-readably marked, emotion recognition and biometric categorisation must be disclosed to the people exposed, and deepfakes must be labeled. These rules apply from August 2, 2026, regardless of the high-risk delay.

Is the December 2027 high-risk deadline confirmed?

Yes. The EU Parliament voted 423-57 on June 16, 2026, and the Council formally adopted on June 29, 2026. Standalone high-risk AI systems (Annex III) must comply by December 2, 2027. High-risk AI embedded in regulated products (Annex I) has until August 2, 2028. Both dates are now binding law.

EU AI Act August 2026: What's Delayed and What Still Applies

Image: Unsplash.

EU AI Act August 2026: What's delayed and what still applies

On May 7, 2026, Parliament and Council negotiators reached a provisional agreement to delay high-risk AI system compliance requirements. Many compliance teams drew the wrong conclusion: that nothing under the AI Act applies until 2027 or 2028. That reading is wrong. Three significant sets of obligations kept their dates.

Update (October 19, 2026): The Digital Omnibus on AI is in force. The Official Journal published Regulation (EU) 2026/1744 on July 24, 2026, and it entered into force on July 27. December 2, 2027 (Annex III) and August 2, 2028 (Annex I) are binding law. The European Parliament voted 423 to 57 on June 16, 2026; the Council gave final approval on June 29, 2026. The Omnibus also gave one transition for Article 50: providers of generative systems placed on the market before August 2, 2026 have until December 2, 2026 to meet the Article 50(2) machine-readable marking duty. Everything else in Article 50, including chatbot disclosure and deepfake labeling, applies from August 2, 2026.

What the Omnibus actually changed

The Omnibus delayed the high-risk rules in Chapter III, Sections 1 to 3 of the AI Act, which bind both providers and deployers. Under the original text, providers of Annex III systems had to complete conformity assessments, technical documentation and post-market monitoring by August 2, 2026, and deployers had to put human oversight and logging in place. All of that now applies from December 2, 2027, a 16-month extension.

What the Omnibus did not delay: Article 50 transparency requirements (applying August 2, 2026, apart from the marking transition above), GPAI model provider obligations (in force since August 2, 2025), and the prohibited AI practices (in force since February 2, 2025). It did add two new prohibitions, which apply from December 2, 2026.

The confusion is understandable, and it showed up within weeks. In r/AiForBusinessesUK, u/Existing_Scallion_66 wrote: "A lot of organisations saw the Omnibus announcement (high-risk AI deadline pushed to December 2027) and assumed the pressure was off for a while." The delay applies to one category of obligations. The Omnibus (the Digital Omnibus on AI, formally adopted June 29, 2026) amended the EU AI Act directly, and the final text introduced two distinct new deadlines: December 2, 2027 for standalone Annex III systems, and August 2, 2028 for high-risk AI embedded in products covered by existing EU harmonization law.

https://www.reddit.com/r/AiForBusinessesUK/comments/1tkgghd/the_eu_ai_act_delay_is_real_but_it_doesnt_cover/

For practical compliance planning: ignore the headlines and read the specific provisions. The August 2, 2026 date still matters for most businesses that deploy AI.

What still applies on August 2, 2026

The curved facade of a large office building with EU flags along its base under a cloudy sky

Image: Pexels, used under the Pexels License.

The European Commission's own enforcement page draws the same line: what became enforceable on August 2, 2026, and what waits.

European Commission page on AI Act enforcement: enforcement powers of the AI Office and national authorities apply from 2 August 2026, covering prohibited AI practices, obligations for providers of GPAI models and transparency requirements for certain AI systems

Screenshot: "The enforcement framework of the AI Act", European Commission, Shaping Europe's digital future, October 2026.

Who enforces it: the Commission's AI Office supervises GPAI model providers (Article 88) and, since the Omnibus, most AI systems a provider builds on its own GPAI model plus AI in very large online platforms (Article 75(1)); national market surveillance authorities supervise other AI systems. Under Article 99, fines reach €35 million or 7% of worldwide annual turnover for a prohibited practice and €15 million or 3% for breaching Article 50 or other operator obligations, whichever is higher (for SMEs and start-ups, whichever is lower), and Article 101 lets the Commission fine GPAI providers up to €15 million or 3% from August 2, 2026.

Article 50: Transparency obligations (not delayed)

Article 50 is the provision most businesses need to act on before August 2. It applies to any company deploying an AI system that directly interacts with people, and it covers four specific situations.

First, chatbots and conversational AI must inform users they are interacting with an AI system. The requirement applies unless it is obvious from the context. "Obvious from context" is not a broad exception; a customer service chat interface that looks like a human agent does not qualify. A system clearly labeled "AI Assistant" in the interface likely does. The disclosure must happen at the beginning of the interaction, not buried in a terms of service.

Second, deployers of AI systems that generate deepfakes (synthetic video, audio, or images that look like real people, places or events) must disclose that the content is AI-generated. Machine-readable marking is a separate duty on the provider under Article 50(2). For evidently artistic, creative, satirical or fictional work, Article 50(4) limits the duty to disclosing that generated content exists, in a way that doesn't spoil the work.

Third, deployers of emotion recognition and biometric categorisation systems must inform the people exposed to them (Article 50(3)). That isn't a licence to use emotion recognition at work: inferring the emotions of employees or students is banned outright under Article 5, except for medical or safety reasons.

Fourth, providers of generative AI must mark audio, image, video and text outputs in a machine-readable format so they can be detected as AI-generated (Article 50(2)). Deployers who publish AI-generated text to inform the public on matters of public interest must disclose it, unless it went through human review or editorial control and someone holds editorial responsibility (Article 50(4)). One open technical standard for machine-readable provenance is C2PA (Coalition for Content Provenance and Authenticity), which its makers call Content Credentials.

Text of Regulation (EU) 2026/1744 adding Article 111(4) to the AI Act: providers of generative AI systems placed on the market before 2 August 2026 must comply with Article 50(2) by 2 December 2026

Screenshot: Regulation (EU) 2026/1744, point (39)(b), the new Article 111(4). Source: EUR-Lex, Publications Office of the European Union.

Who this affects in practice: any business with an AI customer service chatbot, any tool generating marketing video or audio, any publisher distributing AI-generated images or video at scale, and anyone running emotion recognition or biometric categorisation outside the workplace and schools.

GPAI model providers (already in force)

The General Purpose AI Model (GPAI) provider requirements technically applied from August 2, 2025 and are already in effect. These apply to companies that develop and make available general-purpose AI models to downstream users, not to companies that simply deploy an API.

GPAI providers must have three things in place. First, technical documentation and transparency information that gives downstream deployers what they need to understand the model's capabilities and limitations. Second, a copyright compliance policy summarizing how training data was handled and what opt-out mechanisms are in place for rights holders. Third, a systemic risk assessment for GPAI models trained with more than 10^25 FLOPs, the threshold that identifies frontier-class models.

If your company uses a third-party AI API (OpenAI, Anthropic, Google, Mistral, and so on), your vendor bears the GPAI provider obligations, not you. What you should do is ask your vendor to confirm they are meeting GPAI requirements and keep that confirmation on file. Your vendor's GPAI compliance is part of your supply chain risk posture.

Prohibited practices (already in effect, two more coming)

All of the original prohibited practices have applied since February 2, 2025. The Omnibus adds two more from December 2, 2026: AI that generates realistic intimate or sexually explicit images, video or audio of an identifiable person without consent, and AI that generates child sexual abuse material. The full list covers:

Social scoring systems operated by public or private entities are prohibited. AI systems that manipulate people through subliminal or deceptive techniques, or that exploit vulnerabilities related to age, disability, or economic situation, are prohibited. The use of real-time remote biometric identification in publicly accessible spaces for law enforcement is prohibited, with narrow exceptions that need prior authorization. Untargeted scraping of facial images to build recognition databases is prohibited. Emotion inference in workplaces and educational institutions is prohibited, except for medical or safety reasons. Predictive policing based solely on profiling individuals without objective and verifiable facts linked to a specific crime is prohibited.

These prohibitions apply regardless of the Omnibus delay and apply to any organization whose AI systems affect EU residents, including non-EU companies.

What is delayed: confirmed deadlines

The table below covers major obligations from the original AI Act text now governed by the dates in Regulation (EU) 2026/1744.

Obligation	Original deadline	New confirmed deadline	Applies to
High-risk AI system conformity assessment (Annex III)	August 2, 2026	December 2, 2027	Standalone high-risk systems
High-risk AI embedded in products (Annex I)	August 2, 2027	August 2, 2028	AI in medical devices, machinery, vehicles, etc.
Technical documentation for high-risk systems	August 2, 2026	December 2, 2027	Standalone systems
Post-market monitoring (providers)	August 2, 2026	December 2, 2027	Standalone systems
Human oversight requirements (Article 26)	August 2, 2026	December 2, 2027	Standalone systems
Deployer logging requirements (Article 26)	August 2, 2026	December 2, 2027	Standalone systems
Fundamental rights impact assessments (Article 27)	August 2, 2026	December 2, 2027	Standalone systems

These dates are law. The EU Parliament voted June 16, 2026, the Council adopted the text June 29, 2026, and the regulation entered into force July 27, 2026. Teams managing high-risk AI compliance should plan against December 2, 2027 (standalone) or August 2, 2028 (embedded in regulated products) as fixed deadlines.

Who needs to act now on the August 2, 2026 obligations

If you run AI chatbots, virtual assistants, or any AI that talks to users:

Add a disclosure at the start of interactions. "This response is generated by an AI assistant" meets the requirement. Review any chatbot marketing copy that implies human interaction. Update your privacy notices if they do not already describe the AI systems you deploy. This is not a high-cost change; most chat platforms support custom system prompts or disclosure banners that can be deployed in days.

If you generate AI content for public distribution:

If you build the generator, implement C2PA or equivalent machine-readable marking on its outputs. If you only use AI tools, check that they mark outputs and add visible labels on deepfakes and synthetic media. The content pipeline review matters here. If your marketing team is using AI image tools and publishing to social media or press materials, you need a process that captures those outputs and ensures they carry disclosure before publication.

If you are a GPAI model provider:

Finalize technical documentation, publish your copyright compliance summary, and complete your systemic risk assessment if your model's training compute exceeds the 10^25 FLOP threshold. These are not small tasks for frontier model providers, but most smaller organizations fall below the frontier model threshold and only need the documentation and copyright policy.

If you are a US or UK company with EU customers:

The same requirements apply to you. The AI Act has explicit extraterritorial reach: if your AI system affects EU users or EU employees, you are in scope. The prohibition on real-time biometric identification, the Article 50 transparency rules, and the GPAI provider obligations do not have a geographic carve-out for non-EU companies.

If you were preparing for high-risk compliance and now it's delayed, should you stop?

No, and there are three concrete reasons.

The first is legal certainty. The delay has been law since July 27, 2026, so December 2, 2027 is a fixed target. Building compliance documentation now, while the pressure is lower, is cheaper than rebuilding it under time pressure in Q3 2027.

The second is overlap with other laws. UK AI regulation, Texas TRAIGA (effective January 1, 2026), and Colorado SB 26-189 (signed May 14, 2026; it repealed and reenacted SB 24-205 and applies to decisions from January 1, 2027) overlap with it on human oversight and documentation. Colorado's new law has no risk assessment duty: it asks for notices, an adverse-outcome explanation, human review and records. The compliance work is not wasted; it maps to multiple frameworks simultaneously.

The third is institutional readiness. Companies that have never documented their AI systems, mapped their risk levels, or implemented human review processes cannot do so quickly when a deadline arrives. The organizations that use the delay productively are the ones that will be able to demonstrate a compliance posture when the December 2027 date becomes enforceable.

What to do in the next 30 days

Start with an inventory. List every AI system your company uses or deploys that touches EU users, EU employees, or processes EU personal data. For each one, answer two questions: does it interact with people directly, and does it generate content for public distribution? Those two questions determine your Article 50 exposure.

For any chatbot or conversational AI you operate, write and deploy a disclosure. This should be done in the next two weeks, not the next thirty days. The lead time is minimal and the risk of not having it in place is real.

For AI-generated content pipelines, audit what is going out and whether it carries machine-readable marking. If not, add a labeling step now; Article 50 has applied since August 2, 2026.

For your vendor relationships, send a short questionnaire to your AI API providers asking for their Article 50 and GPAI compliance confirmation. File the responses. If a vendor cannot confirm compliance, that is a supply chain risk you need to document.

For high-risk AI compliance work that was already underway, do not dismantle it. Adjust your internal deadline to Q4 2027, but keep the documentation current and the process running. A team that already has logging and human oversight in place faces minimal incremental work when December 2027 arrives.

Correction (October 13, 2026): An earlier version described a December 2026 watermarking "grace period" for artistic and satirical content and said Article 50 has no exception for satire. The only Omnibus transition is for Article 50(2) marking by systems already on the market before August 2, 2026, and Article 50(4) does limit disclosure for evidently artistic or satirical work.

Correction (October 19, 2026): An earlier version said the Official Journal published the Omnibus on July 27, 2026 (it was published July 24 and entered into force July 27), that the remaining prohibited practices take effect August 2, 2026 (all applied from February 2, 2025, and two new bans apply from December 2, 2026), that the Omnibus did not touch the prohibited practices, and that Annex I products originally had until August 2, 2026 (it was August 2, 2027). It also said all AI content for public use needs machine-readable attribution; marking is a provider duty for all generative outputs, and deployer text disclosure covers public-interest text (consolidated AI Act). A later fix the same day: the Article 50 section said an HR platform using emotion inference only had to tell employees. Emotion recognition in the workplace is banned under Article 5(1)(f), except for medical or safety reasons; the Article 50(3) notice covers other uses.

Correction (October 16, 2026): Earlier versions described Colorado's law as SB 24-205 "as amended by" SB 26-189 with AI risk assessment requirements. SB 26-189 repealed and reenacted SB 24-205 before it took effect and has no risk or impact assessment duty (signed act).