ARTICLE
The EU AI Act's high-risk deadline moved. The transparency rules did not.
The 2 August 2026 date a lot of teams were building towards was deferred to December 2027 by the Digital Omnibus. But Article 50 transparency did start applying on 2 August, and it catches ordinary AI products, not just high-risk ones.
If you build an AI product with European users, 2 August 2026 was on your calendar. It was the date the high-risk obligations under the EU AI Act became applicable, and a lot of teams had been treating it as the deadline that mattered.
It moved. And a different set of obligations that were not moved arrived on exactly that date instead, which is a worse outcome for anyone who read the headline and stopped there.
What changed
The Digital Omnibus on AI was formally adopted on 8 July 2026, published in the Official Journal, and entered into force on 27 July 2026 as Regulation (EU) 2026/1744. Among other things, it deferred the application dates for high-risk AI systems.
The new dates:
- 2 December 2027 for stand-alone high-risk AI systems, the Annex III category. Previously 2 August 2026.
- 2 August 2028 for high-risk AI embedded in regulated products covered by Annex I.
The stated reason is to allow more time for implementation against clear standards, which is a fair description of the underlying problem. A good deal of the technical standardisation that providers were expected to conform to was not finished, and conformity assessment against an unfinished standard is not a thing anyone can actually do.
Annex III is broader than people assume. It covers, among other areas, employment uses: recruitment, candidate selection, performance evaluation, task allocation, worker monitoring, and decisions on promotion or termination. If you sell an HR tool with any scoring or ranking in it, that is you, and you have sixteen more months than you thought.
What did not change
Here is the part that gets lost.
Article 50 transparency obligations started applying on 2 August 2026. They were not deferred. As of that date, enforcement also begins for general-purpose AI model obligations, the prohibitions, transparency, and AI literacy requirements.
Article 50 is not about high-risk systems. It is about disclosure, and it catches ordinary products:
- An AI system that interacts with people has to make clear that it is a machine. That is your support chatbot, your onboarding assistant, your in-app helper.
- Synthetic audio, image, video and text has to be marked as artificially generated, in a machine-readable format.
The second one is the one I would look at first, because it is engineering work with a real lead time and it does not resemble a compliance checklist. Machine-readable marking means metadata or watermarking that survives your pipeline: your storage, your CDN, your image resizing, your video transcoding, your social export. Most media pipelines strip metadata somewhere, usually in a resize or re-encode step that nobody has looked at in two years.
If you generate media in your product, that is a real task. It is not something you write a policy about the week before an audit.
The timeline as it now stands
Consolidating the published implementation timeline:
| Date | What applies |
|---|---|
| 1 August 2024 | Entry into force |
| 2 February 2025 | General provisions, definitions, AI literacy, and the prohibitions |
| 2 August 2025 | General-purpose AI model obligations, governance in place |
| 2 August 2026 | Article 50 transparency rules apply. Enforcement begins for GPAI, prohibitions, transparency and AI literacy |
| 2 December 2026 | New prohibitions on non-consensual intimate imagery and CSAM generation. Transitional compliance deadline for synthetic content providers already on the market |
| 2 December 2027 | Annex III high-risk system rules apply |
| 2 August 2028 | High-risk AI embedded in Annex I regulated products |
The 2 December 2026 line is worth flagging separately. The Omnibus added a prohibition covering the generation of non-consensual sexual and intimate content and child sexual abuse material. If you ship any kind of image or video generation, that is a hard prohibition on a near date, and the transitional deadline for synthetic content providers already on the market lands at the same time.
Who this actually affects
The territorial scope is wider than "European companies", and this is the part founders outside Europe most often get wrong. The Act reaches providers placing systems on the EU market, deployers established in the EU or with users there, and providers and deployers in third countries where the output of the system is used in the EU.
Building from Riyadh, Dammam or Dubai does not put you outside it. If European users touch your product, or your output is used in Europe, you are in scope. I have watched more than one team discover this during a procurement questionnaire rather than during design, which is an expensive time to find out. It is the same category of mistake as discovering an integration constraint late, which I wrote about in why enterprise integrations are harder than the API documentation suggests.
What I would actually do
Given a deferral on one axis and a live obligation on another, the sensible response is not to relax and it is not to panic. It is to re-sequence.
Do now, because it is already in application:
- Audit every surface where a user talks to a model. Each one needs to make clear it is a machine. Check the ones you forgot: the email autoresponder, the voice line, the widget on the marketing site that someone shipped without telling you.
- Trace your generated-media pipeline end to end. Generate an asset, follow it through every transform to the point where a user downloads it, and check whether the marking survives. Assume it does not until you have watched it arrive intact.
- Check your AI literacy position. The obligation has been in application since February 2025 and is now in the enforcement window. For most companies this is training and documentation for the people deploying the system, not a product change.
Use the extra sixteen months on, rather than defer:
- Work out honestly whether you are Annex III. Do it now while there is no deadline pressure, because the answer determines the size of everything else. Employment, credit, education and essential services uses are the ones that catch people who did not think of themselves as high-risk.
- Build the record-keeping and logging you would need. This is the part with the longest lead time and it is the part that cannot be retrofitted convincingly. Technical documentation, data governance, post-market monitoring and incident reporting all depend on having recorded the right things from the start. A logging design added in month fourteen produces fourteen months of gaps.
That last point is the one I would emphasise to anyone who reads the deferral as breathing room. Observability is the long pole. It was the long pole for production agents for reasons that had nothing to do with regulation, and the regulatory version wants the same thing: a durable record of what the system did and why, kept from the beginning rather than reconstructed.
The uncomfortable read
I think the deferral is defensible on the merits. Asking providers to demonstrate conformity against standards that were not finished was not a real requirement, and the honest options were to move the date or to enforce something unenforceable.
But a deferral is not a reprieve, and the risk is entirely in how it gets heard. The teams that were already building the documentation, the logging and the oversight will use the time and arrive in December 2027 in good shape. The teams that were behind will read "deferred" as "not yet" and be in exactly the same position sixteen months from now, except with less sympathy available.
And in the meantime, the obligations that did land on 2 August are the ones that touch the most products. Not the specialised high-risk systems with dedicated compliance owners. The ordinary chatbot, the ordinary generated image, in ordinary products built by teams who read that the deadline moved and closed the tab.