What Actually Takes Effect on 2 August 2026
Policy Brief · Synthocracy Institute · 5 July 2026
On 2 August 2026 the EU AI Act’s transparency rules (Article 50) and its enforcement and penalty powers take effect on their original schedule. What does not take effect is the high-risk regime — the substantive obligations on AI systems that make consequential decisions about people — which the Digital Omnibus deferred to 2 December 2027. The one-line version: the rules about whether you are told an AI is involved arrive on time; the rules about whether an AI may co-decide your job, your loan, or your benefit are delayed by sixteen months.
The common headline — “the EU delayed the AI Act” — is half-true and misleading. Some obligations moved by more than a year. Others did not move at all, and are backed by fines from day one. Standing down your 2 August work on the strength of the headline is the most expensive mistake available this summer. This brief separates the two.
At a glance: what applies, what was deferred
| Obligation | Date | |
|---|---|---|
| Applies 2 Aug 2026 | Article 50 transparency — disclose AI interaction (chatbots), label AI-generated / deepfake content, disclose emotion-recognition and biometric-categorisation use | 2 Aug 2026 |
| Applies 2 Aug 2026 | Enforcement and penalty powers become live (AI Office / national authorities) | 2 Aug 2026 |
| Applies 2 Aug 2026 | GPAI (general-purpose AI model) obligations become enforceable (in force since Aug 2025) | 2 Aug 2026 |
| Grace period | Article 50(2) machine-readable marking (watermarking) — for generative systems already on the market before 2 Aug 2026 | 2 Dec 2026 |
| New prohibition | Article 5 ban on AI that generates non-consensual intimate imagery (NCII) and CSAM | 2 Dec 2026 |
| Deferred | Annex III high-risk obligations (stand-alone) — employment, credit, benefits, justice, migration, essential services, etc. | 2 Dec 2027 |
| Deferred | Annex I high-risk (AI embedded in regulated products: medical devices, machinery, toys) | 2 Aug 2028 |
Dates tied to the Digital Omnibus are settled politically but contingent on final publication — see “Legislative status” below.
What takes effect on 2 August 2026
Article 50 transparency — untouched. The Omnibus deliberately left these obligations in place. From 2 August 2026, providers and deployers must make clear when a person is interacting with an AI system, label AI-generated and manipulated (“deepfake”) content, and disclose when someone is subject to emotion-recognition or biometric-categorisation. The one carve-out: the machine-readable marking of generative output under Article 50(2) gets a short grace period to 2 December 2026, but only for systems already on the market before 2 August; anything launched from that date must mark output immediately.
Enforcement and fines — live. From 2 August 2026 the AI Office and national authorities gain full enforcement powers. The penalty ceilings are real: up to €35 million or 7% of worldwide annual turnover for the most serious breaches, with a dedicated tier for GPAI providers of up to €15 million or 3% of turnover. Supplying misleading information to authorities is itself finable. Whatever applies on this date applies with teeth.
GPAI obligations — enforceable. The general-purpose AI model rules have been in force since 2 August 2025; the Omnibus did not touch them. What changes on 2 August 2026 is that they become enforceable. Models placed on the market before August 2025 have until 2 August 2027 to reach full compliance.
AI literacy — softened, not removed. Article 4’s literacy duty was reworded from ensuring a sufficient level to promoting and encouraging it with proportionate measures; the hard penalty pressure is gone, but the duty remains.
What was deferred, and until when
The headline: Annex III high-risk obligations slip to 2 December 2027. These are the substantive duties on high-risk systems — risk management, data governance, technical documentation, record-keeping, human oversight, accuracy and robustness — together with the fundamental-rights impact assessment (Article 27), which moves with them. Sixteen additional months. The stated reason is that the harmonised standards and support tools needed to make these obligations operable were not ready in time.
Annex I (product-embedded) high-risk slips to 2 August 2028. AI acting as a safety component of products already regulated under EU sectoral law — medical devices, machinery, radio equipment, lifts, toys — gets an extra year, plus a mechanism to avoid double regulation where sectoral rules already impose equivalent requirements.
One genuinely new rule arrives 2 December 2026. The Omnibus adds an Article 5 prohibition on AI systems placed on the market to generate non-consensual intimate imagery or CSAM. This is not a deferral; it is a new ban, and if you ship any image or multimodal generation into the EU you need a documented safe-harbour position before that date.
Legislative status: settled, but confirm it is law
As of 5 July 2026 the deferral is politically settled but worth stating precisely. The European Parliament endorsed the text on 16 June 2026; the Council gave its final green light on 29 June 2026. Publication in the Official Journal is expected shortly, ahead of 2 August, with entry into force on the third day after publication. Until it is published, Regulation (EU) 2024/1689 in its original form remains the binding law — which means the original dates technically still apply until the Omnibus is in the Journal. The safe planning posture: treat the new dates as your baseline, but verify publication before relying on the deferral, and do not let a proposed date stall work that is due regardless.
The reading that matters: disclosure arrived, decision-accountability slipped
Look at what survived and what was deferred, side by side, and a pattern appears that the compliance calendars do not name.
What takes effect on time — Article 50 — governs the AI system’s visibility. It ensures you are told that you are talking to a chatbot, that a video is synthetic, that a system is reading your face. These are real protections, and they matter.
What was deferred — the Annex III regime — governs the AI system’s authority over decisions about you. And the Annex III list is, almost exactly, a list of the places where AI co-decides a person’s life: recruitment, task allocation, monitoring, promotion and termination; creditworthiness and credit scoring; access to public benefits and essential services; emergency dispatch; education and exam scoring; law enforcement; migration, asylum and border control; the administration of justice and democratic processes.
So the obligations that arrive on 2 August 2026 make the AI legible — you know it is there. The obligations that will not arrive until December 2027 are the ones that would make its decisions accountable: a documented human at the point of decision (Article 14), an assessment of the impact on fundamental rights before deployment (Article 27), a risk-management discipline around the decision itself. For sixteen months, across exactly the domains where an AI is most likely to be co-deciding something that matters, the specific accountability layer is optional — while the systems themselves keep being deployed.
Two honest qualifications keep this from becoming alarmism. First, the gap is not lawlessness: AI-caused harm in 2026 remains subject to the GDPR, product-liability law, anti-discrimination statutes, and sectoral regulators, and some member states (Italy, for one) are separately mandating human oversight for employment decisions. Second, deferral is not repeal — the architecture is intact and the obligations are coming. But the sequencing is the point. The rules that tell you an AI is present are here; the rules that hold its decisions to account arrive after most of those decisions are already being made. That is not a criticism of the deferral, which the ecosystem needed. It is a description of the window it opens — and the window is precisely where the questions this institute studies live.
What to do before 2 August 2026
For deployers and providers, five concrete items:
- Confirm Article 50 now. Every chatbot discloses; every generative feature labels its output; every emotion-recognition or biometric-categorisation use is disclosed. This is due, and fined.
- Stand up watermarking for 2 December 2026. Machine-readable marking of generative output; that is engineering time, not paperwork.
- Do not stand down the high-risk programme — re-baseline it to December 2027. The hard part (finding and classifying every AI system you run) does not get easier with time. Use the runway to do it properly.
- Document for enforcement. With fining power live from 2 August, keep evidence of your disclosure, marking, and decision-making. Misleading authorities is itself an offence.
- Decide your Article 5 position on NCII/CSAM by 2 December 2026. In scope, safe-harbour by design, or not offered in the EU.
FAQ
What actually applies under the EU AI Act in August 2026? On 2 August 2026, the Article 50 transparency obligations (disclosing AI interaction, labelling AI-generated and deepfake content, disclosing emotion-recognition and biometric-categorisation), the enforcement and penalty powers, and enforceable GPAI-model obligations all take effect. Machine-readable marking of generative output has a grace period to 2 December 2026 for systems already on the market.
Was the EU AI Act delayed? Partly. The Digital Omnibus deferred the high-risk regime — Annex III stand-alone obligations to 2 December 2027 and Annex I product-embedded obligations to 2 August 2028 — but it did not delay the Article 50 transparency obligations or the enforcement powers, which apply from 2 August 2026 as originally scheduled.
When do the high-risk AI obligations apply? Stand-alone high-risk systems (Annex III) must comply from 2 December 2027; high-risk AI embedded in regulated products (Annex I) from 2 August 2028. The Article 27 fundamental-rights impact assessment moves with the Annex III date.
Does Article 50 transparency still apply on 2 August 2026? Yes. Article 50 was not deferred. The one nuance is Article 50(2) machine-readable marking, which has a grace period to 2 December 2026 for generative systems already on the market before 2 August 2026; new systems must comply immediately.
Which AI systems are high-risk under Annex III? Broadly: biometrics; critical infrastructure; education and exam scoring; employment and worker management; access to essential public and private services (including creditworthiness and benefits); law enforcement; migration, asylum and border control; and the administration of justice and democratic processes. These are the categories whose obligations were deferred to December 2027.
Sources
- Council of the EU — final green light on the AI Act simplification package, 29 June 2026; European Parliament endorsement, 16 June 2026.
- Digital Omnibus on AI (Commission proposal, 19 November 2025; political agreement 6–7 May 2026); Regulation (EU) 2024/1689 (AI Act), Articles 4, 5, 27, 50, 99/101; Annexes I and III.
- Law-firm and practitioner analyses (May–June 2026): Gibson Dunn; Latham & Watkins; Covington (Inside Privacy / Global Policy Watch); DLA Piper; VerifyWise; ComplianceHub.
- On the residual legal baseline during the deferral: GDPR, product-liability and anti-discrimination law; national measures (e.g. Italy) on human oversight of employment decisions.
This is a policy brief for general information, not legal advice. Dates tied to the Digital Omnibus are contingent on publication in the Official Journal; confirm current status before relying on them.
