If you’ve been half-following EU AI Act coverage this year, you could be forgiven for thinking the whole thing quietly went away. Headlines all summer have led with delay, postponement, sixteen more months. A lot of compliance teams read that news, exhaled, and moved AI governance back down the priority list.
That’s the wrong read, and it’s worth correcting before it costs someone a fine. The deadline that actually landed on August 2, 2026 didn’t disappear. It split in two, and the half that survived is the half most businesses weren’t watching.
What Actually Changed, and What Didn’t
Here’s the distinction that matters: the EU’s Digital Omnibus on AI, now law as Regulation (EU) 2026/1744, pushed back the heaviest compliance package, conformity assessments, technical documentation, and formal risk classification for high-risk systems, to December 2, 2027 for standalone systems and August 2, 2028 for AI embedded in regulated products. That’s the part everyone’s been reporting.
What didn’t move is Article 50. As of August 2, 2026, any business deploying a chatbot or similar conversational AI has to disclose that a person is talking to an AI, in plain language, at the start of the interaction, and any synthetic or deepfake content has to be labeled as such. The same date activated the EU AI Office’s authority to supervise and fine general-purpose AI model providers directly.
“2 August 2026 remains a live compliance date, and organizations should keep preparing for it regardless of the deferred high-risk deadlines.”
The penalty ceiling attached to this isn’t symbolic. Non-compliance can trigger fines up to €15 million or 3% of global annual turnover, whichever is higher, and that number applies whether you’re a scrappy startup with a customer-support bot or an enterprise running AI across a dozen markets.
Why This Is Easy to Get Wrong Right Now
Part of what makes this moment genuinely confusing is that two separate regulatory clocks landed in the same news cycle, and most coverage collapsed them into one story. The high-risk delay is real. The transparency requirement is also real, and it was never on the table for postponement.
A few other details tend to get lost in the same noise:
- AI literacy obligations under Article 4, requiring that people operating AI systems on a provider’s or deployer’s behalf have adequate understanding of how those systems work, have technically applied since February 2025, not August 2026.
- GDPR obligations around every prompt, upload, and AI-generated output containing personal data were never given a grace period by the AI Act. Data minimization and storage limitation still apply in full, on their own timeline.
- Businesses that placed AI systems on the market before August 2, 2026 get a four-month grace period, until December 2, 2026, before the watermarking requirement for AI-generated content kicks in.
- A new carve-out for “Small Mid-Caps,” businesses with up to 750 employees and €150 million in annual revenue, now gives streamlined documentation requirements and priority access to regulatory sandboxes, closing a gap that previously threatened to burden scaling mid-market companies with enterprise-level compliance costs.
None of this is legal advice, and the details here shift quickly enough that anything published today is worth re-checking against current EU guidance before you act on it. But directionally, the pattern is consistent: the parts of the Act touching how AI shows up in front of your customers stayed on schedule. The parts touching how you document and classify high-risk systems internally got more room to breathe.
A Practical Checklist for What Actually Applies Now
Strip away the delay headlines, and here’s what a business using AI tools should actually be checking against, starting now.
Disclose AI in every customer-facing conversation. If a chatbot, voice assistant, or similar tool interacts with customers, it needs a clear, plain-language disclosure at the start of the interaction. This is enforceable today, not in 2027.
Label synthetic and AI-generated content. Deepfakes and AI-generated media need visible or machine-readable labeling. If your marketing, support, or product teams are using generative AI to produce customer-facing content, this now needs to be built into the workflow, not bolted on afterward.
Audit AI literacy across your teams. Article 4 has technically applied since early 2025. If the people operating AI tools on your behalf, internally or through vendors, don’t have adequate understanding of how those systems function and where they can go wrong, that’s a live gap, not a future one.
Treat vendor contracts as compliance surface, not just procurement. Update supplier and contract management to incorporate AI Act commitments, disclosure requirements, and recourse mechanisms, particularly for any AI vendor whose output touches your EU customers, employees, or operations.
Map your Shadow AI. One of the most consistently underestimated risks is the AI tools staff adopt informally, outside any sanctioned procurement process. A structured inventory of every AI system in use, its provider, its purpose, and its department, is the starting point most compliance frameworks recommend before anything else.
Check whether the Small Mid-Cap carve-out applies to you. If your business sits under 750 employees and €150 million in revenue, you may now qualify for a lighter documentation burden than the original framework assumed, worth confirming before assuming the heaviest requirements apply.
Reassess your high-risk classification against the delayed timeline, but don’t stop preparing. Standalone high-risk systems, hiring tools, credit scoring, biometric identification, critical infrastructure, now have until December 2027. That’s genuine breathing room, not a reason to abandon the classification work entirely, since the underlying obligation hasn’t gone away, only its enforcement date.
Your EU AI Act Quick-Reference Checklist
Save this section, or copy it into your own compliance tracker. It’s the same requirements above, condensed into something you can actually check off.
Live now (already enforceable):
- Chatbots and conversational AI disclose “you are talking to an AI” at the start of every customer interaction
- AI-generated or synthetic content (deepfakes, generated media) is labeled as such
- Staff operating AI systems on your behalf have documented AI literacy training (Article 4 has applied since February 2025)
- GDPR data minimization and storage limitation are applied to every AI prompt, upload, and output containing personal data
- Vendor and supplier contracts include AI Act disclosure and recourse commitments, not just data-processing terms
Due by December 2, 2026:
- Watermarking implemented for AI-generated content, if your system was placed on the market before August 2, 2026 (four-month grace period)
Ongoing, before the extended deadlines arrive:
- A complete inventory of every AI system in use across the business, including tools adopted informally by staff (“Shadow AI”)
- A documented risk classification for each system against Annex III high-risk categories, even though enforcement isn’t until December 2027
- Confirmation of whether your business qualifies for the Small Mid-Cap carve-out (under 750 employees, under €150 million revenue)
- A named owner internally for AI Act compliance, not left to whichever team happened to deploy the tool
Before you assume you’re covered:
- Confirm which deadlines actually apply to your specific systems with qualified legal counsel, since classification is highly contextual and the guidance is still evolving
The Real Risk Isn’t the Regulation, It’s the Assumption
The businesses most exposed right now aren’t the ones still working through a genuinely complex classification question. They’re the ones who read “AI Act delayed” once, in a headline, and quietly stopped paying attention to everything the Act still requires today.
That’s a communication failure as much as a compliance one. Legal and compliance teams inside plenty of organizations understand the Article 50 versus high-risk distinction clearly. The people actually deploying AI tools day to day, marketing teams standing up a new chatbot, product teams shipping a generative feature, often don’t, because the nuance rarely makes it past the headline before it reaches them.
Closing that gap is less about legal expertise and more about making sure AI adoption inside your business is deliberate, documented, and disclosed by design, which is a big part of how we think about AI integration work with clients through Kilowott Intelligence, building the disclosure, documentation, and governance habits in from the start rather than retrofitting them after a customer complaint or a regulator’s letter.
If you’re not fully sure where your business’s AI tools currently stand against what’s actually enforceable this year, that’s worth a proper look, ideally alongside qualified legal counsel for anything touching your specific obligations. Take a look at how we’ve approached responsible AI adoption for other clients in our case studies, or get in touch if you’d rather talk it through directly.
