EU AI Act Delay: What Moved and What Didn't

The heaviest batch of obligations in the EU AI Act was scheduled to take effect on August 2, 2026. Six days before that deadline, an amending regulation took effect first and pushed the date back by 16 months.

In August I wrote a short item whose headline said three transparency rules “didn’t give an inch”. Checking again this time, that needs correcting: one of them did get a four-month grace period. The amending regulation also did more than defer; it added two new prohibitions along the way, which the original didn’t mention at all.

If your product has users in Europe, the timetable below is more useful than the headlines.

What exactly is this amending regulation?

Its formal name is long. I went straight to EUR-Lex, the EU’s legal database, for the original record:

Figure: the EUR-Lex record for Regulation (EU) 2026/1744 (source: eur-lex.europa.eu)

The number is Regulation (EU) 2026/1744, and the short name in brackets is Digital Omnibus on AI. Its stated purpose in the title is “simplification” of how the AI rules are implemented. It amends more than the AI Act (2024/1689); two other regulations are included. The Official Journal date is July 24 and the status reads In force.

It took eight months from proposal to law, and it didn’t go smoothly:

Figure: the Digital Omnibus from proposal to law (compiled for this article from DLA Piper’s update log and the Official Journal date on EUR-Lex)

The trilogue at the end of April collapsed. A provisional agreement came only on May 27, and entry into force was July 27, six days short of the original August 2.

That gap had a practical effect on companies. The body of DLA Piper’s article was still advising clients, right up to the end of April, to keep preparing for August 2, because nobody could guarantee the delay would pass. So the serious companies had mostly finished the bulk of their compliance work before the news of the delay arrived.

What moved, and to when?

I merged several law firms’ summaries into one table:

Figure: the main dates the Digital Omnibus changed (compiled for this article from Orrick’s and Jones Walker’s accounts of Regulation (EU) 2026/1744)

The main item is Annex III high-risk systems, moved from August 2, 2026 to December 2, 2027. Annex III lists uses, not technologies. An AI counts whenever it’s used for these things: recruiting and screening candidates, performance evaluation, task allocation, monitoring workers, decisions on promotion or termination, as well as creditworthiness, certain insurance, education, and access to essential services.

What got deferred is an entire set of compliance requirements: risk management, data governance, technical documentation, human oversight. These take money and people to build.

Orrick’s summary adds a detail: systems already on the market are covered only if they are substantially modified after that date.

Two other dates get mentioned less. High-risk AI embedded in regulated products (Annex I) is August 2, 2028. AI used by public authorities is August 2, 2030.

What took effect on August 2 anyway?

The transparency obligations in Article 50. The August article said “three”; broken down there are actually five, aimed at different parties:

Figure: the five transparency duties in Article 50 of the AI Act (compiled for this article from Jones Walker’s account of 2026-07-16)

One distinction in this table is worth remembering: the duties are split between two roles. A “provider” is whoever builds the system, and a “deployer” is whoever puts it to use. If you built a support chatbot on someone else’s model, under these definitions you may be both.

Plain-language versions:

• If your system interacts directly with people, they have to know it’s an AI. The exception is when the context already makes it obvious to an ordinary person.
• If your system generates or manipulates audio, image, video or text, the output has to carry a machine-readable marking and be detectable where technically feasible.
• If you run emotion recognition or biometric categorization on people, you have to tell them.
• If you publish deepfake content, you have to disclose it. Works that are evidently artistic, creative, satirical or fictional are treated differently.
• If you publish AI-generated text on matters of public interest, you generally have to disclose it. Content that has been through human review, with someone bearing editorial responsibility, is exempt.

That last one matters especially for content sites. Its exemption turns on someone bearing editorial responsibility, which amounts to the law sorting “AI-written with a person checking it” and “AI-written and published directly” into two categories.

The item I need to correct

The second one, machine-readable marking of synthetic content, got a grace period. Orrick and Jones Walker agree: systems placed on the market before August 2, 2026 have until December 2, 2026 to implement technical marking.

The grace period is narrow. It applies only to this one duty and only to legacy systems. New systems placed on the market after August 2 get none, and neither do the other four duties. Jones Walker specifically warns against stretching it to cover anything else.

So the more accurate statement is this: all five transparency duties took effect on August 2, and one of them gives legacy systems four more months. I’m writing this in mid-October, and that deadline is less than two months away.

How large are the fines for violating Article 50?

The ceiling Jones Walker gives is €15 million or 3% of worldwide annual turnover for the prior year, whichever is higher. For qualifying SMEs and startups it’s whichever is lower.

That’s a statutory ceiling, and the Act itself requires penalties to be proportionate. How it will actually be applied, there are no cases to look at yet.

The supporting material arrived over the same period. Jones Walker notes that on July 8 the Commission found a Code of Practice on AI-generated content adequate to cover several Article 50 duties, and the AI Board adopted that assessment the next day. Following the code helps show compliance but doesn’t guarantee it, and the code doesn’t cover every Article 50 question.

Beyond the delay, what else did it change?

This is what the August article missed entirely. Orrick lists eight changes; I’ll pick the ones more relevant to general readers.

Two new prohibitions. Article 5 (prohibited AI practices) gains two: systems designed to produce, or reasonably foreseeably producing, non-consensual intimate imagery, and child sexual abuse material. They apply from December 2, 2026. The European Parliament’s press release calls the former a “nudifier app ban”.

A regulation named for “simplification” has new prohibitions added to it. That’s probably what Parliament got in exchange for agreeing to the delay.

Relief for mid-sized companies too. Simplified measures used to be for SMEs only, and now extend to “small mid-caps”: fewer than 750 employees, and turnover of €150 million or less or a balance sheet total of €129 million or less. They get simplified documentation templates, lighter quality-management requirements, priority access to regulatory sandboxes, and lower penalty caps.

A narrower definition of “safety component”. To count as one, a component’s intended purpose must be preventing or mitigating health and safety risks. Systems used solely for optimization or convenience are excluded. But if its malfunction would endanger health and safety, it still counts.

More power for the AI Office. For AI systems built on a general-purpose model and supplied by the same company or group, and for AI systems integrated into very large online platforms or search engines, the EU AI Office gets exclusive supervision. In plain terms, products that the big model companies build themselves are supervised directly from Brussels, not through member states.

What does this have to do with companies outside Europe?

Quite a bit, and more than most people assume.

Jones Walker’s piece is written for US companies, and the principle applies equally to Taiwan: the AI Act can reach providers and deployers outside the EU when the AI’s outputs are used in the EU. Europeans merely being able to reach your website isn’t the trigger; it has to be assessed system by system.

I think several of its practical suggestions can be used as they stand:

1. Take inventory. List the chatbots, generative systems and synthetic media workflows with a European connection.
2. Map roles. For each system, are you a provider, a deployer, or both?
3. Handle each duty separately. The five target different parties and have different exceptions, so don’t treat them as one bundle.
4. Identify legacy systems. Which were on the market before August 2 and can use the marking grace period to December 2?
5. Test in practice. Does the chatbot notice appear before the first interaction, and does the marking survive your distribution pipeline?
6. Write down the exceptions. If you conclude a duty doesn’t apply, record the facts behind that conclusion.

Is this delay good or bad?

My own view leans this way: not good for users, though the approach is understandable.

The understandable part is that standards aren’t ready. Orrick notes the amendment requires the Commission to ask European standards bodies for standards covering both the AI Act and existing harmonization laws. With rules in force and no standard to measure against, companies really don’t know how far is far enough to comply.

The not-good part is that what got deferred is exactly the piece closest to ordinary people. AI screening résumés, scoring performance and deciding who gets laid off is happening now, and the requirements governing it arrive 16 months late.

What the EU chose to keep is worth noticing. “People should know they’re talking to an AI” and “synthetic content must be marked”, rules that are cheap and directly felt by users, weren’t touched. The expensive ones, requiring a whole management system, were pushed back.

Over the same period the US sits at the other extreme. There’s no federal AI safety legislation, and in September’s argument over whether to slow down, nothing with binding force emerged either. Regulatory pressure is coming from the courts instead, as with Meta’s youth addiction trial. The EU’s route at least provides a table with dates on it.

What would change my mind? A second delay before the end of 2027. The reason this time was that standards weren’t ready, and the same reason can be used again.

The limits of this article

• I haven’t read the full text of the regulation. I saw the EUR-Lex record page, but what the articles say comes to me through three law firms’ summaries (DLA Piper, Orrick, Jones Walker).
• Those firms’ articles are summaries written for clients, not legal advice, and this article even less so.
• The August article said “the Commission’s enforcement powers over general-purpose AI models began the same day”. Nothing in the sources I checked this time supports that sentence, and it’s been removed.
• The fine figures are statutory ceilings; there are no actual penalty cases yet.
• Whether your system is covered depends on the specific facts. Talk to a lawyer who knows EU law.