EU deferred the AI Act's high-risk rules to 2027 and 2028 but left the 2 August labelling duties standing

The measure that everyone calls a gutting of the EU AI Act has a name, a number and a date. It is Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026, amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence, known as the Digital Omnibus on AI. It was published in the Official Journal on 24 July 2026 and, on the standard formula of entry into force on the third day following publication, took effect on 27 July 2026. The International Association of Privacy Professionals gives the same date.

What it defers is real. Obligations for systems classified as high risk under Article 6(2) and Annex III, the standalone category covering biometrics, critical infrastructure, education, employment, migration, border control, law enforcement and the administration of justice, now apply from 2 December 2027. Obligations for systems classified as high risk under Article 6(1) and Annex I, meaning artificial intelligence embedded in products already regulated by sectoral safety law, apply from 2 August 2028. Gibson Dunn notes those dates were previously 2 August 2026 and 2 August 2027, so the standalone category slipped by about sixteen months and the embedded category by twelve. The European Commission's own framework page presents the new dates as a clearer staggered timeline rather than a single compliance cliff.

What did not move is the part most consumers will actually see. The Article 50 transparency obligations began to apply on 2 August 2026. They require providers to disclose when a person is interacting with an artificial intelligence system, require machine readable marking of synthetic content, and require deployers to disclose deepfakes and the use of emotion recognition and biometric categorisation. The omnibus does soften the edge: providers who placed generative systems on the market before 2 August 2026 get a transitional period of four months for the Article 50(2) marking obligation, which runs to 2 December 2026.

The omnibus also adds a prohibition rather than only removing burdens. Article 5, the list of banned practices, now covers systems that generate or manipulate non consensual intimate material and child sexual abuse material. Gibson Dunn reads the drafting as catching systems where such generation is a reasonably foreseeable and reproducible outcome rather than only systems built for the purpose, and says the new prohibition carries a transitional period running to December 2026. The regulation text as read for this article indicates the new prohibitions take effect on entry into force with no separate delay stated. The two readings are not reconcilable from the summaries alone, and anyone relying on a December date should get advice on the specific transitional article rather than on the timeline tables.

One widely repeated claim about 2 August 2026 does not survive checking. The AI Act's penalty framework was not switched on that day. The public AI Act implementation timeline puts the penalties provisions in Articles 99 and 100, alongside the general purpose AI model obligations and the governance chapter, at 2 August 2025, a year earlier. What Norton Rose Fulbright's Data Protection Report identifies as falling on 2 August 2026 is narrower: the deadline for member states in respect of market surveillance authorities, and the end of the grace period for signatories to the general purpose AI code of practice.

Several other changes ride along in the same instrument. The deadline for member states to establish regulatory sandboxes moves to August 2027. The AI Office gains investigative powers, the ability to conduct on site inspections and the power to impose fines. The legal basis for processing special category personal data for bias detection is widened, under a strict necessity standard, to cover all AI systems and general purpose models. Fundamental rights impact assessment duties under Article 27 are modified, AI literacy obligations are softened, relief is given to small mid-cap enterprises, and the Commission is empowered to limit the application of specific AI Act requirements where sectoral legislation already imposes equivalent obligations.

What is unresolved is mostly practical. The sources do not agree on when the political deal was struck, with Gibson Dunn giving 6 May 2026 and confirmation by member states on 13 May, and the IAPP giving 7 May 2026. The deferral of the high risk rules was justified by the absence of harmonised standards, and nothing in the regulation guarantees those standards will exist by December 2027. National penalty regimes, which member states set themselves, are not standardised by the omnibus. And the first real test of the Article 50 duties will be whether a machine readable marking obligation can be enforced against content that is trivially stripped of its markings.