A conversation about 2 August

Around the middle of May the headlines all said roughly the same thing, which was that Brussels had delayed the AI Act, and ever since then I have been having a version of the same conversation with people who read those headlines and quite reasonably concluded that August was off the table. It was never off the table. It got smaller, and it got quieter, and in my experience a quiet deadline is a good deal more dangerous than a loud one, because nobody puts a quiet deadline on the board paper.

The Digital Omnibus on AI is law. Parliament adopted the agreed text on 16 June, the Council signed off on 29 June, the act was signed on 8 July, and it was published in the Official Journal on 24 July as Regulation (EU) 2026/1744. It entered into force on 27 July, three days after publication, and the regulation justified that compressed timing as a matter of urgency because the date it amends fell the following week.

The relief in it is genuine, which I want to be fair about, because a fair bit of commentary treated the Omnibus as some sort of sleight of hand and it is nothing of the sort. The heavy high-risk regime for the Annex III categories, the one covering recruitment tools and credit scoring and insurance pricing and the rest of it, moved from 2 August 2026 out to 2 December 2027, and where the AI sits inside a product already governed by EU product safety law it moved further again to 2 August 2028. Those are fixed calendar dates rather than the conditional ones originally proposed, which is worth knowing, because the November draft tied them to a later finding that the standards were ready and the adopted text dropped that condition entirely.

What did not move is Article 50, and Article 50 has applied since 2 August.

Article 50 is the transparency layer and it has nothing to do with whether a system is high-risk, which is precisely why the deferral does not reach it. If you run a chatbot, the person on the other end has to be told they are talking to a machine. If you generate synthetic audio or images or video or text, the output has to be marked in a machine-readable form so it can be detected as artificial. If you produce a deepfake you have to disclose it, and if you publish AI-generated text to inform the public on a matter of public interest you have to disclose that too. That catches a marketing team drafting public copy, a service desk running a bot, and a communications function producing anything synthetic, none of which anybody would describe as a high-risk AI deployment, and all of which are squarely in scope.

The same date brought the enforcement machinery with it, which is the part that tends to get missed. From 2 August the Commission and the national market surveillance authorities have the power to fine, and the general-purpose AI provisions became enforceable. The obligation and the penalty arrived together, so there was never a comfortable window in which the duty existed on paper and nobody could act on it.

There is one narrow piece of breathing room and it is worth understanding precisely how narrow it is. Generative systems already placed on the market before 2 August have until 2 December this year to meet the machine-readable marking requirement under Article 50(2). That is a provider transition for legacy systems and it is not a general pause, so the chatbot disclosure and the deepfake disclosure applied from August regardless, and anything placed on the market from 2 August onwards had no transition at all. The second of December also brings the new prohibitions the Omnibus added to Article 5.

For the financial services firms I work with there is a second layer to this, because the AI system that decides something about a customer is almost always running on ICT that DORA already governs. The AI Act asks who signed off on the model and the DORA register asks who provides the service underneath it, and firms that answer those two questions separately end up doing the work twice and then answering inconsistently when somebody puts them side by side. It is the same inventory, the same owners and the same evidence trail, and it is considerably cheaper to build it once.

If you have not done it yet there is a short list that is worth a good deal more than a programme. Find every place your organisation puts AI output in front of a person or out into the world, which usually takes an afternoon and usually turns up two or three that nobody had written down. Check what the chatbot actually says when it opens a conversation. Check whether anything you publish that was drafted or generated by a model carries a disclosure. Ask your vendors in writing how they are meeting Article 50(2), because if you are deploying somebody else's generative tool then their marking is your exposure. And write down who owns the answer, because the question stopped being rhetorical in August.

None of that amounts to a compliance programme and I would not pretend otherwise. It is the difference between being able to answer the question and not being able to, which is generally where these things start.