Regulatory update, 30 July 2026

The EU AI Act's 2 August 2026 deadline moved. Here is the exact diff.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July. It defers the high-risk AI obligations by 16 months for standalone systems and 12 months for embedded ones. It does not defer everything, and the parts it left alone start applying this Sunday. This page is the date-by-date diff for engineers and compliance owners, with no vendor panic attached.

The date diff, in one table

Compiled from Regulation (EU) 2026/1744 and published analyses of the final text. Engineering summary, not legal advice.

What moved, and how it got here

The Commission published the Digital Omnibus on AI on 19 November 2025, proposing to defer the high-risk compliance deadline. A first trilogue on 28 April 2026 ended without agreement; the institutions returned and reached provisional political agreement on 6 May, confirmed by Member State representatives in the Council on 13 May. The European Parliament endorsed the package on 16 June 2026 by 423 votes to 57 with 174 abstentions, the Council gave final approval on 29 June, and the regulation entered into force on 27 July 2026.

The stated reasons were practical rather than philosophical: national competent authorities were not designated on time, and the harmonised standards that tell providers how to comply with the high-risk requirements are still in draft. Critics read it as a response to industry pressure. Both readings can be true; neither changes the dates.

One detail matters more than it looks. The Commission's original proposal made the deferral conditional, tied to a determination that harmonised standards were available. The final text dropped that mechanism in favour of fixed dates. So there is no stop-the-clock left to pull: 2 December 2027 and 2 August 2028 are firm even if the standards slip again.

What did not move, and lands on 2 August 2026

The transparency obligations in Article 50 were not deferred. From 2 August 2026:

• Disclosure of AI interaction. People must be told they are interacting with an AI system, unless it is obvious to a reasonably well-informed person.
• Machine-readable marking of synthetic content. Providers of systems generating synthetic audio, image, video or text must mark outputs in a machine-readable format, detectable as artificially generated or manipulated. This applies immediately to systems placed on the market after 2 August 2026; systems already on the market have until 2 December 2026.
• Deepfake and public-interest text disclosure duties on deployers.

Also untouched: the revised Product Liability Directive (EU) 2024/2853, due for national transposition on 9 December 2026. Its Recital 46 allows defectiveness to be presumed where a product lacks the logging that Union law requires. That is a civil-litigation mechanism, enforced by claimants rather than by the AI Office, and it now arrives almost a full year before Article 12 does. If your mental model was "logging pressure starts in August 2026," the pressure did not disappear; it changed which body of law delivers it.

Other amendments worth knowing

• A new Article 5 prohibition covering AI-generated non-consensual intimate imagery and child sexual abuse material, with a transitional period to 2 December 2026.
• AI literacy requirements relaxed to a documentation-based obligation rather than individual competence certification.
• Simplified registration for systems self-assessed as out of scope under Article 6(3).
• Limited exemptions for AI embedded in products already covered by EU product safety law, to reduce duplicate requirements.
• Expanded bias-detection authority extended to all AI systems, and a strengthened supervisory role for the EU AI Office including investigative powers.
• Expanded support provisions for SMEs and small mid-cap enterprises.

What to actually do with 16 extra months

The honest answer for most teams is: less than the vendors selling you an August 2026 emergency were telling you, and more than nothing.

1. Check whether Article 50 reaches you this Sunday. It is far broader than the high-risk categories. If your product talks to people or generates content, the disclosure and marking duties can apply even when the high-risk regime never will.
2. Do not defer record-keeping to match the deferred deadline. Records are the one obligation you cannot satisfy retroactively. On 2 December 2027, questions will be asked about incidents from months earlier, and either the signed, timestamped record exists from back then or it does not. Switching capture on the week before the deadline produces an empty history.
3. Plan around 9 December 2026, not 2 December 2027. The Product Liability Directive is now your earliest hard reason to care about whether your logs can be argued away as self-serving.
4. Use the time for the parts that are genuinely hard. Risk management, data governance, and human oversight take longer to build than a logging pipeline. The deferral is most valuable if it is spent on those rather than on waiting.

FAQ

Is the EU AI Act high-risk deadline really delayed?

Yes. Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. Standalone Annex III high-risk obligations move from 2 August 2026 to 2 December 2027; AI embedded in Annex I regulated products moves from 2 August 2027 to 2 August 2028.

Does the delay cover Article 12 record-keeping?

Yes. Article 12 sits within the requirements for high-risk AI systems, so it applies when those obligations apply: 2 December 2027 for standalone Annex III systems, 2 August 2028 for Annex I embedded systems.

What still applies from 2 August 2026?

The Article 50 transparency obligations, which were not deferred: disclosing that a user is interacting with an AI system, and marking synthetic media in a machine-readable format. Systems already on the market have until 2 December 2026 for the marking duty.

Could the deadline move again?

Not through the mechanism in the original proposal. The Commission had proposed tying the new dates to the availability of harmonised standards; the adopted text replaced that conditional trigger with fixed dates. A further change would require new legislation.

Should we stop our AI Act compliance work?

No, and in particular not the record-keeping part, which cannot be produced retroactively. The revised Product Liability Directive must be transposed by 9 December 2026 and was not deferred, so the evidentiary pressure on log integrity arrives before Article 12 does. This is an engineering summary, not legal advice; consult qualified counsel for your situation.

Sources: Regulation (EU) 2026/1744 (Digital Omnibus on AI), published in the Official Journal 24 July 2026, in force 27 July 2026; Regulation (EU) 2024/1689 (the AI Act), Articles 5, 6(3), 12, 14, 50 and Annexes I and III; Directive (EU) 2024/2853 (revised Product Liability Directive). Published 30 July 2026. Engineering summary, not legal advice.