EU AI Act now applies, but its high-risk rules slipped 16 months

01What is live on 4 August, and what was already live

The AI Act entered into force on 1 August 2024 and switches on in stages.¹ Three stages are behind us. Since 2 February 2025 eight practices have been banned outright, among them social scoring, manipulative techniques that cause significant harm, untargeted scraping of faces to build recognition databases, and emotion recognition at work and in schools. Since 2 August 2025 providers of general-purpose AI models, the large models other products are built on, have owed technical documentation, information for the companies building on them, a copyright policy and a public summary of their training content.¹

On 2 August 2026 the Act became applicable as a whole, with the exceptions the omnibus carved out. In practice three things changed this week. Article 50’s transparency duties now bind. The European Commission’s power to fine general-purpose model providers, held back a year by Article 113, is now in force. And national market-surveillance authorities can enforce the transparency rules against anyone in scope.¹⁴

Article 50 is the part most firms will meet first. A provider must design any AI system that talks to people so they know it is an AI, unless that is obvious, and must mark synthetic audio, images, video and text in a machine-readable way so that it can be detected as artificial. A deployer must tell people when it runs emotion recognition or biometric categorisation on them, and must disclose deepfakes and AI-written text published to inform the public on matters of public interest, unless a human has reviewed it and taken editorial responsibility.¹ A customer-support bot is not high-risk under the Act. It is, from this week, a system that has to say what it is.

02What the omnibus moved, and how it became law with six days to spare

The Commission proposed the “Digital Omnibus on AI” on 19 November 2025 as targeted simplification.³ A first round of three-way talks on 28 April 2026 ended without a deal; negotiators reached a provisional agreement on 6 May, and member-state representatives confirmed it on 13 May.⁴ The European Parliament adopted it on 16 June.⁵ The final act, Regulation (EU) 2026/1744, is dated 8 July 2026, was published in the Official Journal on 24 July²⁶ and entered into force three days later, on 27 July.⁵ Until that publication, law firms had warned that the new dates would bind only once the text appeared in the Journal.⁴ It appeared in time.

The omnibus did more than move dates. It added a ninth ban, on systems that generate child sexual abuse material or non-consensual intimate imagery, the so-called nudifier apps, applying from 2 December 2026. It softened the AI-literacy duty that has applied since February 2025, which law firms read as a duty to support staff literacy rather than to guarantee a level of it. It extended to all AI systems the legal basis for processing sensitive personal data to detect and correct bias, under a strict-necessity test. It kept the duty to register Annex III systems a provider judges not to be high-risk, with a simpler procedure. And it extended some small-business relief to small mid-cap companies.⁴⁵

03Provider or deployer: the role decides the duty

The Act hangs almost every obligation on one of two roles. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its own authority in a professional activity.¹ A software company selling a CV-screening product is its provider; the employer that screens applicants with it is the deployer. The same company can be both: a provider of what it sells and a deployer of the tools it runs internally.

Roles can change hands. A distributor, importer or deployer becomes the provider of a high-risk system if it puts its own name or trademark on one, makes a substantial modification, or changes a system’s intended purpose so that it becomes high-risk, for example by pointing a general chatbot at loan decisions.¹ For Annex III systems that rule bites from 2 December 2027, but the contracts that decide whose name is on the product are being signed now.

04What getting it wrong can cost

The penalty tiers are set as a fixed sum or a share of total worldwide annual turnover for the preceding financial year, whichever is higher. The share is of the whole group’s worldwide turnover, not its EU sales. For small and medium-sized firms, and since the omnibus for small mid-caps on the middle and lower tiers, the cap is whichever is lower.¹⁷ Member states set the penalties for operators; the Commission alone fines general-purpose model providers.¹

The middle tier is the one that matters this week, because it covers the Article 50 transparency duties as well as the deployer and provider duties that arrive in 2027.¹ A chatbot that does not say it is a chatbot is now, in principle, a breach in that tier.