--- title: "EU AI Act now applies, but its high-risk rules slipped 16 months" summary: "What the EU AI Act began to require on 2 August 2026, what the digital omnibus moved to December 2027 and August 2028, and who owes what, as of 4 August 2026." url: https://www.thetechbag.com/blog/eu-ai-act-applies-high-risk-delayed format: Analysis desk: "AI in the enterprise" published: 2026-08-04 facts_checked: 2026-08-04 author: TechBag (The TechBag Journal) tags: ["EU AI Act","Digital Omnibus on AI","Article 50","high-risk AI","general-purpose AI","AI governance","IT Rules","India AI Governance Guidelines"] cover: https://www.thetechbag.com/blog/covers/eu-ai-act-applies-high-risk-delayed.png --- # EU AI Act now applies, but its high-risk rules slipped 16 months *What the EU AI Act began to require on 2 August 2026, what the digital omnibus moved to December 2027 and August 2028, and who owes what, as of 4 August 2026.* Analysis · AI in the enterprise · By TechBag · Published 2026-08-04 · Facts checked 2026-08-04 · Canonical: https://www.thetechbag.com/blog/eu-ai-act-applies-high-risk-delayed The short version - The EU AI Act became generally applicable on 2 August, but not its best-known part. The rules for high-risk systems such as hiring screeners and credit scoring now start on 2 December 2027, sixteen months late, and those for AI built into regulated products on 2 August 2028.[1][2] - The delay is law, not a promise. The digital omnibus that moved the dates was published in the EU’s Official Journal on 24 July and took effect on 27 July, six days before the old deadline would have bitten.[2][5][6] - What did not move is live today: the bans (since February 2025), the duties on general-purpose AI models (since August 2025, with Commission fines possible from 2 August), and Article 50’s transparency rules for chatbots, deepfakes and synthetic content. Any Indian firm whose AI output is used in the EU is in scope.[1][4] For two years, compliance teams were told that 2 August 2026 was the day the EU AI Act arrived in full. It did arrive, in part. The question for anyone who builds or runs AI that touches Europe, from a chatbot on an EU retailer’s site to a CV screener sold to a German employer, is narrower: which duties apply this week, which were pushed back and by how much, and whether you are a “provider” or a “deployer” in the Act’s terms, because that decides what you owe. ## What is live on 4 August, and what was already live The AI Act entered into force on 1 August 2024 and switches on in stages.[1] Three stages are behind us. Since 2 February 2025 eight practices have been banned outright, among them social scoring, manipulative techniques that cause significant harm, untargeted scraping of faces to build recognition databases, and emotion recognition at work and in schools. Since 2 August 2025 providers of general-purpose AI models, the large models other products are built on, have owed technical documentation, information for the companies building on them, a copyright policy and a public summary of their training content.[1] On 2 August 2026 the Act became applicable as a whole, with the exceptions the omnibus carved out. In practice three things changed this week. Article 50’s transparency duties now bind. The European Commission’s power to fine general-purpose model providers, held back a year by Article 113, is now in force. And national market-surveillance authorities can enforce the transparency rules against anyone in scope.[1][4] **Figure: The bans, model duties and transparency rules are live; the high-risk regime is 16 and 24 months away** *Application dates of the EU AI Act as amended by Regulation (EU) 2026/1744, February 2025 to August 2028* | Date | Event | Detail | | --- | --- | --- | | 2 Feb 2025 | Bans and AI literacy | Eight prohibited practices; staff AI literacy | | 2 Aug 2025 | General-purpose AI models | Documentation, copyright policy, training summary | | 27 Jul 2026 | Omnibus in force | Published 24 July; moves the high-risk dates | | 2 Aug 2026 | Act applies | Article 50 transparency; Commission can fine model providers | | 2 Dec 2026 | Marking grace ends; new ban | Machine-readable marking for systems already on sale; nudifier and CSAM generators banned | | 2 Aug 2027 | Older models, sandboxes | Pre-August 2025 models comply; national sandboxes due | | 2 Dec 2027 | Annex III high-risk | Hiring, credit, education, biometrics and more | | 2 Aug 2028 | Annex I high-risk | AI inside regulated products | Source: Regulation (EU) 2024/1689, Article 113; Regulation (EU) 2026/1744; Gibson Dunn; Sidley Austin · as of 4 August 2026 · Dates after 4 August 2026 are fixed in law, not forecasts. Models on sale before 2 August 2025 have until 2 August 2027 to comply. Article 50 is the part most firms will meet first. A provider must design any AI system that talks to people so they know it is an AI, unless that is obvious, and must mark synthetic audio, images, video and text in a machine-readable way so that it can be detected as artificial. A deployer must tell people when it runs emotion recognition or biometric categorisation on them, and must disclose deepfakes and AI-written text published to inform the public on matters of public interest, unless a human has reviewed it and taken editorial responsibility.[1] A customer-support bot is not high-risk under the Act. It is, from this week, a system that has to say what it is. ## What the omnibus moved, and how it became law with six days to spare The Commission proposed the “Digital Omnibus on AI” on 19 November 2025 as targeted simplification.[3] A first round of three-way talks on 28 April 2026 ended without a deal; negotiators reached a provisional agreement on 6 May, and member-state representatives confirmed it on 13 May.[4] The European Parliament adopted it on 16 June.[5] The final act, Regulation (EU) 2026/1744, is dated 8 July 2026, was published in the Official Journal on 24 July[2][6] and entered into force three days later, on 27 July.[5] Until that publication, law firms had warned that the new dates would bind only once the text appeared in the Journal.[4] It appeared in time. ReportedThe legal status on 4 August The omnibus is in force. Regulation (EU) 2026/1744 amends the AI Act (Regulation (EU) 2024/1689) and two product regulations, and its new dates are now part of Article 113 of the Act.[2][7] **Figure: Annex III high-risk rules moved 16 months and Annex I rules 12; transparency and the model duties did not move** *When each obligation applies, in months after the AI Act entered into force on 1 August 2024: original Act vs as amended in July 2026* | | Original Act | As amended | Change | | --- | --- | --- | --- | | Annex III high-risk | 24 | 40 | 67% | | Annex I high-risk | 36 | 48 | 33% | | National sandboxes | 24 | 36 | 50% | | Marking, systems on sale | 24 | 28 | 17% | | Article 50 transparency | 24 | 24 | 0% | | General-purpose AI models | 12 | 12 | 0% | | Prohibitions (Article 5) | 6 | 6 | 0% | Source: Regulation (EU) 2024/1689, Article 113 (original); Regulation (EU) 2026/1744; Gibson Dunn; Sidley Austin · as of 4 August 2026 · TechBag arithmetic on the legal dates. The percentage beside each value is the change in that month count, not a measure of burden. Marking: the grace period covers only systems placed on the market before 2 August 2026. The omnibus did more than move dates. It added a ninth ban, on systems that generate child sexual abuse material or non-consensual intimate imagery, the so-called nudifier apps, applying from 2 December 2026. It softened the AI-literacy duty that has applied since February 2025, which law firms read as a duty to support staff literacy rather than to guarantee a level of it. It extended to all AI systems the legal basis for processing sensitive personal data to detect and correct bias, under a strict-necessity test. It kept the duty to register Annex III systems a provider judges not to be high-risk, with a simpler procedure. And it extended some small-business relief to small mid-cap companies.[4][5] TechBag countTechBag count From 2 August 2026 to 2 December 2027 is 16 months; from 2 August 2027 to 2 August 2028 is 12. From entry into force on 27 July to the old 2 August deadline was six days. We counted calendar months and days between the dates in the two Regulations. ## Provider or deployer: the role decides the duty The Act hangs almost every obligation on one of two roles. A **provider** develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A **deployer** uses an AI system under its own authority in a professional activity.[1] A software company selling a CV-screening product is its provider; the employer that screens applicants with it is the deployer. The same company can be both: a provider of what it sells and a deployer of the tools it runs internally. **Figure: Providers carry the build-time duties and most of the 2027 workload; deployers carry the duties of use** *Obligations by role under the EU AI Act as amended, and when each applies, as of 4 August 2026* Provider (builds it, sells it under its name) - **Now:** chatbots tell people they are talking to an AI; synthetic content is marked machine-readably (2 December 2026 for systems already on sale). - **Now:** no prohibited practice; support staff AI literacy. - **Model providers, now:** documentation, copyright policy and training summary; Commission fines possible from 2 August. - **From 2 December 2027 (Annex III):** risk management, data governance, technical documentation, logging, human-oversight design, conformity assessment, CE marking, EU database registration. - **Outside the EU:** appoint an authorised representative in the EU before selling a high-risk system there. Deployer (uses it under its authority) - **Now:** tell people when emotion recognition or biometric categorisation is used on them. - **Now:** disclose deepfakes, and AI-written public-interest text that no human editor has taken responsibility for. - **Now:** no prohibited practice; support staff AI literacy. - **From 2 December 2027 (Annex III):** use as instructed, assign trained human oversight, keep logs at least six months, tell workers’ representatives before use at work, inform people a decision concerns. - **Credit and insurance deployers, and public bodies:** a fundamental-rights impact assessment before first use. Source: Regulation (EU) 2024/1689, Articles 4, 5, 16, 22, 26, 27, 50 and 53, with the dates set by Regulation (EU) 2026/1744 · as of 4 August 2026 Roles can change hands. A distributor, importer or deployer becomes the provider of a high-risk system if it puts its own name or trademark on one, makes a substantial modification, or changes a system’s intended purpose so that it becomes high-risk, for example by pointing a general chatbot at loan decisions.[1] For Annex III systems that rule bites from 2 December 2027, but the contracts that decide whose name is on the product are being signed now. Our view Our view: do not read the delay as a pause. The 2027 provider list is a documentation and testing programme that takes many months to build, and Annex III’s areas (recruitment and promotion decisions, creditworthiness and credit scores, life and health insurance pricing, access to education) are where vendors are selling AI hardest.[7] The useful thing the omnibus gave buyers is a fixed date to write into a contract. ## What getting it wrong can cost The penalty tiers are set as a fixed sum or a share of total worldwide annual turnover for the preceding financial year, whichever is higher. The share is of the whole group’s worldwide turnover, not its EU sales. For small and medium-sized firms, and since the omnibus for small mid-caps on the middle and lower tiers, the cap is whichever is lower.[1][7] Member states set the penalties for operators; the Commission alone fines general-purpose model providers.[1] **Figure: Breaking a transparency or deployer duty can cost up to €15 million or 3% of worldwide turnover** *Maximum fixed fine by type of breach under the EU AI Act, € million; the turnover alternative is in the note* Prohibited practice (Article 5) 35 €m Operator duties, incl. Article 50 and deployers 15 €m General-purpose model provider (Commission) 15 €m Misleading information to authorities 7.5 €m | | Value (€m) | | --- | --- | | Prohibited practice (Article 5) | 35 | | Operator duties, incl. Article 50 and deployers | 15 | | General-purpose model provider (Commission) | 15 | | Misleading information to authorities | 7.5 | Source: Regulation (EU) 2024/1689, Articles 99 and 101, as amended by Regulation (EU) 2026/1744 · as of 4 August 2026 · Each cap is the fixed sum or a share of worldwide annual turnover, whichever is higher: 7% for prohibited practices, 3% for operator duties and for general-purpose model providers, 1% for misleading information. For SMEs, and small mid-caps on the lower two tiers, the lower of the two applies. The middle tier is the one that matters this week, because it covers the Article 50 transparency duties as well as the deployer and provider duties that arrive in 2027.[1] A chatbot that does not say it is a chatbot is now, in principle, a breach in that tier. If you build or run AI for European clients from India **You are in scope wherever you sit.** The Act covers providers placing AI systems on the EU market whether they are established in the EU or not, and providers and deployers in a third country where the system’s output is used in the EU.[1] That reaches the Indian SaaS company selling an AI hiring screener to EU employers (a provider), the IT services firm that builds a credit-scoring model and ships it to a European lender under its own product name (a provider), and the support centre in Pune or Gurugram answering an EU client’s customers with an AI agent, which owes the Article 50 disclosure today. A firm that builds to a client’s specification, for the client to put into service under the client’s name, is usually not the provider; the client is. Read the contract to see whose name goes on it. **What to do now.** Put the Article 50 disclosure and content marking into every EU-facing chatbot and generator this quarter; systems already on sale have until 2 December 2026 for the marking. For hiring, credit and insurance products, plan the provider file for 2 December 2027, including the EU authorised representative a non-EU provider must appoint. Fines are counted on worldwide turnover, so an Indian group’s domestic revenue is in the base.[1] We found no published count of Indian firms selling AI into the EU, and we will not estimate one. There is no Indian price here either: the cost is the compliance work, and compare any adviser’s or EU representative’s quote in INR inclusive of 18% GST. **Figure: Europe regulates AI with one binding law; India relies on guidelines and duties on platforms** *The two approaches to AI rules, as of 4 August 2026* European Union - One Regulation for every sector, with duties tiered by risk. - Applies to non-EU firms whose AI output is used in the EU. - Fines up to €35 million or 7% of worldwide turnover. - High-risk duties from 2 December 2027 and 2 August 2028. India - No AI law; November 2025 guidelines say none is needed for now and lean on the IT Act and DPDP Act. - Binding duties sit on intermediaries through the IT Rules, amended 10 February 2026. - Synthetic audio and video must be labelled and carry provenance metadata. - Certain takedown orders must be met in 3 hours, down from 36. Source: Regulation (EU) 2024/1689; Regulation (EU) 2026/1744; Business Today on the IT Rules amendment; Entrepreneur India on the India AI Governance Guidelines · as of 4 August 2026 **India’s own rules apply on a different axis.** The India AI Governance Guidelines, released by MeitY in November 2025 after more than 2,500 consultation submissions, concluded that separate AI laws “are not needed at the moment” and proposed an AI Governance Group and an AI Safety Institute.[9] The binding rule is the IT Rules amendment notified on 10 February 2026 and in force since 20 February: intermediaries that enable AI-generated content must label it prominently and embed provenance metadata, social media platforms must ask users to declare synthetic content, certain lawful orders must be acted on within three hours instead of 36, and grievance replies are due in seven days instead of 15.[8] Those duties fall on platforms, not on the company that builds an HR model. An Indian firm exporting AI to Europe answers to the EU’s Act for that product, and to India’s IT Rules only where it runs a platform at home. How we did this Figures as of 4 August 2026 Application dates are read from Article 113 of the AI Act, original and as amended, and cross-checked against Gibson Dunn’s alert of 27 May and Sidley Austin’s of 22 June 2026. The omnibus’s status is taken from its own reference: Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July 2026, in force three days later. Gibson Dunn dates the provisional agreement 6 May; some accounts give 7 May. We did not find a primary record of the date of the Council’s final vote, so we give the Regulation’s own date instead. Law firms describe the amended AI-literacy duty in slightly different words; we give the common reading. Month and day gaps are TechBag arithmetic. The provider and deployer lists summarise the articles named in the figure and are not legal advice. India’s IT Rules amendment is described from Business Today’s report of the notification; the Gazette text was not read. Nothing published after 4 August 2026 is used. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Regulation (EU) 2024/1689, the Artificial Intelligence Act: Articles 2, 3, 4, 5, 16, 22, 25, 26, 27, 50, 53, 99, 101, 111 and 113](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) — 13 June 2024, published 12 July 2024 2. [Regulation (EU) 2026/1744, Digital Omnibus on AI, amending Regulations (EU) 2024/1689, 2018/1139 and 2023/1230](https://eur-lex.europa.eu/eli/reg/2026/1744/oj) — 8 July 2026, published 24 July 2026 3. [European Commission, Digital Omnibus on AI Regulation Proposal](https://digital-strategy.ec.europa.eu/en/library/digital-omnibus-ai-regulation-proposal) — 19 November 2025 4. [Gibson Dunn, EU AI Act Omnibus agreement: postponed high-risk deadlines and other key changes](https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/) — 27 May 2026 5. [Sidley Austin, Data Matters: EU lawmakers reach provisional agreement to delay key EU AI Act obligations](https://datamatters.sidley.com/2026/06/22/eu-lawmakers-reach-provisional-agreement-to-delay-key-eu-ai-act-obligations/) — 22 June 2026 6. [MySolution, Omnibus digitale sull'IA: pubblicato il Regolamento UE 2026/1744 che modifica l'AI Act](https://www.mysolution.it/fisco/informazioni/news/2026/07/28/omnibus-digitale-sullia-pubblicato-il-regolamento-ue-20261744-che-modifica-lai-act/) — 28 July 2026 7. [AI Act consolidated text with the omnibus amendments: Annex III, Articles 99 and 113](https://artificialintelligenceact.eu/annex/3/) — text as amended by Regulation (EU) 2026/1744, 24 July 2026 8. [Business Today, Govt tightens rules on AI-generated content, mandates labels and faster takedowns](https://www.businesstoday.in/technology/story/govt-tightens-rules-on-ai-generated-content-mandates-labels-and-faster-takedowns-515505-2026-02-10) — 10 February 2026 9. [Entrepreneur India, India's AI guidelines adopt a softer approach](https://india.entrepreneur.com/news-and-trends/indias-ai-guidelines-adopt-a-softer-approach-but-with/499394) — 10 November 2025 **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [BFSI industry guide](https://www.thetechbag.com/industries/bfsi) — the Indian regulators a lender answers to at home - [Keka HR](https://www.thetechbag.com/keka/keka-hr) — an Indian HR suite, the category where hiring AI is sold - [Trellix AI Data Security](https://www.thetechbag.com/trellix/trellix-ai-data-security) — see which AI tools staff already use before you classify them