The EU AI Omnibus Is in Force: Which AI Act Deadlines Moved—and What Applies from 2 August

The EU AI Omnibus entered into force on 27 July 2026, but that does not mean the entire AI Act has been “put on hold.” The EU moved the application dates for two groups of high-risk systems, while the Article 50 transparency rules still begin applying on 2 August. Businesses, websites, and freelancers now need to separate the obligations that genuinely moved from those that remain on the calendar.

This analysis explains the now-binding Regulation (EU) 2026/1744: which dates changed, who received extra time, and why the narrow transition to 2 December is not a general postponement of Article 50. It is an editorial explanation of regulatory changes, not legal advice for a particular organisation or project.

What happened on 27 July

Regulation 2026/1744 was published in the EU Official Journal on 24 July and entered into force on the third day, 27 July. The Commission calls it the AI Omnibus. It is a targeted amendment to the AI Act, not a replacement for the whole Regulation.

The most visible change concerns the timetable for high-risk AI. Technical documentation, risk-management systems, conformity assessment, and related controls depend on standards, guidance, and functioning compliance infrastructure. The legislature gave two groups more time, but assigned a different date to each.

System group	New application date for the relevant rules	What it covers
High-risk systems under Article 6(2) and Annex III	2 December 2027	Use cases listed in Annex III, including specified applications in employment, education, access to services, and law enforcement.
High-risk systems under Article 6(1) and Annex I	2 August 2028	AI that is a product, or a safety component of a product, covered by the legislation listed in Annex I.

The change moves the application of specified Chapter III sections to these categories. It is not permission to ignore prohibited practices, GPAI rules, data protection, consumer law, contractual requirements, or other applicable cybersecurity duties outside the postponed sections. Before changing a compliance roadmap, an organisation should identify the system’s legal role and the exact AI Act provision involved, rather than relying on a headline that “the AI Act was delayed.”

What still applies from 2 August 2026

The AI Omnibus did not postpone Article 50. Its main transparency rules for particular AI systems and forms of content begin applying on 2 August 2026. They address four distinct situations:

1. Direct AI interaction. People must be informed that they are interacting with an AI system unless that is obvious in the circumstances.
2. Machine-readable marking. The provider of a system generating synthetic text, images, audio, or video must ensure that outputs are marked in a machine-readable format and detectable.
3. Emotion recognition and biometric categorisation. A professional user, or deployer, must inform the people exposed to such a system.
4. Deepfakes and certain public-interest text. For a deepfake, a deployer must provide a clear disclosure; artistic and similar works have a separate limited-manner rule that should not hamper enjoyment of the work. Only AI-generated public-interest text can use the exception for substantive human review or editorial control combined with editorial responsibility.

These duties have different addressees. A website owner using a third-party generator is usually not responsible for engineering the provider’s machine-readable marking, but may have its own visible-disclosure duty for a deepfake or AI-generated text. Our updated Article 50 checklist for websites and small teams explains the roles and scenarios in detail using the Commission’s final Guidelines.

The narrow transition to 2 December—and who can use it

Two dates are often being confused. Providers of synthetic-content-generating systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with the Article 50(2) duty concerning machine-readable marking and detectability.

This is a narrow transitional rule for systems already placed on the market. It does not move:

• the notice that a person is interacting with an AI chat system;
• information about emotion recognition or biometric categorisation;
• visible deepfake disclosures;
• the rule for AI-generated text used to inform the public on matters of public interest.

The Commission also explains that AI-generated or manipulated content generated before 2 August 2026 does not have to be labelled retroactively. Voluntary disclosure may still be useful, but the absence of a retroactive duty should not be extended to new content created after the application date.

Human control means more than a grammar check

The final Article 50 Guidelines matter especially to publishers, businesses, and freelancers. AI-generated public-interest text may fall within the editorial exception where it has undergone a genuine process of human review or editorial control and a natural or legal person holds editorial responsibility for publication.

A superficial spelling or grammar pass is not enough by itself. The practical process should include substantive examination, checking claims, dates, and figures, verifying trustworthy primary sources, correcting mistakes, and assigning a responsible editor. Client work should state who reviews the material and who makes the final decision—an extension of a transparent AI-assisted freelance workflow.

AI literacy was simplified, not removed

The AI Omnibus changed the wording around AI literacy. Providers and deployers still need to take measures that support the literacy of staff and other people operating AI systems on their behalf, but the law no longer asks every organisation to prove the same abstract “sufficient level.”

Training should match the role, experience, context, and risk. A person supervising an internal chatbot, a news editor, an HR team, and a developer of a high-risk system need different knowledge. The Commission’s official AI literacy questions and answers are a better basis for focused internal training than a generic certificate disconnected from the actual work.

What a small business, website, or freelancer should check now

1. Identify your role. For every tool, record whether you are deploying a third-party service or offering a system under your own name.
2. Build two requirement maps. Track potential high-risk use cases separately from the four Article 50 triggers. Moving one timetable does not move the other.
3. Test interfaces before 2 August. An AI chat should identify itself at the start of the interaction; the notice should not live only in terms and conditions.
4. Document editorial control. Define fact-checking, source standards, the responsible editor, and how evidence of the review will be retained.
5. Do not strip provenance without a reason. Keep original files, metadata, and generator information where compatible with security and privacy. Our AI privacy checklist helps prevent unnecessary data from entering that workflow.
6. Ask providers about their transition plan. If a system was already on the market before 2 August, ask how and when the provider will implement Article 50(2); do not assume four extra months remove your website’s separate duties.
7. Update the internal policy. Put roles, approved tools, content review, and responsibility into an AI-use policy for a small business.

The Code and EU icons remain voluntary

The Code of Practice on Transparency of AI-Generated Content is not mandatory legislation. Signatories may use it as one route to demonstrate compliance; other providers and deployers must be able to show that their alternative measures are adequate. The EU icons for AI-generated content are also optional. An icon can make a notice easier to understand, but the icon alone does not establish Article 50 compliance.

The practical test is whether a person receives the required information at the right time, in a clear and accessible form, and whether the organisation has a process and evidence appropriate to its real role.

Bottom line

The AI Omnibus moved the deadlines for two groups of high-risk systems, but it did not postpone Article 50. High-risk teams gained time until 2027 or 2028 depending on the category. The transparency rules apply from 2 August 2026, with a 2 December transition only for providers of pre-existing systems regarding machine-readable marking.

The right response is therefore neither to stop all preparation nor to label everything indiscriminately. Classify the system, identify your role, verify the exact obligation, and document substantive human control wherever the organisation relies on the editorial exception.