The EU AI Act on 2 August 2026: what actually applies

According to the European Commission’s AI Act policy page, the AI Omnibus entered into force on 27 July 2026. The Commission records 2 December 2027 for stand-alone high-risk systems and 2 August 2028 for high-risk systems embedded in regulated products. Transparency requirements apply from 2 August 2026. The distinction matters for a workflow: identify the system category and the organisation’s role before assigning a compliance date.

The version I keep hearing is that the whole thing has been paused. It hasn’t: Article 50 was not postponed. From 2 August 2026, providers of AI systems intended to interact directly with natural persons must ensure those persons are informed unless the interaction is obvious. Providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text must make outputs machine-readable and detectable as artificially generated or manipulated. That marking duty is limited by technical feasibility, the characteristics and limitations of the content, implementation costs and the generally acknowledged state of the art, and it does not apply to standard assistive editing, to systems that do not substantially alter the deployer’s input or its meaning, or to qualifying law-enforcement uses. Deployers must disclose deepfakes and certain public-interest text, subject to the regulation’s scope and exceptions.

What an organisation owes therefore turns on its role and on the output, and not merely on whether AI is in use somewhere in the building. The Commission’s voluntary Code of Practice on marking and labelling, published on 10 June 2026, can support compliance with specified Article 50 duties, though it replaces neither the regulation nor the work of analysing the use case.

Article 50 duties become enforceable on 2 August 2026. Breaches can attract administrative fines of up to 15 million euro or, for undertakings, 3 percent of total worldwide annual turnover, whichever is higher, and SMEs are subject to the lower of those caps. Whether a competent court or some other body imposes the fine depends on national law. There are two December transitions, and both are narrower than a general pause: providers of AI systems, including general-purpose AI systems, that generate synthetic content and were placed on the market before 2 August 2026 have until 2 December 2026 to comply with Article 50(2), and specified prohibitions on provider and deployer practices involving non-consensual intimate material and child sexual abuse material also apply from 2 December 2026.

None of this is the beginning of the AI Act, incidentally. The original Article 5 prohibitions and the AI literacy duty have applied since February 2025, and Chapter V has applied to general-purpose AI models since August 2025, while providers of models placed on the market before 2 August 2025 have until 2 August 2027 to comply. The voluntary GPAI Code of Practice can help providers demonstrate compliance.

For a legal team, the date has passed, and the three moves are now the minimum it should be able to show. First, an inventory of every AI surface that talks to people or publishes outward, including marketing, customer service and product features. Second, a map of each output against the applicable disclosure or marking rule, and against any exception that might apply. Third, a record of whether the organisation acts as provider or deployer for each surface, bearing in mind that offering a vendor tool under your own name may affect that role analysis. The amending regulation buys time for high-risk work and none at all for transparency; the one transparency date still ahead is 2 December 2026, and it covers only synthetic-content systems already on the market before 2 August.

Next: AI citation errors: a verification protocol for legal teams →