Most conversations about AI focus on what the technology can do. A quieter question matters just as much for anyone building, buying, or simply using these tools: what are the rules?
In the European Union, that answer changed this summer. A package known as the Digital Omnibus on AI amended the EU’s landmark AI Act, and headlines mostly said “delay.” That is true for one important category of systems. It is badly misleading for the rest.
This article sorts out what moved, what didn’t, what is still coming this year, and what it means whether you run a business, build products, or just want to know what protections to expect as an AI user.
What the AI Act is, in one paragraph
The AI Act (formally Regulation (EU) 2024/1689) is the EU’s risk-based law for artificial intelligence. It bans a short list of practices, imposes strict duties on “high-risk” systems, adds transparency rules for things like chatbots and synthetic media, and sets separate obligations for providers of general-purpose AI models. It entered into force on 1 August 2024 and has been phasing in since. Because it applies to systems placed on the EU market, companies outside Europe pay close attention too.
What actually changed in July
The Digital Omnibus on AI was published in the Official Journal of the EU on 24 July 2026 and entered into force on 27 July 2026, the first formal set of amendments to the AI Act since its adoption in June 2024. The European Commission had proposed it on 19 November 2025, and the Council gave final approval on 29 June 2026. the digital omnibus on ai enters into force today 102nedo +2
The headline change concerns high-risk systems. Under the original schedule, standalone high-risk obligations were due from 2 August 2026. Those for Annex III uses are now pushed to 2 December 2027, while high-risk AI embedded in regulated products (Annex I) moves from 2 August 2027 to 2 August 2028. Annex III covers sensitive uses, and includes AI used in education and employment, the kind of systems that rank job candidates or assess students. pasqualepillittericasrai
The reasoning given for the delay was practical: the Commission described the package as targeted simplification meant to make implementation smooth and proportionate, and the supporting standards and guidance for high-risk compliance were not ready. cooley
What was not delayed
This is the part that gets lost in the headlines. Several law firms that have analyzed the amendment make the same warning: it is not a general pause on AI regulation. One summary stresses that the rules for general-purpose AI models continue to apply as planned, and those duties have applied since 2 August 2025. mondaqcasrai
Transparency rules also stayed on schedule. According to one legal analysis, the Article 50 duties, including telling people when they are dealing with an AI system and labeling deepfakes, remain on the 2 August 2026 timetable. Another firm notes these apply to all in-scope AI systems regardless of when they were first placed on the market. cooleyeaccny
There is one grace period inside that. Providers of generative AI systems that were already on the market before 2 August 2026 have until 2 December 2026 to meet the obligation to mark AI-generated content. cuatrecasas
Here is how it looks at a glance:
| Obligation | Original date | Where it stands now |
|---|---|---|
| General-purpose AI model duties | 2 Aug 2025 | Unchanged |
| Transparency (chatbot disclosure, deepfake labeling) | 2 Aug 2026 | Unchanged, with content-marking grace to 2 Dec 2026 for existing generative systems |
| High-risk systems, Annex III uses | 2 Aug 2026 | 2 Dec 2027 |
| High-risk systems, Annex I products | 2 Aug 2027 | 2 Aug 2028 |
| New bans on certain intimate-imagery and abuse-material generators | Did not exist | 2 Dec 2026 |
Dates are drawn from law-firm summaries of the final text, so check them against the Official Journal before relying on them.
The tightening that got less attention
While most dates slipped, the amendment also added something. It introduces two new prohibited practices aimed at systems designed to generate or manipulate realistic intimate imagery or child sexual abuse material, applying from 2 December 2026. Commentators note that other laws already address such conduct, but the AI Act will now give regulators a direct basis for enforcement. natlawreview
Oversight is also being centralized. The same analysis says the AI Office now has exclusive supervisory responsibility for certain AI systems built on general-purpose models, and for AI integrated into very large online platforms and search engines. In practice, that means the biggest AI products will answer to a single EU-level body rather than 27 national regulators. natlawreview
The criticism
Not everyone sees the delay as sensible housekeeping. Civil-society and digital-rights groups argue that deferring high-risk obligations by more than a year leaves people exposed to consequential automated decisions, in areas like hiring and education, without the impact assessments, human oversight, and transparency the Act was designed to guarantee. casrai
That is a fair concern. The counterargument is that rules companies cannot yet comply with, because technical standards are missing, are hard to enforce well. Both can be true at once, and which one matters more depends on whether you are the company trying to comply or the applicant whose CV is being screened.
What this means for different readers
If you run or work at a business using AI tools. Treat December 2027 as a planning horizon, not a reprieve. One law firm advises that organizations should keep mapping their AI use cases, assessing which requirements apply, tracking guidance and harmonized standards, and planning for the relevant dates. A sensible first step is simply a list of every AI system in use, what it decides, and who is affected. Hiring, grading, and credit-style decisions deserve the most attention. cms
If you build or sell AI products. The transparency duties are already live. Chatbots should make clear they are AI, and synthetic content should be labeled according to the rules. If you provide a general-purpose model, the model-level obligations are already in force.
If you are a regular user. You should increasingly see disclosure and labeling on AI interactions and AI-generated media in the EU. The stronger protections for automated decisions about you, such as in recruitment, are the part pushed furthest into the future.
If you are outside Europe. The Act matters indirectly. Global companies often apply one set of product rules everywhere rather than maintain separate versions, so EU requirements can shape the tools you use, though this is a tendency, not a guarantee.
What to watch next
Three things are worth following. The first is 2 December 2026, when the new prohibitions and the content-marking grace period both end. The second is the publication of harmonized standards and Commission guidance for high-risk systems, since the delay was justified partly by their absence. The third is the wider Digital Omnibus package, because work on broader amendments to EU digital legislation is continuing, so further changes are likely. sidley
Note that this article describes EU rules and is general information, not legal advice. Anyone with real compliance obligations should consult a qualified lawyer.
Frequently Asked Questions
Did the EU delay the whole AI Act?
No. The amendment delays the high-risk system obligations, but general-purpose AI model rules, the transparency duties, and the supervisory structure remain on their existing schedule. Law firms analyzing the change stress that it should not be read as a blanket pause.
When do the high-risk AI rules now apply?
For standalone high-risk uses listed in Annex III, the new date is 2 December 2027. For high-risk AI built into regulated products under Annex I, it is 2 August 2028.
What counts as high-risk AI?
Broadly, systems used in sensitive areas where errors can seriously affect people, such as employment and education, plus AI that is a safety component of regulated products. The exact categories are defined in the Act’s annexes, and guidance on classification is still developing.
Do AI chatbots have to tell me they are AI?
Under the transparency rules that took effect on 2 August 2026, providers must make sure people are informed when they are interacting with an AI system. Deepfake labeling is covered by the same article, with a grace period to 2 December 2026 for marking obligations on generative systems that were already on the market.
Does the AI Act apply to companies outside the EU?
It applies to AI systems placed on the EU market or whose outputs are used in the EU, regardless of where the provider is based. Whether a specific company is in scope depends on its product and customers.
Where can I read the official text?
The Digital Omnibus on AI is Regulation (EU) 2026/1744, published in the Official Journal of the European Union on 24 July 2026. The underlying law is Regulation (EU) 2024/1689. Both are available on EUR-Lex (eur-lex.europa.eu).