The EU AI Act After the Digital Omnibus: What Actually Applies from 2 August 2026

On paper, 2 August 2026 was the AI Act's general application date — the day the high-risk regime, the transparency rules and the penalty framework all became enforceable at once. Then, five weeks before the deadline, the EU rewrote the timetable. The Digital Omnibus on AI was endorsed by the European Parliament on 16 June 2026 by 423 votes to 57 according to the Parliament's plenary record, given final approval by the Council of the EU on 29 June, and published in the Official Journal as Regulation (EU) 1744/2026, becoming applicable on 27 July 2026 — six days before the deadline it amended.

The result is a compliance picture that is easy to misread in both directions. Some teams believe everything moved and have stood down programmes that are still legally required this month. Others are still working to the old timetable and burning budget on obligations that are now sixteen months away. Both mistakes are expensive. Here is the position as it stands, and what an engineering organisation should do with it.

What the omnibus actually moved

Standalone high-risk systems gained sixteen months. Systems in Annex III — recruitment and CV screening, credit scoring, biometric identification, critical infrastructure management, education, access to essential services — were due to meet the provider obligations in Articles 9 to 17 and the deployer obligations in Article 26 from 2 August 2026. Under the amended regulation, that date is now 2 December 2027.

High-risk AI embedded in regulated products gained twelve months. AI that forms part of products already covered by EU product legislation under Annex I — medical devices, machinery, vehicles — moved from August 2027 to 2 August 2028.

Machine-readable marking of synthetic content moved four months. Article 50(2), which requires providers of generative systems to mark synthetic audio, image, video and text output in machine-readable form, was postponed to 2 December 2026. Four months is not long to build a content provenance pipeline, which is why this one deserves attention now rather than in November.

What did not move

User-facing transparency applies now. The rest of Article 50 took effect on 2 August 2026 as originally scheduled. If a person is interacting with an AI system — a chatbot, a voice agent, an autonomous service agent — they must be told, unless it is obvious from context. Deployers of emotion recognition or biometric categorisation systems must inform the people exposed to them. Deepfakes must be disclosed. And there is no ambiguity defence available: the European Commission adopted its final Guidelines on the Article 50 transparency obligations on 20 July 2026, less than a fortnight before the rules began to bite.

The penalty regime is live. Article 99 of the AI Act sets fines of up to €35 million or 7 per cent of worldwide turnover for prohibited practices, and up to €15 million or 3 per cent for most other infringements. The prohibitions and AI literacy duties have applied since February 2025, and the general-purpose AI model obligations since August 2025 — but 2 August 2026 is when member state authorities gained the full enforcement powers to act on all of it. Rules that existed without a penalty mechanism now have one.

The scope did not shrink. The Act applies where an AI system's output is used in the EU, regardless of where the provider or deployer sits. A Gulf-headquartered group whose credit model scores applicants in Frankfurt, or whose service agent talks to customers in Paris, is inside the regime. The omnibus changed dates, not reach.

Why the deferral is not a holiday

December 2027 is closer than it looks for the systems that matter. The deferred obligations are not paperwork; they are systems engineering. Articles 9 to 17 require a risk management system that runs across the lifecycle, data governance for training and testing sets, technical documentation, automatic event logging, meaningful human oversight, and demonstrated accuracy and robustness. Read as a specification, that is a logging architecture, an evaluation programme and an operational design — the kind of thing that is cheap to build in from the first commit and punishingly expensive to retrofit into a production system eighteen months old.

Classification does not pause. An agent that screens CVs is an Annex III system today, whether or not its obligations have started to apply. The single most useful artefact a CTO can commission this quarter is a register of every AI system in the estate, what each one decides, who it affects and where its output lands. That register is the input to everything else, and it also surfaces the systems that are quietly closer to high-risk than anyone had admitted.

The politics can tighten again. The omnibus passed with 174 abstentions in Parliament according to the plenary record, against sustained criticism from civil society groups who regard the deferral as a concession too far. A change of political weather, or a well-publicised harm, could shorten the runway. Treat the sixteen months as slack in the schedule, not scope removed from the project.

The engineering reading

Transparency is an architecture property, not a banner. Meeting Article 50 properly means a disclosure surface at every point where a human meets the system — including the awkward ones, like an autonomous agent that telephones a supplier or drafts an email in a person's name. Teams building agentic systems should decide now how an agent identifies itself when it acts, because bolting identification onto a fleet of deployed agents later is miserable work.

Logging is the cheapest obligation to meet early and the most expensive to retrofit. Decision logs, tool-call traces and retrieval provenance are the raw material for the record-keeping duties arriving in December 2027, and they are also simply good engineering: the same traces that satisfy an auditor are the ones your own team needs when an agent misbehaves at 2am.

Evaluation is where compliance and quality converge. The accuracy and robustness duties in the deferred regime presuppose that you can measure how often the system is wrong, on cases that resemble production. A curated evaluation set with agreed correct outcomes answers the regulator and the CTO with the same artefact. If you build one thing during the deferral window, build that.

A checklist for this month

Three actions fit inside August. First, walk every customer-facing AI touchpoint and confirm a disclosure exists where Article 50 requires one — chat interfaces, voice channels, and any agent that composes messages sent under a human's name. The Commission's July guidelines are the reference document, and they are more specific about what counts as adequate disclosure than most teams expect.

Second, if you operate a generative system whose output leaves your organisation, put the December 2026 marking deadline for synthetic content on the engineering roadmap now, with an owner. Watermarking and provenance metadata are pipeline changes, not toggles.

Third, brief the board accurately. The message that survives scrutiny is not that the AI Act was delayed; it is that the transparency and penalty regime arrived on schedule, the heavy obligations arrive in December 2027, and the organisation's classification register determines which of them apply.

Where Masarrati fits

We build agentic and retrieval systems for enterprises in the Gulf and Europe, and we treat regulatory artefacts as part of delivery rather than paperwork bolted on afterwards. Our AI agent development engagements ship with decision logging, disclosure surfaces and human-oversight controls designed in from the start; our multi-agent systems work includes orchestration-level audit trails so you can reconstruct which agent did what, and why; and our enterprise RAG builds carry retrieval provenance, so every generated claim can be traced to the passage that grounded it. We build the system and its evidence together, document both, and hand them over — your team operates them, with a register and an evaluation harness they own from day one. If any of the terminology here is unfamiliar, our AI glossary covers it.

If your roadmap includes an AI system that will touch an EU user before December 2027, the cheapest time to design for Articles 9 to 17 is before the first commit. Talk to us about scoping it properly.