For two years, compliance calendars across Europe circled August 2, 2026, as the date the EU AI Act's toughest rules would finally bite. That date arrived Sunday. Part of what was supposed to happen did. A much bigger part didn't, and the gap between those two outcomes has left a lot of published compliance guidance quietly wrong.

The EU AI Act, formally Regulation (EU) 2024/1689, entered into force on August 1, 2024, with obligations rolling out in stages over several years. August 2, 2026 was originally set as the date the Act's high-risk AI system rules, covering everything from hiring algorithms to biometric categorization tools, would become fully enforceable. A late amendment package changed that timeline just weeks before the deadline arrived, but only for part of the law.

A Deadline That Split Into Two Different Deadlines

The mechanism behind the split is a set of amendments called the Digital Omnibus on AI, which the European Commission first proposed on November 19, 2025, as part of a broader simplification effort also touching GDPR, ePrivacy, NIS2, and the EU's Data Act. The European Parliament approved the package on June 16, 2026, the Council gave final adoption on June 29, and it was signed on July 8, awaiting formal publication in the EU's Official Journal.

What the Omnibus actually changed was narrower than the "EU delays AI Act" headlines it generated suggested. High-risk AI system obligations under Annex III, the category covering standalone systems like recruitment tools and credit-scoring algorithms, moved from August 2, 2026 to December 2, 2027, a deferral of roughly sixteen months. AI systems embedded inside already-regulated products, covered under Annex I, got pushed even further, to August 2, 2028. The European Commission's stated reason for the delay was straightforward: the harmonized technical standards that companies need from European standards bodies CEN and CENELEC to actually demonstrate compliance simply weren't ready in time for the original deadline.

What Actually Has to Happen Starting Today

Here's the part that didn't move, and the part that actually matters for the widest range of businesses right now. Article 50 of the AI Act, covering general transparency obligations, remains on its original schedule and became enforceable exactly as planned on August 2, 2026. In practice, that means three specific requirements now apply to any AI system placed on the EU market. Systems that interact directly with people must make clear a person is dealing with a machine, unless that's already obvious from context. AI-generated or manipulated content, including deepfakes and synthetic text, images, audio, and video, must be marked in a way that's identifiable as artificially generated. And systems using emotion recognition or biometric categorization must inform the people being analyzed that this is happening to them.

There's a modest grace period built into the marking requirement specifically. New generative AI systems placed on the market must comply with machine-readable marking starting August 2, 2026, but systems already on the market before that date get until December 2, 2026 to catch up. Content that goes through genuine human editorial review before publication is exempted under a separate provision, Article 50(4), a carve-out clearly aimed at protecting legitimate journalism and publishing workflows from being swept into deepfake-style labeling requirements.

The Rule Nobody Was Expecting

The Digital Omnibus didn't just push deadlines around. It also expanded what counts as prohibited under Article 5 of the Act, adding a new ban on AI systems that generate non-consensual intimate imagery, commonly referred to as nudifier apps, alongside tools that generate child sexual abuse material. That prohibition takes effect December 2, 2026, the same date as the watermarking grace period deadline. The amendments also gave the EU's AI Office broader supervisory authority specifically over vertically integrated AI companies, those that control multiple layers of the AI stack from chips to models to consumer products, a category that increasingly describes several of the largest AI companies operating in Europe.

Penalties for violations remain steep and unchanged by the Omnibus: up to €35 million or 7% of global annual turnover for prohibited practices, and up to €15 million or 3% of turnover for other violations, a category that includes both the high-risk rules being delayed and the transparency rules that just took effect.

Why So Much Compliance Advice Is Now Wrong

The confusion driving this story isn't really about what the law says. It's about timing. Much of the compliance guidance published before July assumed, reasonably given the Act's original structure, that both the high-risk regime and the transparency requirements were converging on the same August 2, 2026 date. Once the Digital Omnibus split those two tracks apart, only weeks before the deadline, that older guidance became misleading for anyone who hadn't specifically tracked the amendment's final terms. Legal and compliance analysts covering the change have been blunt about the practical risk: organizations that treated the entire AI Act as broadly relieved by the Omnibus now have a real compliance gap opening on exactly the date they assumed was safely pushed back.

Who Actually Has to Care About This Today

The reach of Article 50 is genuinely broader than the high-risk rules it's often confused with, because it applies based on what a system does rather than how risky regulators consider it. That sweeps in a much wider set of companies than the handful of frontier AI labs usually associated with EU AI regulation. Generative AI providers, chatbot operators, publishers using AI-assisted content tools, and marketers deploying synthetic media all fall within scope starting now, not in 2027 or 2028.

That's the real story sitting inside this week's deadline. The part of the AI Act that touches the largest number of companies, transparency obligations that require disclosure rather than deep technical compliance infrastructure, is exactly the part that stayed on schedule. The part that would have required the most complex, costly compliance engineering, the full high-risk classification and conformity assessment regime, is the part that got the reprieve. For a regulation frequently described as slow-moving and bureaucratic, that's a notably pragmatic sequencing: enforce the rules companies can actually implement quickly first, and give the harder infrastructure more time to catch up behind it.