Did the EU AI Act get delayed?

Partly. The Digital Omnibus on AI — Regulation (EU) 2026/1744 — was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, six days before the AI Act's original 2 August 2026 deadline. It deferred the high-risk obligations for standalone Annex III systems from 2 August 2026 to 2 December 2027, and for AI embedded in already-regulated products under Annex I to 2 August 2028. It did not delay the Article 50 transparency obligations or the AI literacy duty, both of which took effect on 2 August 2026 as originally scheduled.

Why were the high-risk rules delayed but not the transparency rules?

The high-risk regime depends on infrastructure that was not ready: harmonised technical standards, notified bodies to perform conformity assessments, and national supervisory authorities with the capacity to oversee them. By late 2025 the European Commission judged implementation visibly off track and tabled the Digital Omnibus on 19 November 2025. The Article 50 transparency duties needed none of that scaffolding — they are largely disclosure obligations that a provider can satisfy through product and interface changes, so there was no capacity argument for postponing them.

Does the delay mean the high-risk rules might be cancelled?

There is no indication of that. The Omnibus deferred the dates and adjusted some scope, but the high-risk regime remains in the AI Act with new deadlines of 2 December 2027 and 2 August 2028. Treating a deferral as a repeal is the specific mistake the timeline punishes: organisations that stopped preparing in August 2026 have roughly sixteen months of work to fit into whatever remains of that window.

What penalties apply to the transparency rules now in force?

Non-compliance with Article 50 can trigger fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher. The obligations apply to in-scope systems regardless of when they were placed on the market, with one narrow transitional carve-out: providers of generative AI systems already on the market have until 2 December 2026 to comply with the marking and machine-readable detection requirement.

The EU AI Act Rollout Taught Us Three Things About Regulating AI

On 27 July 2026, six days before the European Union's Artificial Intelligence Act was due to impose its most demanding obligations, a second regulation entered into force and moved the deadline. The Digital Omnibus on AI — Regulation (EU) 2026/1744 — deferred the high-risk rules by sixteen months. It left the transparency rules exactly where they were.

That split is the most informative thing to happen in AI regulation this year. Not the delay itself, which had been signalled since the Commission tabled the proposal in November 2025, but the shape of it: which obligations proved deliverable on schedule and which did not. A regulator postponing half a law is telling you, in public, which half it could not yet enforce.

Three lessons come out of that, and none of them are specific to Europe.

Obligations that need institutions arrive late

The high-risk regime under Annex III — AI used in hiring, credit decisions, education, essential services — was never a pure drafting problem. It requires harmonised technical standards so that "conformity" means something specific. It requires notified bodies with the competence to assess against those standards. It requires national supervisory authorities staffed well enough to oversee the assessors.

By late 2025 none of that was in place at the scale the deadline assumed. The standards work at CEN-CENELEC was running behind, and member states were still constituting their authorities. The Commission's own assessment was that implementation had gone visibly off track, which is what produced the Omnibus.

Standalone Annex III systems now face 2 December 2027. AI embedded in products already regulated under Annex I — medical devices, machinery, aviation — moved further, to 2 August 2028, on the reasoning that those sectors have their own conformity machinery to align with first.

The generalisable point: an obligation that can only be satisfied through a third party is capped by that third party's readiness. Legislators control the deadline. They do not control whether an assessment ecosystem exists to meet it.

Obligations that live in the product arrive on time

Article 50 took effect on 2 August 2026 as written. It requires providers and deployers to disclose, in defined circumstances, that a person is interacting with an AI system, that emotion-recognition or biometric-categorisation is being applied to them, and that particular content was generated or manipulated by AI.

Nothing in that list waits on a notified body. A chatbot disclosure is an interface change. Marking synthetic content is a pipeline change. These are engineering tasks inside a company's own product, which is precisely why they survived a round of deadline-cutting that removed almost everything else.

The enforcement posture matches. Article 50 breaches carry fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher, and the obligations apply to in-scope systems regardless of when they reached the market. The single concession is narrow: providers of generative systems already on the market have until 2 December 2026 to meet the marking and machine-readable detection requirement.

So the rule that actually binds today is the one that could be implemented unilaterally. That is worth remembering the next time a jurisdiction publishes an AI framework — read it for which duties depend on institutions that do not exist yet, and you will have a reasonable forecast of what slips.

A deferral gets misread as a reprieve

The most expensive consequence of the Omnibus has not been regulatory. It has been interpretive.

"AI Act delayed" was an accurate headline for the high-risk regime and a misleading one for everything else, and the compression cost organisations real preparation time. Teams that heard the delay and stood down in August 2026 were standing down from obligations that had just come into force, while relaxing on obligations that still carry a firm date sixteen months out.

Sixteen months sounds generous until you price the work: gap assessments across deployed systems, technical documentation, human-oversight design, post-market monitoring plans. That is not a quarter of effort. Organisations that treated December 2027 as distant in August 2026 will meet it with considerably less room than they expect.

The pattern is familiar from GDPR, where a two-year runway produced a visible scramble in the final six months. Deadlines that move once train people to assume they will move again. Sometimes they do. The Article 50 date did not.

What this predicts

The AI Act's structure is now a natural experiment running in public. One set of obligations is live and enforceable with meaningful penalties. Another sits sixteen months out and depends on standards and institutions still being assembled.

Watch two things. First, whether Article 50 enforcement actually materialises — a rule in force but never applied teaches the market something different from one that produces early cases. Second, whether the standards and notified-body capacity arrive before December 2027, or whether the same capacity argument that produced the first deferral produces a second.

If you want to reason about where AI regulation is heading, that second question is the one to track. The first deferral was justified by institutional unreadiness. Whether that justification is available twice is the real test of the timeline.

For the practical question of what changed for you as someone who uses AI tools daily, that is a separate matter — the disclosure rules now in force are the part of this law most people will actually encounter, and they show up in ordinary products rather than in compliance departments. We cover exactly what you should be seeing, and what the labels do and do not tell you, in what the AI disclosure rules changed for you.