The AI Act Deadline Moved, but August 2026 Duties Did Not

Treating the Digital Omnibus as a general delay is now the most expensive misreading in EU AI regulatory compliance. The deferral of high-risk conformity work to December 2027 and August 2028 is real. Regulation (EU) 2026/1744, published on 24 July 2026 and in force since 27 July 2026, delivered a genuine 16-month runway for Annex III standalone systems and pushed embedded Annex I systems to 2 August 2028. However, the reprieve is narrow. Article 50 labelling, Article 5 prohibitions and GPAI provider duties, binding since August 2025, remain exactly where they were. If your programme treats "high-risk deferred" as "everything moved", you will breach obligations that still ship on 2 August 2026.

This analysis separates what changed from what did not. It maps the three-tier timeline, explains the Article 50 watermarking transition, and shows how to re-sequence conformity documentation properly rather than quickly. You will leave with a concrete 30-day action list.

Treating the Omnibus as a General Delay Is Now the Expensive Mistake

The headline that travelled furthest in mid-2026, "EU delays AI Act high-risk rules", is half true. The narrow scope of the deferral is the subject of the three-tier breakdown below; what matters here is the cost of misreading it.

Most Article 50 transparency and labelling duties still apply from 2 August 2026. The Article 5 prohibitions regime has been in force since February 2025, and GPAI provider obligations, binding since 2 August 2025, become enforceable on that same date, as the Commission's implementation timeline confirms.

The cost is concrete. Teams stand down labelling workstreams, miss the 2 December 2026 watermarking transition for generative systems already on the market at 2 August 2026, and spend the high-risk runway on delay rather than on conformity documentation that still has to exist, held to the same evidential standard as your audit documentation.

The error spreads because most circulating summaries were written from the May 2026 provisional deal. The enacted text narrows, softens and simplifies several provisions, so pre-July briefings are already out of date.

Correct one number at source: the Annex III shift is 16 months, from 2 August 2026 to 2 December 2027. The widely repeated 13-month figure is wrong, and repeating it inside a compliance plan signals which text the author actually read.

What Regulation (EU) 2026/1744 Actually Did

Regulation (EU) 2026/1744 is not a proposal or a provisional deal. It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, six days before the deadline it moved, making it live law for anyone placing AI systems on the EU market.

Its durability has a number attached. The European Parliament approved the agreed text on 16 June 2026 by 423 votes to 57, with 174 abstentions. A margin that wide makes the deferral a settled legislative position rather than a stopgap awaiting reversal.

What moved:

• Annex III standalone high-risk obligations shift from 2 August 2026 to 2 December 2027, a 16-month extension.

• Annex I embedded high-risk systems, the AI safety components inside regulated products, shift from 2 August 2027 to 2 August 2028.

What did not move is the substance. The regulation re-times obligations rather than removing them: risk management records, conformity assessments and technical documentation survive intact with new dates attached. Building that evidence trail requires the same management-system discipline as ISO 27001:2022 documentation, a structured evidence trail assembled before, not after, a deadline. Both tracks now run in parallel, which is why the timeline needs to sit in one place.

The Three-Tier Timeline, in One Place

The dates above resolve into three manageable tiers. Each row below is drawn from the Commission's implementation timeline rather than from secondary commentary.

Tier 1 is the tier most internal decks have wrongly cleared: Article 50 transparency rules did apply from 2 August 2026, and the bulk of them were never deferred (Morgan Lewis). Tier 2 is a narrow bridge, not a grace period. Tier 3 is the long build.

Use this table as your obligations register spine. A date-keyed register survives leadership changes and reorganisations; a project-phase plan does not.

Tier 1: What Still Has to Ship on 2 August 2026

The timeline table above confirms both dates; this section focuses on what shipping means in practice.

Tier 1 is not a planning horizon. It is the live set: everything already binding or becoming binding on 2 August 2026, none of it re-timed by the omnibus.

Most Article 50 transparency duties apply from 2 August 2026: telling people they are interacting with an AI system, and marking AI-generated content in a machine-readable format. The published implementation timeline lists Article 50 and GPAI enforcement from 2 August 2026, so the date is checkable against a source other than vendor commentary.

The practical read is blunt. If you ship a conversational agent, a generative feature or a deepfake-capable tool into the EU, 2 August 2026 is a real compliance date. Treat 3 August 2026 as the first day you could be asked to evidence it, so disclosure copy, provenance method and supplier declarations should exist before the date, not after.

What did move is a checkpoint, not a reprieve.

Tier 2: The 2 December 2026 Transitional Checkpoint

Not every obligation on that date landed cleanly. Article 50(2), the machine-readable marking of synthetic content, carries a transition rather than a clean start: for generative systems already on the EU market at 2 August 2026, the duty applies from 2 December 2026 (Article 50 transparency rules).

Two conditions matter. First, the exception is not a general grace period. A provider that places a generative system on the market on or after 2 August 2026 gets no transition at all; Article 50(2) bites on day one. Second, the transition is contingent on a factual claim about market placement, which means the placement date becomes an evidential asset rather than an administrative detail.

The same checkpoint carries a new prohibition. Non-consensual sexual deepfakes and child sexual abuse material (CSAM) fall inside Article 5 from 2 December 2026, extending the prohibited-practice perimeter rather than replacing it.

Treat 2 December 2026 as a checkpoint with a named owner and defined evidence, not a footnote. It falls close enough to year-end planning that it can be absorbed into a quarter and then forgotten.

Start collecting release records and version histories now. Without a defensible placement date you cannot claim the exception and you cannot answer a regulator's first question.

Tier 3: High-Risk Conformity, Deferred to 2027 and 2028

Beyond that checkpoint, the deferral proper begins. Annex III standalone high-risk obligations now apply from 2 December 2027, 16 months after the original date of 2 August 2026. Annex I embedded high-risk systems, typically AI safety components inside regulated products such as machinery, move from 2 August 2027 to 2 August 2028.

Crucially, the deferral changes dates, not deliverables. Conformity assessment, technical documentation and EU database registration remain confirmed requirements; quality management, logging, human oversight design and post-market monitoring are expected under the Act and should be verified against Articles 9–15 before finalising the workplan. Nothing substantive was struck; the same evidence a regulator would have demanded in 2026 will be demanded in 2027 and 2028.

That runway is long enough to build documentation properly and short enough to waste. The gap is one year and four months, which is sufficient for genuine conformity work and insufficient for a programme that only starts in the final quarter.

Two readiness signals deserve monitoring ahead of 2 December 2027: the availability of harmonised standards and the capacity of notified bodies. Both were cited as reasons the original date was unworkable, and neither is yet settled. If either slips again, the date moves again, so track them rather than assuming the runway is fixed.

Why the EU Deferred: A Reprieve, Not a Repeal

The readiness signals just outlined are why the deferral exists. The stated rationale was capacity, not policy reversal: conformity-assessment infrastructure, notified bodies included, had not matured enough to make 2 August 2026 workable for high-risk conformity.

That makes the honest reading a reprieve, not a repeal. The obligations were re-timed, not withdrawn. The core risk framework was not reopened, and the substantive duties for in-scope Annex I and Annex III systems survive with new dates attached.

The constraint on your programme follows: the availability of conformity assessment routes. Documentation prepared against the enacted dates is the work that cannot start too early.

Treat the deferral as the Union aligning obligations with the infrastructure needed to satisfy them. That signals sequencing priorities and delivery capacity, not doubt about whether the rules will arrive. Planning on a further extension would be a bet, not a strategy.

May Provisional Deal vs Final Text: What Actually Changed

That reprieve was agreed at provisional stage, and the enacted regulation does not reproduce the deal line for line. If your internal briefing was drafted between May and the end of July 2026, it describes an agreement, not the law. The final text of Regulation (EU) 2026/1744 differs from the May provisional deal in ways that change compliance decisions.

Machinery-embedded AI. High-risk scope was narrowed for AI embedded in machinery and regulated products. Some Annex I integrations captured by the provisional text may now sit outside high-risk treatment altogether, which changes whether conformity work is needed at all.

AI literacy. The mandate was softened relative to the provisionally agreed version, lowering the enforcement exposure attached to training and competence expectations. Documented literacy programmes remain good practice, but the compliance pressure around them is lighter.

AI Office supervisory reach. The AI Office gained expanded supervisory powers, moving some practical oversight away from purely national channels.

Registration. Self-assessed systems still register, but through a simplified procedure rather than removal.

Reconciling your register against the enacted text is the first step; the next is knowing which duties were never re-timed at all.

Article 50 Transparency and Labelling: The Work That Did Not Move

Where the final text narrowed and simplified, Article 50 was left substantially intact. It applies from 2 August 2026 and binds providers and deployers alike, so a business running a conversational assistant on a third-party model carries the duty as well as the business that built it.

The core duties are two: tell people they are interacting with an AI system; and mark synthetic content in a machine-readable format. A third duty, disclosing deepfakes and AI-generated text published on matters of public interest, is pending confirmation against the Article 50 text on EUR-Lex. Disclosure is conditional, not universal: it turns on who you are, what was produced, the purpose of publication and the degree of human control.

The only carve-out is Article 50(2): systems already on the EU market at 2 August 2026 get until 2 December 2026 to comply with marking.

Shipping means revised user-facing disclosures, content provenance signals and documentation deployers can pass to customers and auditors. Teams slip because labelling is treated as late-stage product polish rather than a compliance artefact. The evidence trail behind how automation is reshaping the certification process still needs decision records, named owners and proof of go-live.

Article 5, by contrast, stayed put and grew.

Article 5 Prohibitions: Retained, Extended and Enforced

Transparency and prohibition duties share a trait: both were already live or about to become live, and neither waits for the high-risk runway. The Article 5 prohibitions regime has been in force since February 2025, and the omnibus did not defer it, so prohibited-practice screening should already sit inside use-case intake and model procurement review, not in a future workstream.

What changed is the perimeter. The omnibus added a prohibition on non-consensual sexual deepfakes and child sexual abuse material (CSAM), applying from 2 December 2026. It closes gaps that became visible only after the original prohibitions took effect.

Your intake form may not ask the right questions. Recommended practice: refresh screening explicitly for synthetic sexual content and any capability to generate material involving minors.

As noted at Tier 2, this checkpoint belongs on the same calendar row as the Article 50(2) watermarking transition.

GPAI Provider Duties Have Been Binding Since August 2025

One regime predates every other date in this article.

Under Article 53, providers must keep updated technical documentation, give technical details to downstream integrators, hold a copyright compliance policy, and publish a training content summary using the AI Office template. Open-source models without systemic risk get partial exemptions. Systemic-risk models, presumed above 10^25 FLOPs of training compute, also face standardised evaluations, adversarial testing, mitigation and incident reporting.

Enforcement powers begin on 2 August 2026, with penalties up to €15 million or 3% of worldwide turnover. The duty already binds; enforcement turns it imminent. Commission guidelines remain interpretive rather than binding, and the AI Office has favoured cooperative engagement until that date, but neither weakens the obligation.

Building on a third-party GPAI model does not transfer the provider's duties to you, and it does not remove your own Article 50 or high-risk obligations downstream. Hold the 2 August 2026 line here as firmly as you hold it for transparency.

Worked Example: Legacy Systems vs Systems Placed After August 2026

Scenario A: a legacy generative system

Take a provider whose generative image tool was already on the EU market before 2 August 2026. Article 50(2) marking of synthetic output applies from 2 December 2026. Real relief, but only four months of it.

Scenario B: placed on or after 2 August 2026

The same provider places a new generative system on the market on or after 2 August 2026. Article 50(2) applies immediately. No transition. Same provider, same capability, different date, different obligation start.

Scenario C: deployer running on a third-party model

A deployer running a conversational assistant over a third-party model may own Article 50 disclosure duties in its own right from 2 August 2026; role-specific applicability should be confirmed with legal counsel. Downstream use does not inherit upstream compliance.

The hinge is documentation

What changes between these scenarios is not the substance of the duty, but the date and the burden of proof. The transition is conditional on a market placement date, so that date becomes a documented fact rather than an assumed one.

The following records are recommended practice, not a legally prescribed list. Keep four records for every generative system: market placement date, version history, the marking or provenance method used, and supplier declarations. Without them you cannot claim the transition, and you cannot answer a regulator's first question.

That documentation, not the deferral, is what makes the later dates workable.

How to Re-Sequence the High-Risk Runway

The record-keeping discipline protecting your Article 50(2) transition is the same discipline the deferred track needs. Note the distinction: the sources establish dates, not a workplan. What follows is recommended sequencing practice, not legal advice.

Hold the 2 August 2026 line. Article 50 transparency, Article 5 prohibitions and GPAI enforcement did not move. Do not redeploy the people who own transparency and prohibition compliance onto Annex III documentation; they remain on the critical path.

Treat 2 December 2026 as a checkpoint, not a footnote. Name an owner for each item, the Article 50(2) legacy watermarking transition and the new deepfake and CSAM prohibition, and define the evidence you will hold before that date.

Spend the Annex III runway properly. The sixteen months to 2 December 2027 should produce conformity artefacts, not slides: risk management records, technical documentation, data governance evidence, human oversight design and post-market monitoring plans. Keep them retrievable, because 2027 evidence only counts if a regulator can still find it.

Do not parallelise everything. Pick a small number of in-scope Annex III use cases and finish their documentation. Unfinished conformity work is worth nothing on 2 December 2027; three completed files beat ten half-built ones.

What This Means for Your AI Regulatory Compliance Programme

Sequencing only holds if the underlying plan is built on the enacted text. Re-baseline your AI regulatory compliance plan against Regulation (EU) 2026/1744 itself, not a May 2026 summary of the provisional deal. Any board paper written from provisional text describes a narrower high-risk scope, a softened AI literacy mandate and simplified registration that are not the law now in force. Correct the record before the plan is endorsed.

Four adjustments do most of the work:

• Key the register to dates, not phases. An obligations register built on legal dates cannot let deferred items inherit the urgency of live ones, or the reverse.

• Name owners by tier. One for 2 August 2026, one for 2 December 2026, and one for the combined 2 December 2027 and 2 August 2028 high-risk track.

• Work evidence-first. Ask what you could hand a regulator on 3 August 2026, not what your roadmap promises by December.

• Reuse existing controls. Much of the data governance, logging and documentation evidence overlaps with GDPR, ISO 27001 and comparable frameworks, so map AI Act duties onto controls you already operate rather than building parallel ones.

Where the same artefact satisfies two regimes, say so in the register.

Where Compliance Tooling Fits, and Where It Does Not

Mapping AI Act controls onto frameworks you already maintain is largely a register question, and register work is what tooling does well.

This section is product context, not regulatory guidance. Nothing here changes what the AI Act requires of you.

DataDoc is an AI-powered compliance automation platform that covers a broad range of frameworks, including GDPR, ISO 27001, SOC 2, CCPA and NIST, which makes it relevant where AI Act work sits alongside existing certification programmes. Teams evaluating AI compliance software for deadline tracking should test the platform's framework coverage against their own obligations list rather than accept vendor descriptions at face value.

A free trial is available. That is enough time to check whether your AI obligations register maps cleanly onto the platform's framework structure.

Set expectations honestly. Software tracks obligations, evidence and deadlines. It cannot tell you whether Article 50 applies to a specific system, and it does not replace the judgement call on whether a use case falls inside a prohibition. Those remain human decisions with named owners, which is precisely why the dates above need sequencing before any platform is selected.

Ready to automate your compliance?

Your Next 30 Days: Dates to Diarise and Actions to Take

Tooling tracks obligations; the dates below still need named owners.

The four dates from the three-tier table, 2 August 2026, 2 December 2026, 2 December 2027 and 2 August 2028, each need a named owner on your calendar now.

Then inventory. List every generative and conversational system you run, record the date each was placed on the market, and flag which qualify only for the Article 50(2) transition. That date is the hinge the exception turns on, so treat it as a documented fact rather than an estimate.

Freeze the Annex III plan at 2 December 2027 milestones and measure success by finished documentation, not started workstreams.

Finally, keep the two tracks visibly separate in your AI regulatory compliance reporting. The 2026 duties are about shipping; the deferred high-risk track is about building evidence a regulator will accept in 2027 and 2028. Merge them into one status report and you will bury the deadline that arrives first.

Conclusion

Your next step is simple: inventory every generative and conversational system, document the date each was placed on the market, and assign a named owner to each date in the tier table. That sequencing turns a moving deadline into a managed programme.