EU AI Act August 2026: What Is Actually Delayed, and What Isn't

A Deadline That Moved, Not Disappeared

For most of 2025 and early 2026, 2 August 2026 was the date every EU AI Act compliance tracker pointed to for the heaviest obligations in the regulation: the detailed conformity assessments, technical documentation and human oversight requirements that apply to high risk AI systems. By the time that date actually arrived, it had effectively split in two, and a lot of the confusion we have seen among business readers comes down to not knowing which half applies to them.

The short version is that the EU adopted a Digital Omnibus on AI that pushed back the compliance timeline for high risk systems, but it did not touch everything tied to the August 2026 date. Some obligations stayed exactly where they were. Others moved to December 2027. Others moved again, to August 2028, depending on what kind of AI system is involved. Treating this as one single delayed deadline, which is how a lot of coverage still frames it, is the first mistake worth avoiding.

What Is Already In Force, Delay Or No Delay

Three sets of obligations under the Act were not touched by the omnibus and are live now, regardless of the high risk timeline.

The prohibited practices under Article 5, covering things like manipulative or subliminal techniques and social scoring, have applied since 2 February 2025. These carry the Act's highest penalties, up to EUR35 million or 7% of global annual turnover, whichever is higher, and nothing in the delay touches them.

Obligations on providers of general purpose AI models under Articles 51 to 56 have applied since 2 August 2025. If your organisation builds or fine tunes a general purpose model, that clock has already been running for over a year.

Transparency duties under Article 50, including labelling AI generated content and disclosing when someone is interacting with an AI system, took effect on schedule on 2 August 2026. These apply based on what a system does, not on which risk tier it falls into, so a tool that would never be classed as high risk can still trigger them.

What Has Been Pushed Back, and Why the Date Keeps Moving

The obligations that did move sit in two different places in the Act's annexes, and they did not move to the same date. Standalone high risk systems under Annex III, the category covering things like CV screening tools and credit scoring systems, had their compliance date moved from 2 August 2026 to 2 December 2027.

AI that is embedded inside a product already regulated under other EU safety law, such as machinery or medical devices, falls under Annex I. That category's date moved further out, to 2 August 2028. A separate classification duty under Article 6(1), which helps determine whether a system counts as high risk in the first place, is tied to an August 2027 date in some reporting, which adds another layer to track.

Here is where we would urge genuine caution rather than false confidence. Reporting written before the Council of the EU gave its final approval, in the first half of 2026, understandably described this delay as a Parliament vote still awaiting sign off, with dates that were provisional. Reporting written after the enacting regulation was published in the Official Journal in late July 2026 describes the same dates as settled law. If the source you are working from predates that final step, or does not say which step it predates, treat its dates as directional rather than exact, and confirm the Annex I and Annex III dates against the enacted text or your own legal counsel before you rely on either one in a contract, an audit, or a board paper.

What This Means If You Are Running or Buying AI Systems

Do not relax just because the deadline moved. The obligations that were never delayed are not minor ones. Prohibited practices under Article 5 have carried the Act's steepest fines since February 2025, and general purpose model obligations have applied for over a year. A system that was never going to be classed as high risk can still be caught by the Article 50 transparency duties that took effect on schedule.

Work out which Annex your system actually sits in before you assume which date applies to you. Standalone high risk software under Annex III now has until December 2027 for the detailed obligations. AI embedded in a product already regulated under separate EU safety law, under Annex I, has until August 2028. These are not interchangeable, and a compliance plan built on the wrong one will be wrong by more than a year.

Check when your system went to market. The Act is not retroactive, and some of the obligations are written to apply to systems placed on the market after a given date, so a system already in commercial use before 2 August 2026 may sit under different transitional rules than one you are launching now. That nuance is easy to miss if you are only reading headline summaries.

None of this is limited to companies headquartered in the EU. If your AI system's output is used by people in the EU, or you supply a component that ends up inside an EU regulated product, the Act's reach follows the deployment, not your registered address. Treating this as someone else's regulatory problem because your head office is in the UK or the US is a common and avoidable mistake.

We see a version of this problem constantly in our own work on AI Readiness assessments. Before any organisation deploys a new AI system, one of the hardest questions to answer honestly is also the most basic one: what historic data is this system actually permitted to touch, and who signed off on that. Many organisations we assess cannot answer that cleanly, because data was never classified or permissioned in the first place, long before any EU AI Act obligation entered the picture. Whatever happens to the specific compliance dates above, that classification work, knowing what an AI system is authorised to see and keeping a record of who approved it, is the groundwork that any high risk assessment under the Act will eventually require anyway.

The Practical Takeaway

Treat 2 August 2026 as the date that applied to obligations which were never delayed, Article 5, Article 50 and the general purpose AI rules, rather than as the Act's single deadline. Build your own tracker tied to actual article and annex numbers rather than to a single article's headline date, note which of your systems falls under Annex I versus Annex III, and revisit it once more EU guidance and delegated acts are published, since the Commission has retained the power to add detail to several of these provisions later.

Sources

• Cloud Security Alliance, 'CSA Research Note: EU AI Act High Risk Deadline and the Digital Omnibus', labs.cloudsecurityalliance.org (1 August 2026).
• Holland & Knight, 'US Companies Face EU AI Act's Possible August 2026 Compliance Deadline', hklaw.com (April 2026).