On 29 June 2026 the Council of the European Union gave final approval to the Digital Omnibus, moving the high-risk obligations of the AI Act from 2 August 2026 to 2 December 2027. A great many compliance programmes quietly went back to sleep that week. That was the wrong reading. The deadline that moved is not the deadline most companies were actually going to fail.
What moved, and what did not
| Obligation | Original date | Status now |
|---|---|---|
| Annex III high-risk systems — provider duties (Art. 9–17) and deployer duties (Art. 26) | 2 Aug 2026 | Deferred to 2 Dec 2027 |
| Annex I product-embedded high-risk systems | 2 Aug 2027 | Deferred to 2 Aug 2028 |
| Article 50 transparency — disclose that a user is interacting with an AI system; label AI-generated content | 2 Aug 2026 | Unchanged |
| Prohibited practices and AI literacy duties | 2 Feb 2025 | Already in force |
| General-purpose AI model obligations | 2 Aug 2025 | Already in force |
Read that table again with a commercial eye. The obligations that were deferred are the heavy, documentation-led ones that mostly bind a specific and relatively small set of Annex III use cases. The obligation that did not move is the one that touches nearly every company that has shipped a chatbot, a generated-content pipeline or a voice agent in the last two years.
Article 50 is the deadline you actually have
Article 50 is short, which is part of why it gets underestimated. In substance it requires four things.
- Disclosure of interaction. A person interacting with an AI system must be told, unless it is obvious from context. “Obvious from context” is doing less work than most product teams assume — a support widget branded with your logo and a human first name is not obvious.
- Labelling of synthetic content. AI-generated or manipulated audio, image, video and text must be marked in a machine-readable way. Machine-readable, not a footer disclaimer.
- Deepfake disclosure. Content that resembles real people, places or events must be identified as artificially generated.
- Emotion recognition and biometric categorisation notice. Where deployed, subjects must be informed.
None of that requires a conformity assessment or a notified body. All of it requires you to know, definitively, every surface on which your organisation puts model output in front of a human. In practice that inventory is the hard part, and it is the part nobody has done.
The extraterritorial trap
The AI Act mirrors GDPR’s reach. It applies to any organisation, wherever established, whose AI systems are used inside the EU or whose outputs affect people in the EU. A US or Israeli company with no EU entity, no EU data centre and a marketing site that converts EU visitors is inside scope for Article 50 the moment its chatbot answers one of them.
This is the failure mode we see most often: legal has correctly scoped the high-risk analysis and concluded “we are not Annex III”, and then nobody carries that conclusion forward to the transparency obligations, which have a completely different trigger.
What to do in the next twelve months
1. Build the AI surface inventory
One row per place where a model touches a human or produces content that reaches one. Columns: surface, model, is the user told, is output labelled, who owns it, does it fall in Annex III. Most organisations discover between two and five times more surfaces than the executive team believed existed — a marketing team’s generated blog imagery, a recruiter’s screening assistant, a support macro generator nobody registered as AI.
2. Fix disclosure at the component level, not the page level
Disclosure that lives in a privacy policy does not satisfy the requirement and does not survive an audit. It belongs in the interface, at the point of interaction, in the language of the interaction. Build it once as a component and it stops being a per-launch decision.
3. Make labelling machine-readable
C2PA content credentials for image and video, and provenance metadata for generated text where your CMS supports it. The requirement explicitly contemplates machine detectability. A visible caption is good practice and insufficient on its own.
4. Use the deferral, do not bank it
If any of your systems genuinely fall in Annex III — credit scoring, employment and worker management, access to essential services, education, biometric identification — December 2027 is not generous. Risk management systems, data governance, technical documentation, logging, human oversight and accuracy testing under Articles 9 to 17 are a multi-quarter build for most organisations, and the Cloud Security Alliance’s readiness research found the gap between stated intent and shipped controls to be wide even among firms that had budgeted for it.
5. Write the agent question down before you need the answer
Autonomous agents that act on a user’s behalf sit awkwardly in the Act’s architecture, which was drafted around systems that produce outputs rather than take actions. If you are deploying agents that transact, schedule or communicate externally, the defensible position today is documented human oversight and scoped authority — the same controls described in agent permissions and boundaries and where to place the approval point. Those controls are good engineering regardless of how the regulatory reading settles.
The strategic read
Regulatory deferrals are usually treated as a gift of time and spent as a gift of attention — the programme stops, the working group disbands, and the institutional knowledge evaporates. The Digital Omnibus did not reduce the total obligation; it re-sequenced it, and left the most broadly applicable piece exactly where it was.
The organisations that will handle this well are the ones that treat the inventory as an operating asset rather than a compliance artefact. Knowing every surface where a model speaks to a customer is useful for quality, for cost control, for incident response and for the next regulation, which will not be the last one.
Frequently asked questions
Has the EU AI Act been delayed?
Partially. The Digital Omnibus, approved by the Council on 29 June 2026, deferred Annex III high-risk obligations from 2 August 2026 to 2 December 2027, and Annex I product-embedded systems to 2 August 2028. Article 50 transparency obligations remain on 2 August 2026, and prohibited practices and general-purpose AI model obligations are already in force.
Does the AI Act apply to a company outside the EU?
Yes, where the AI system is used in the EU or its output affects people in the EU. The extraterritorial construction closely mirrors GDPR, so a company with no EU establishment can still be in scope.
Is a disclaimer in the privacy policy enough for Article 50?
No. Disclosure must reach the person at the point of interaction, and synthetic content must be marked in a machine-readable form. A policy page satisfies neither requirement.
We are not high-risk. Is there anything to do before August 2026?
Almost certainly yes. Build the inventory of AI-facing surfaces, add interaction disclosure to each one, and implement machine-readable labelling for generated media. That work is independent of Annex III classification.