Most of the headlines about the EU's "AI Act delay" gave teams the wrong impression. Yes, the heavy compliance regime for high-risk AI has been pushed back by well over a year. But the rules that touch almost every customer-facing AI feature, such as a support chatbot, a voice agent or a tool that generates marketing copy and images, did not move. They have applied since 2 August 2026.
This article sorts out which dates changed, which did not, and what a team building or buying AI features should have done by now. It is a software-delivery view, not legal advice. Have counsel confirm how this applies to your product.
What the Digital Omnibus actually changed
The amending law is Regulation (EU) 2026/1744, known as the Digital Omnibus on AI. It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It amends the original AI Act (Regulation (EU) 2024/1689). The headline changes, as reported consistently by several law firms and checked against the Commission's own timeline:
| Area | Before | After the Omnibus |
|---|---|---|
| High-risk systems in sensitive domains (Annex III: employment, education, biometrics, credit and similar) | 2 August 2026 | 2 December 2027 |
| High-risk AI embedded in regulated products (Annex I) | 2 August 2027 | 2 August 2028 |
| Article 50 transparency duties | 2 August 2026 | Unchanged, 2 August 2026 |
| Machine-readable marking of AI-generated content (Art. 50(2)), for systems already on the market before 2 August 2026 | 2 August 2026 | 2 December 2026 |
| New ban on AI that generates non-consensual intimate imagery or child sexual abuse material | Not in the Act | 2 December 2026 |
Two other changes matter for smaller software companies. The AI literacy duty was softened: providers and deployers must now support the development of AI literacy rather than guarantee a particular level of it. And a new "small mid-cap" category, broadly companies under 750 employees with turnover up to 150 million euros or a balance sheet up to 129 million euros, gets simplified documentation and priority access to regulatory sandboxes. The reasons given for the delay were practical: the harmonised technical standards needed to assess high-risk systems were not ready.
Dates are from Regulation (EU) 2026/1744 as summarised by the Commission and several law firms. Check the Official Journal text for your own case.
The part that did not move: Article 50
Article 50 is the transparency article, and it is the one most product teams will meet first. In plain terms it asks for five things:
- Tell people they are talking to an AI. Providers must design systems that interact directly with people so that users are informed they are dealing with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person.
- Mark synthetic content. Providers of systems that generate synthetic audio, image, video or text must mark the output in a machine-readable format so it is detectable as artificially generated, as far as is technically feasible.
- Notify people exposed to emotion recognition or biometric categorisation. This falls on deployers.
- Label deepfakes. Deployers must disclose that image, audio or video content was artificially generated or manipulated, with a lighter touch for evidently artistic or creative work.
- Disclose AI-written text on matters of public interest, unless a human has reviewed it or holds editorial responsibility.
Disclosures have to be clear and given at the latest at first interaction or exposure. Article 50 violations can carry fines of up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher, with lower caps for SMEs and start-ups. The AI Office also gains exclusive supervision over AI systems built on general-purpose models from the same provider, and over AI integrated into very large online platforms and search engines.
What this means for a support chatbot or voice agent
The first duty is the one that bites most often, and it is more design work than legal work. A disclosure buried in the terms and conditions will not do. Practical guidance from compliance practitioners is to make it visible at the start of every interaction, and to avoid giving a bot a human-sounding name and photo with no clear indication that it is automated. For a voice agent, that means saying so at the start of the call, not on a web page.
Some things to build, and to check in anything you buy:
- A persistent, readable "you're chatting with an AI assistant" label in the widget, plus a first message that says the same.
- A clear route to a human, even where the law does not strictly require one. It is good practice and it protects you when the model gets something wrong.
- Logging of the disclosure being shown, so you can demonstrate it later.
- For voice, an opening line stating that the caller is speaking with an automated assistant.
The second duty, content marking, is where the standards are still unfinished. The Commission is working with a code of practice on AI-generated content and parallel standards work, and a standardised EU label is still in development. If your product generates images, audio, video or published text, you cannot simply wait. Check whether your model provider already embeds provenance metadata or watermarks, and whether your own pipeline (resizing, re-encoding, templating) strips them. A watermark that disappears when your CMS recompresses the file does not help anyone.
Who is caught if you are not in the EU
The Act applies to providers placing AI systems on the EU market or putting them into service there, regardless of where the provider is established. So a US SaaS company with EU customers, a UK agency building a chatbot for a client with EU users, or an Australian or Gulf-based vendor selling into Europe should assume the rules reach them for that product. There is no single answer for every case, and where you are only serving users outside the EU the picture changes, so this is a question to settle early with counsel.
A checklist to run this month
- Inventory every AI feature that talks to people or produces content: chatbots, voice agents, email drafting, image generation, summarisation shown to customers.
- Classify each one. Does it interact directly with people? Does it generate content that is published? Does anything touch employment, credit, education or biometrics? The last group is the one that now has until December 2027, but design for it now.
- Add disclosure to the interface and test it on mobile and in voice flows, not just desktop web.
- Trace your content marking path end to end, from model output to the file a user downloads. Decide who is responsible for the mark: you or your model vendor.
- Ask vendors in writing how they handle Article 50 and what they will provide. Keep the answers.
- Write down your human review process for AI-written public-facing text if you rely on the editorial exception.
- Set a review date for 2 December 2026, when the marking grace period and the new prohibition take effect.
What to do about high-risk systems
If you are building recruitment screening, credit scoring, student assessment or biometric features, the extra time is a gift, but not an excuse. The Omnibus moved the date, not the requirements. Teams that start recording data provenance, evaluation results and human oversight decisions now will find the documentation far easier to produce later than those who try to reconstruct it in 2027. It is also cheaper to build logging and override controls into an architecture than to bolt them on.
Frequently asked questions
Did the EU AI Act get delayed? Partly. High-risk obligations were pushed to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Article 50 transparency duties still applied from 2 August 2026, and the other timelines for prohibited practices and general-purpose models were not changed.
Do I have to label every chatbot as AI? Where users interact directly with an AI system, the provider must ensure they are informed, unless it is obvious to a reasonably well-informed person. Treat "obvious" narrowly. A friendly name and avatar is not a disclosure.
Does the Act apply to a UK, Australian or Middle East company? It can, if you place a system on the EU market or put it into service there, wherever you are based. Confirm your specific case with a lawyer.
What is the deadline for watermarking AI-generated content? For generative systems already on the market before 2 August 2026, the Omnibus allows until 2 December 2026. New systems placed on the market after that date get no grace period.
Where to go from here
If you are planning an AI agent or chatbot for customers in Europe, the cheapest time to design for disclosure, logging and human handover is before you build the flow. Our AI automation service covers agent design with these controls from the start, and our consulting team can review an existing AI feature against the checklist above. For background on where agents fit in a business, see AI agents for business. When you are ready, book a call.
Sources
- European Commission: AI Act regulatory framework and implementation timeline
- EUR-Lex: Regulation (EU) 2026/1744 (Digital Omnibus on AI)
- AI Act Article 50 text (artificialintelligenceact.eu)
- Orrick: EU AI Act update, Digital Omnibus finalizes 8 compliance changes
- Gibson Dunn: EU AI Act omnibus agreement
- Cooley: Digital AI Omnibus delays key deadlines
- Cuatrecasas: Digital Omnibus on AI has been published
- Jones Walker: August 2 still matters
- GDPRLocal: Article 50 transparency rules for businesses
