AI Act 2026: The Deadline Has Changed. What Actually Applies to Companies From August?

17.08.2026 12 min

In short: The AI Act (EU Regulation 2024/1689) is being rolled out in stages. The 2 August 2026 deadline was supposed to trigger some of the key obligations for high-risk systems. In July 2026, however, the EU adopted an amendment - the Digital Omnibus on AI (Regulation 2026/1744) - which pushed back the application of the relevant provisions for high-risk systems under Annex III to 2 December 2027, and for systems under Annex I to 2 August 2028. Meanwhile, from 2 August 2026, the transparency obligations under Art. 50 do apply. Their scope depends on the type of system and how the AI is used: it covers, among other things, informing people about direct interaction with AI, machine-readable labelling of certain synthetic content, and disclosure requirements related to deepfakes and certain texts on matters of public interest.

If someone on your team has asked in the last few months "do we need to do something about the AI Act before August," you're not alone. That date has long circulated in conversations about EU AI regulation as the moment the most demanding obligations - those for high-risk systems - would kick in.

There's something worth knowing before you start planning a compliance budget, though: that particular deadline has changed. In July 2026, the European Union formally adopted an amendment to the AI Act that pushes the heaviest obligations further into the future. That doesn't mean the topic can be shelved - some provisions did start applying on 2 August 2026. It means it's worth acting on the current legal state rather than on a year-old announcement.

In this article, we cover what the AI Act actually means today for a company that uses AI, builds AI solutions, or is still planning a rollout.

What exactly is the AI Act?

The AI Act is the world's first comprehensive regulation of artificial intelligence covering the entire EU internal market (Regulation 2024/1689). It entered into force on 1 August 2024, but - much like GDPR in its time - it didn't start applying in full straight away. Its provisions come into effect in stages, depending on the type of AI system involved.

The regulation takes a risk-based approach. The greater an AI system's potential impact on health, safety, or fundamental rights, the more obligations fall on the entity that supplies or uses it. The AI Act doesn't only apply to tech companies building AI models - it can apply to any company that uses AI in its processes, products, or services, regardless of whether it's headquartered inside or outside the EU.

What's really changing in 2026?

This is where most of the confusion happens, so let's break it down by date.

On 24 July 2026, the Digital Omnibus on AI (Regulation 2026/1744) - the first substantial amendment to the AI Act since it was passed - was published in the EU's Official Journal. It entered into force on 27 July 2026. Its main goal was to defer the deadlines for high-risk systems, because the required technical standards and institutional infrastructure (notified bodies, Commission guidance) simply weren't ready yet.

Here's how the timeline looks now:

Date	What takes effect
Feb 2,2025	Ban on unacceptable-risk practices + obligation to ensure staff have adequate AI literacy
Aug 2,2025	Governance rules + obligations for GPAI providers
Aug 2,2026	Transparency (Art. 50): labelling AI content, disclosing chatbots + penalties for GPAI
Dec 2,2026	Ban on nudifiers* and CSAM + AI-content labelling for older systems *Nudifiers - AI tools that generate intimate images of people without their consent (Art. 5 AI Act).
Dec 2,2027	Full obligations for high-risk systems (Annex III)
Aug 2,2028	Obligations for AI in regulated products (Annex I)

2 August 2026 was indeed an important date - just not the one most people were talking about. Obligations for high-risk systems were pushed back by 16 months (standalone systems) or 12 months (systems embedded in products). At the same time, the transparency and AI-content-labelling rules genuinely took effect, and those are the ones affecting the largest number of companies today, since they cover chatbots and content generators regardless of whether a given system is formally "high-risk."

Does every company using ChatGPT need to worry about the AI Act?

No. This is one of the most common questions, and it's worth breaking down, because obligations depend on the role a company plays with respect to a given AI system.

Using ready-made AI tools (e.g. a content-writing assistant, an internal chatbot built on a popular model): the company is usually a "deployer" - a user, not a provider of the system. Obligations here are generally limited, but it's worth knowing what data goes into the tool and whether interaction with the AI is properly disclosed to users.

Building your own AI solution: the company becomes a provider, and most of the obligations around risk classification, documentation, and testing fall on it.

Integrating with an external model, e.g. building an application on top of a large language model's API: responsibility is split between the provider of the underlying model and the integrating company, depending on what the system is ultimately used for.

Building an AI system for clients: the key question is the context in which the client will use the system, since that determines the risk classification.

Deploying AI in internal processes, e.g. in recruitment or employee evaluation: these are areas the AI Act treats as potentially high-risk, regardless of whether the tool was bought or built in-house.

The mere presence of AI in a company isn't the problem. The problem tends to be a lack of awareness of which of these roles the company actually occupies.

Risk categories, explained in plain terms

The AI Act is most commonly presented as a four-tier risk model.

Unacceptable risk covers banned practices, such as certain forms of social scoring, manipulation that exploits people's vulnerabilities, or certain uses of emotion recognition in the workplace. Most typical business use cases don't fall into this category, but the list of prohibitions is broader than the often-cited social-scoring example.

High risk covers certain systems used in areas such as recruitment, education, creditworthiness assessment, or critical infrastructure, as well as selected systems linked to regulated products. A system used for recruiting or screening candidates - in particular for analysing and filtering job applications and evaluating candidates - will generally fall into the high-risk category. The final classification, however, depends on the specific intended purpose and the criteria set out in the AI Act.

Transparency-related risk applies to, among others, systems that interact directly with people and systems that generate or manipulate synthetic content. Art. 50 does not establish a single, general requirement to visibly label every piece of AI-generated content. The scope of obligations depends on the entity's role and the specific use case: providers must, among other things, design certain systems so that a person is informed of direct interaction with AI, and ensure machine-readable labelling of certain synthetic content. Deployers carry additional disclosure obligations, including for deepfakes and certain texts on matters of public interest.

Minimal or no significant risk covers many typical AI applications. In general, the AI Act does not impose the special regime reserved for high-risk systems on these, but other AI Act provisions, as well as other regulations such as GDPR, consumer law, or sector-specific rules, may still apply.

What does the AI Act mean for a technology company?

For a company that designs or deploys AI solutions - whether for its own use or for clients - it largely comes down to one thing: moving these questions to an earlier stage of the process instead of leaving them for the end.

It's worth thinking through the following already at the design stage:

the specific application of the system and the context in which it will be used,
the resulting risk category,
the origin and quality of the data the system learns from or relies on,
technical security and resilience against misuse,
privacy and GDPR compliance (the AI Act doesn't replace GDPR - both apply in parallel),
the role of human oversight over decisions made or supported by the system,
the scope of technical documentation required,
the testing plan, including tests for errors and biased outputs,
how the system's performance will be monitored after deployment,
how responsibility is divided between the technology provider, the integrator, and the deploying company.

The AI Act and software development: what changes in practice?

A responsible approach to the AI Act largely overlaps with good engineering practices that should accompany AI projects anyway. Instead of treating compliance as a separate stage tacked on at the end, it can be woven into the standard product-building process:

idea risk analysis architecture model selection data implementation testing security documentation deployment monitoring

Doing risk analysis at the outset helps avoid a situation where, right before deployment, it turns out the system needs extra documentation or an architecture change. The choice of model and data sources directly affects how easy it is to later demonstrate compliance. Testing and monitoring - already standard practice in a mature software development process - become, along the way, part of meeting regulatory requirements.

It's worth stating this clearly: a software house doesn't provide legal services and doesn't replace a client's compliance department. Its role is to translate business and regulatory requirements into concrete architectural and engineering decisions, so the final product is ready for a compliance assessment whenever the client - ideally together with a lawyer - needs one.

How should a company prepare for the AI Act?

Whatever stage you're at today, it's worth starting with a simple review:

Map out where AI is actually being used across the company - it often turns out more tools are in use than expected, across different departments, without central visibility.
Identify which tools and models are in use, both officially deployed ones and those employees use on their own.
Check what data flows into AI systems, especially personal data and confidential information.
Determine the company's role in each specific solution: provider, integrator, or user.
Assess the risk level of every identified use case.
Establish who in the organisation is responsible for each AI system.
Make sure employees have an adequate level of AI literacy.
Verify the security of the tools and integrations in use.
Prepare documentation proportionate to the actual risk, not "just in case."
Plan ongoing monitoring of how AI systems perform over time, not just a one-off assessment at deployment.

What shouldn't companies do?

A few mistakes come up especially often:

deploying AI without prior analysis of risk and the context of use,
pasting confidential company or client data into public AI tools,
having no visibility at all into which models and tools employees are using,
lacking documentation of what decisions were made and why,
treating AI as a black box that no one in the company can explain,
skipping tests, especially for errors or biased outputs,
ignoring the obligation to build up employees' AI literacy.

None of these mistakes usually comes from bad intentions. More often it's a lack of time, or treating AI as "just another SaaS tool." The AI Act calls for a bit more care - not for giving up on technology.

The AI Act as an opportunity, not just an obligation

It's worth looking at this from the other side, too. A well-organised approach to AI - even one that goes beyond what's formally required - genuinely helps a company:

reduce the risk of mistakes that could cost reputation or money,
gain more control over what data flows into AI systems,
scale AI solutions more easily, because they're built on a transparent architecture,
build trust with clients, who increasingly ask how a company uses AI,
create more predictable, stable products.

Companies that take these issues seriously now will have an easier time of it, regardless of exactly when the next deadlines take effect. And as July 2026 showed, deadlines can still change.

How can Yellows help?

In AI-powered projects, it's worth thinking about compliance and security from the start, not just before deployment. At Yellows, that's exactly where we begin: with understanding the business goal, the data, the architecture, and the risks tied to using AI.

In practice, that means combining several competencies at once: software engineering, thoughtful system architecture, a security-first mindset, experience integrating AI solutions, and familiarity with the client's business processes. We don't replace a lawyer or a compliance specialist, but we make sure technology decisions work well alongside the client's regulatory obligations, instead of complicating them.

If you're planning to roll out AI in your product or processes - or already using it and wondering whether your architecture is well prepared for what's coming - we'd be glad to talk it through.

Book a consultation

Summary: what's worth remembering

The AI Act has been coming into effect in stages since 2024. Not every provision applies yet.

The 2 August 2026 deadline no longer means full obligations for high-risk systems - those were pushed back by the July 2026 amendment to December 2027 (standalone systems) and August 2028 (systems embedded in products).

From 2 August 2026, the transparency rules genuinely apply - including AI-content labelling and the obligation to disclose interaction with a chatbot.

A company's obligations depend on its role with respect to a given AI system: provider, integrator, or user.

Risk classification (unacceptable, high, limited, minimal) determines the scope of obligations.

A thoughtful approach to AI - documentation, testing, human oversight, data control - isn't just a regulatory requirement; it's good business practice.

This article is for informational purposes only and does not constitute legal advice. When assessing your company's specific situation, it's worth consulting a lawyer or compliance specialist.

If you'd like to discuss how to prepare your AI solution's architecture with current and upcoming requirements in mind, get in touch.

FAQ

What is the AI Act?

The AI Act is Regulation (EU) 2024/1689 of the European Parliament and of the Council - the world's first comprehensive regulation of artificial intelligence applying across the entire European Union. It entered into force on 1 August 2024 and is being rolled out in stages.

Is 2 August 2026 the date high-risk system obligations took effect?

No. That was the original assumption, but in July 2026 the EU adopted an amendment to the AI Act (the Digital Omnibus on AI, Regulation 2026/1744) that pushed those obligations back to 2 December 2027 for standalone Annex III systems and 2 August 2028 for Annex I systems embedded in products.

What exactly started applying on 2 August 2026?

Among other things, the transparency obligations under Art. 50 of the AI Act. Providers of certain systems must ensure people are informed of direct interaction with AI and provide machine-readable labelling of certain synthetic content. Deployers have additional disclosure obligations, including for deepfakes and certain texts on matters of public interest. For synthetic-content-generating systems placed on the market before 2 August 2026, the amendment sets a transitional period until 2 December 2026 for Art. 50(2).

What are the penalties for non-compliance with the AI Act?

Depending on the type of violation, maximum administrative fines can reach up to EUR 35 million or 7% of global annual turnover for breaches of banned practices; EUR 15 million or 3% for breaches of certain other AI Act obligations - including some obligations for operators and transparency; and EUR 7.5 million or 1% for providing incorrect, incomplete, or misleading information to competent authorities. How the applicable cap is determined depends, among other things, on the company's category and the specific violation.

Does using ChatGPT or similar tools at a company trigger AI Act obligations?

Obligations here are usually limited, since the company acts as a user (deployer) rather than a provider of the system. The scope of obligations does depend on the context of use, though - simple content-writing support is different from using AI in recruitment or employee evaluation.

How many risk categories does the AI Act have?

Four: unacceptable risk (banned practices), high risk (strict obligations, e.g. recruitment, education, creditworthiness assessment), limited risk (transparency obligations, e.g. chatbots), and minimal risk (no additional obligations).

Legal status as of 17 August 2026. Informational content only; not legal advice. Details may change.

Sources: