The EU AI Act on 2 August: What Now Applies and What Was Postponed
Updated: 6 days ago
Title: The EU AI Act on 2 August: What Now Applies and What Was Postponed
Date: 12 August 2026
Type: Paper
Author: SAASiQ (contact@saasiq.ai)
Word count: 2309 words
Reading time: 9 min
Published: 12-08-2026
Enforcement of the EU AI Act began on 2 August 2026, and the Act's transparency rules for chatbots and AI-generated content took effect on the same day. The high-risk obligations that most organisations had been planning around did not. They were moved to December 2027 and August 2028 by the Digital Omnibus on AI, which entered into force a week earlier. This paper sets out what applies now, who carries which duty, how content marking works in practice, and a working approach for organisations that use AI rather than build it.
Where the Act stands
The AI Act has been coming into force in stages since it was adopted. The bans on prohibited practices, such as social scoring, have applied since February 2025. Obligations on providers of general-purpose AI models followed in August 2025. The third stage, on 2 August 2026, was meant to bring in the bulk of the regime, including the rules for high-risk systems used in recruitment, credit decisions, education, access to public services and similar areas.
That third stage was cut back. EU lawmakers reached political agreement on the Digital Omnibus on AI in May, the Council gave its final approval on 29 June, and the regulation entered into force on 27 July. On 2 August the European Commission's AI Office, working with national authorities, began enforcing the Act, and the transparency obligations in Article 50 started to apply. Henna Virkkunen, the Commission's Executive Vice-President for tech sovereignty, described the aim of the Omnibus as making it easier to innovate without lowering the bar on safety.
So the Act that applies in August 2026 is narrower than the one most organisations were briefed on a year ago, and the part that does apply now has a regulator actively enforcing it.
What the AI Office can now do
The general-purpose AI obligations have applied to model providers since August 2025, but the Commission's powers to enforce them only started on 2 August 2026. From that date the AI Office can request documentation from providers of general-purpose models, run its own technical evaluations of those models, require compliance and risk-mitigation measures, restrict or withdraw a model from the EU market, and fine a provider up to 3 per cent of worldwide annual turnover or 15 million euros, whichever is higher.
These powers apply to the companies that build the models, such as OpenAI, Google, Anthropic, Meta and Mistral, rather than to the organisations using them. They still matter to deployers. A model a supplier builds into a product is now subject to documentation requests and evaluation by a regulator, and in an extreme case it could be withdrawn from the EU market. Contracts that depend on a particular model should say what happens if it is restricted or withdrawn.
National market surveillance authorities handle enforcement of most other obligations, including Article 50. Member states were required to designate those authorities by August 2025, so an organisation operating in several EU countries may deal with more than one regulator on the same question.
What Article 50 requires
Article 50 splits its duties between providers, the organisations that develop an AI system and put it on the market or into service under their own name, and deployers, the organisations that use one in the course of their work.
Providers have two main obligations. An AI system that interacts with people has to tell them they are dealing with AI, unless that is already obvious from the context. And a system that generates synthetic audio, images, video or text has to mark its output in a machine-readable way so that it can be detected as artificially generated. Standard editing and changes that do not materially alter the input are exempt.
Deployers also have two. An organisation using emotion recognition or biometric categorisation has to inform the people exposed to it. And an organisation publishing deepfakes, or AI-generated text meant to inform the public on matters of public interest, has to disclose that the content was generated or manipulated. The text disclosure does not apply where the content has been through human editorial review and a person has taken editorial responsibility for it.
The simplest way to meet the chatbot duty is a short statement at the start of each conversation, on every channel the assistant runs on, including web chat, messaging apps and phone lines where a voice assistant answers. The wording, and where it appears, should be recorded so it can be shown to a regulator later.
Fines for breaching these obligations run to 15 million euros or 3 per cent of worldwide annual turnover, whichever is higher. Generative AI systems already on the market before 2 August have a grace period for the marking requirement until 2 December 2026.
How content marking works in practice
The Act says output must be marked in a machine-readable way. It does not say how. The detail sits in the Code of Practice on Transparency of AI-Generated Content, which the Commission published in June. It is voluntary, and more than 180 organisations have signed it. Signing gives a provider a recognised way to show compliance, and law firms advising on the Code expect signatories to receive a more favourable enforcement posture.
The Code asks providers to use two methods together. The first is digitally signed metadata attached to the content, recording that it was generated or altered by AI. The second is an imperceptible watermark embedded in the content itself, so that the mark survives when metadata is stripped, as it often is when a file is copied or re-uploaded. Very short text, under 200 tokens, is exempt from watermarking. Fingerprinting or logging of generated content is listed as an optional third method.
Signatories also commit to a visible layer. Where content is disclosed as AI-generated, they use a common set of icons provided by the AI Office, so that a reader sees the same symbol whichever tool produced the content. And they commit to making their watermarks detectable by others, through a shared API, a readable signal in the content, or a joint detection service, by 2 February 2027.
For deployers the practical point is that marking is a provider's job. An organisation using Copilot, Gemini or ChatGPT to draft content does not have to build watermarking itself. What it does have to handle is disclosure when it publishes, and the editorial review exemption only helps if the review is real and someone is recorded as responsible for the text.
What was postponed, and to when
The main change in the Omnibus is timing. Obligations for stand-alone high-risk systems listed in Annex III, which covers areas such as biometrics, critical infrastructure, recruitment and staff management, education, credit scoring and access to essential public services, move from 2 August 2026 to 2 December 2027. Obligations for high-risk AI built into products already covered by EU safety legislation under Annex I, such as machinery and medical devices, move from 2 August 2027 to 2 August 2028.
Some things were changed rather than delayed. The AI literacy duty in Article 4 has been softened, so providers and deployers now have to support the development of AI literacy among their staff rather than ensure a set level of it. A new prohibition was added, covering AI systems that generate non-consensual intimate imagery or child sexual abuse material, with a transitional period to 2 December 2026. The deadline for member states to set up AI regulatory sandboxes moved to 2 August 2027.
The high-risk requirements themselves, covering risk management, data governance, logging and human oversight, remain in the Act. Organisations now have sixteen more months before the Annex III rules apply.
The deployer duties that arrive with them are set out in Article 26 and are worth reading now. A deployer of a high-risk system has to use it in line with the provider's instructions, assign human oversight to people with the competence and authority to exercise it, monitor how the system performs, and keep the logs it generates for at least six months. An employer putting a high-risk system into use in the workplace has to inform the affected workers and their representatives beforehand. Public bodies also have to complete a fundamental rights impact assessment.
Provider or deployer
Most organisations will read the Act as a deployer, since they buy AI features inside products from Microsoft, Oracle, Salesforce, ServiceNow and others. That reading holds for features used as the supplier provides them.
An organisation that builds its own chatbot on a third-party model and runs it under its own name can count as the provider of that system, and the provider duties in Article 50 then fall on it, including disclosure and, where the chatbot generates content, marking. The same applies to a customer-facing assistant on a council or housing association website, an internal HR assistant that staff can query, or a document generator that produces letters sent to the public. Each one needs a decision, written down, on which role the organisation holds.
The boundary matters more for the December 2027 rules than for Article 50. Provider obligations for high-risk systems are far heavier than deployer obligations, and an organisation that substantially modifies a high-risk system, or puts its own name on one, can become its provider.
Where UK organisations stand
The Act applies to organisations that place AI systems on the EU market or whose AI output is used in the EU, wherever they are based. A UK public body serving UK residents is outside it. A UK software supplier with customers in the EU is within scope, as is a UK firm whose chatbot or generated content reaches people in the EU.
The UK has no AI statute of its own. AI is regulated through existing law, principally UK GDPR and the Data (Use and Access) Act 2025, and through sector regulators such as the FCA, Ofcom and the MHRA. The government's stated position is that most AI systems should be regulated at the point of use by the regulator that already covers that activity.
For UK public sector organisations the more likely route in is indirect. Suppliers selling into both markets are likely to build the Article 50 disclosure and marking features into their standard products, in which case those features will reach UK tenancies through the normal release cycle whether or not the customer is in scope. The Act's categories also make a usable checklist for UK organisations that have no equivalent of their own, and UK GDPR already requires a data protection impact assessment for many of the uses Annex III lists, such as automated decisions about job applicants.
A working approach for deployers
The first step is an inventory. Finance, HR and customer service estates now contain AI features that arrived in a quarterly update rather than through a procurement: candidate ranking in a recruiting module, suggested matches in accounts payable, reply drafting in a case management system. Some are enabled by default and others have to be switched on. The inventory needs to record what each feature does, whether it is on, what data it reads, and who acts on its output.
The second is to sort that inventory against the Act. Customer-facing chat and published AI-generated content fall under Article 50 now. Anything that ranks, scores or filters people for jobs, credit, benefits or services is a candidate for Annex III and should be flagged for December 2027. Everything else can be recorded and reviewed periodically.
The third is to settle the provider or deployer question for each system that the organisation built, configured heavily, or runs under its own brand. That decision determines which set of obligations applies, and it is far easier to make now than in the months before a deadline.
The last is contractual. Suppliers should be asked how their products meet the Article 50 marking and disclosure requirements, which of their features they classify as high-risk under Annex III, what documentation they will provide to deployers ahead of December 2027, and what happens if a model they depend on is restricted by the AI Office. The answers should be written into the contract and the supplier's service documentation.
A worked example
Take an illustrative organisation with EU customers that runs three things: a customer service chatbot built on a hosted model and branded with its own name, a communications team that drafts news items with Copilot, and a recruitment module that ranks applicants.
The chatbot makes the organisation a provider under Article 50. From 2 August it has to tell users they are talking to AI unless that is obvious, and if the chatbot generates content, that output has to be marked. The hosted model's supplier handles watermarking at the model level, but the organisation should confirm in writing that marking survives its own integration.
The communications team is a deployer publishing text on matters of public interest. Its news items need an AI disclosure unless a named editor reviews and takes responsibility for each one. Recording that review, even as a line in the publishing workflow, is what makes the exemption hold up if it is ever questioned.
The recruitment module is a deployer's Annex III system, due for December 2027. Nothing changes in August 2026, but the time to ask the supplier for its conformity plans and to design human oversight of the rankings is now, while there are sixteen months in hand.
Dates to hold
The next fixed date is 2 December 2026, when the grace period for marking AI-generated content ends and the transitional period for the new prohibition closes. Code of Practice signatories have committed to make their watermarks detectable by others by 2 February 2027. Member states' AI regulatory sandboxes are due by 2 August 2027. The Annex III high-risk obligations apply from 2 December 2027, and the Annex I obligations from 2 August 2028.
SAASiQ - Intelligent Solutions for SaaS ©
