The EU AI Act's August Deadline: What Actually Changed

On 2 August 2026 the EU AI Act changed in two ways: the Commission gained the power to enforce the rules for general-purpose AI models, and the transparency duties in Article 50 started to apply. What did not change on that date is the high-risk rulebook, because a separate law, the Digital Omnibus, moved those deadlines to December 2027 and August 2028. Our August post covered only the enforcement half. This update adds the rest, and it matters most if you run a chatbot, publish AI-generated media or build a hiring tool.

What changed since August

• High-risk deadlines moved. The Digital Omnibus passed in June and moved stand-alone high-risk systems from 2 August 2026 to 2 December 2027, and AI embedded in regulated products to 2 August 2028, per Jones Walker and Gibson Dunn.
• Transparency duties started on time. Article 50 applies from 2 August 2026, with a grace period for one part, covered below.
• A new ban was added. The omnibus prohibits AI systems that generate non-consensual intimate imagery or child sexual abuse material, with a transition until 2 December 2026.
• No public fine yet. We found no report of a fine, formal proceeding or named target as of mid-October. One source mentions first information requests at the end of August, which we could not confirm.

What actually applied on 2 August 2026?

Two things switched on, and one thing did not.

Enforcement of general-purpose AI rules. A GPAI model is a general-purpose AI model, trained broadly and used for many tasks. The duties for GPAI providers have applied since 2 August 2025: publish a training-content summary, keep a copyright policy and technical documentation, and manage systemic risk. What arrived in 2026 is the machinery. The Commission's AI Office can demand documents, evaluate models, order mitigation, fine providers up to the higher of €15 million or 3 percent of worldwide annual turnover, and require a model to be restricted, withdrawn or recalled, as the Commission's guidance describes.

Transparency duties under Article 50. The Commission's announcement says chatbots and other interactive AI systems must tell users they are dealing with AI, deepfakes must be labelled, and AI-generated or altered content must carry machine-readable marks. Violations fall in the tier with fines of up to €15 million or 3 percent of turnover, with a lower ceiling for qualifying small businesses, according to Jones Walker.

High-risk rules did not start. That was the headline expectation for 2 August 2026, and the omnibus removed it. The obligations are deferred, not repealed.

The new calendar

The dates below combine the original Act with the omnibus changes. Law-firm summaries agree on them, but confirm against the Official Journal text before you rely on any date for compliance.

Date	What happens	Status
2 Feb 2025	Prohibited practices and AI literacy duty apply	In force
2 Aug 2025	GPAI provider obligations apply	In force
2 Aug 2026	Commission enforcement of GPAI rules and Article 50 transparency begin	In force
2 Dec 2026	Machine-readable marking deadline for systems already on the market, and end of the transition for the new intimate-imagery ban	Upcoming
2 Aug 2027	National regulatory sandboxes due	Upcoming
2 Dec 2027	Stand-alone high-risk systems (hiring, credit, education and similar)	Delayed
2 Aug 2028	AI embedded in regulated products	Delayed

!Timeline of the EU AI Act from February 2025 to August 2028, showing GPAI obligations in 2025, enforcement and transparency duties in August 2026, the marking grace period ending in December 2026 and high-risk duties in 2027 and 2028

The omnibus also softened the AI literacy duty. It now asks providers and deployers to "support the development of AI literacy" among staff, rather than guarantee a specific level, per Gibson Dunn.

Who has to do what now?

Your answer depends on your role. This matrix sorts common situations.

You are	What applies now	What is delayed
A GPAI model provider	Documentation, copyright policy and systemic-risk duties, now enforceable	Nothing
A company running a customer-facing chatbot	Tell users it is AI, from 2 August 2026	Nothing
A publisher using AI images, audio or video	Label deepfakes and AI-generated content	Marking grace period for older systems to 2 December 2026
A vendor of hiring, credit or education AI	Prohibitions and AI literacy	Core high-risk duties to 2 December 2027
A small site owner who only publishes text	Nothing directly	Nothing

!Matrix of five roles, GPAI provider, chatbot operator, AI media publisher, high-risk system vendor and small site owner, showing what applies now and what is delayed

The transparency duties in plain terms

Article 50 is the part of the Act that deals with being open about AI use. Three duties matter in practice:

1. Say it is a machine. A chatbot or voice assistant must tell users they are dealing with AI, unless it is obvious.
2. Label deepfakes. Synthetic image, audio or video that depicts real people or events must be labelled as artificially generated.
3. Mark AI output in a machine-readable way. Providers of systems that generate content must embed marks that software can detect. Systems already on the market before 2 August 2026 have until 2 December 2026 for this technical marking only, per Jones Walker. The other duties are not delayed.

The Commission also published a first list of signatories to a Code of Practice on the transparency of AI-generated content, which names more than 180 organisations. The Code operationalises the labelling rules. As with the GPAI code, signing is voluntary and does not replace the law.

If you run a site that publishes AI-assisted images or video, the practical step is to find out whether your generation tool adds machine-readable marks, and to add a visible label where the content could be taken for real.

The part that matters if you run a website

The GPAI copyright duty relies on machine-readable signals that publishers already use to say "do not mine me." These include robots.txt rules, ai.txt files and text-and-data-mining reservations. A GPAI provider serving the EU market must run a policy that respects them. For a site owner, your robots.txt now feeds a legal duty for model providers, so audit it.

A starting point for blocking common AI training crawlers looks like this:

User-agent: GPTBot
Disallow: /

User-agent: Google-Extended
Disallow: /

User-agent: CCBot
Disallow: /

Blocking costs you visibility in AI answers, and allowing means your content may be used for training. Either is a legitimate choice. Drifting into one without deciding is not.

What has and has not happened since August

The enforcement story is quieter than the headlines suggested. The Commission's FAQ says the AI Office may use its powers where technical compliance dialogues are not sufficient, which suggests information requests and evaluations come before fines. We found no fine, formal proceeding or named investigation. The Commission does offer a complaints tool and a whistleblower tool, so reports from outside the industry can start the process.

Signing the GPAI Code of Practice also does not make a provider compliant. The Commission says it weighs a provider's cooperation under the Code when it sets a penalty, and sources describe adherence as creating a presumption of conformity that can be rebutted.

Five common misreadings

Headlines created several wrong impressions, so it is worth correcting them.

• "The high-risk rules started in August." They did not. The omnibus moved them to December 2027 and August 2028.
• "The rules are new." The GPAI duties date from 2 August 2025. Only the enforcement powers are new.
• "Fines are automatic." The figures are ceilings. The Act requires proportionality, and the Commission's FAQ points to compliance dialogue first.
• "Only EU companies are covered." The Act applies to providers placing models on the EU market, wherever they are based.
• "All AI-generated content is banned or must be hidden." Nothing bans it. Article 50 asks that it be disclosed and marked, and the new prohibition targets non-consensual intimate imagery and child abuse material.

A five-step checklist

1. Classify your role. Provider, deployer or neither, for each AI product you ship or use.
2. Add a disclosure to every chatbot or assistant that talks to EU users.
3. Label synthetic media and check whether your tools add machine-readable marks, with 2 December 2026 as the date for older systems.
4. Review your crawler rules and decide on purpose whether to allow AI training.
5. Do not wait for the delayed high-risk dates. Stand-alone systems have until December 2027, but the documentation work takes time, and prohibited practices already apply.

The takeaway

The August 2026 deadline was not one deadline. It was an enforcement switch for general-purpose AI, a start date for transparency duties, and, after the omnibus, a missed date for high-risk systems. If you build a general-purpose model, ask whether your training summary and copyright policy would survive a document request. If you run a chatbot or publish AI media, add the disclosure and the label now. And if you sell a hiring or credit tool, you have been given extra time, not an exemption.