The EU AI Act: What Actually Applies Since August 2026, and What Was Postponed

The original timeline made 2 August 2026 the application date for obligations on high-risk AI systems. The package known as the Digital Omnibus changed that deadline: obligations for the standalone systems listed in Annex III, which cover things like CV screening, school admissions, creditworthiness assessment and migration management, will apply on 2 December 2027. Those for AI embedded in already-regulated products such as medical devices, toys or machinery are set for 2 August 2028. The postponement was justified by delays in harmonised technical standards and Commission guidelines, without which companies had no enforceable reference framework to comply against.

This is the part many companies missed. Since August 2026, a website, customer service desk or public body using a conversational agent must tell the user they are talking to an AI. Content generated or modified by an AI system must carry technical marking that identifies its artificial origin, whether through embedded metadata, provenance information or watermarking. And synthetic content depicting real people or events must be flagged visibly, so the audience clearly understands it is not watching an authentic scene.

This is what changes the nature of the subject. Breaching transparency obligations can be penalised up to 15 million euros or 3% of worldwide turnover: the higher of the two for a large company, the lower for an SME or a start-up (Article 99 of the regulation). Using a practice prohibited by the regulation exposes you to 35 million euros or 7% of annual turnover. The European Commission has also gained direct supervisory power over providers of large models, including the ability to request information from them and to impose sanctions.

Since 2 February 2025, a company deploying AI systems must be able to demonstrate that its teams have been made aware of the capabilities, limits and risks of those tools. This obligation requires neither an external audit nor certification: a documented awareness session, an internal framing note and a record of who was trained are enough to establish compliance. It is probably the best ratio between effort required and risk covered, and yet it is the line we most often find missing.

Deploying Microsoft 365 Copilot does not make you the operator of a high-risk system, so the December 2027 postponement probably does not concern you. What does concern you already applies: user awareness, transparency if you expose a conversational agent to your customers, and marking the content you publish after generation. On top of that sits a common-sense requirement the regulation makes worth documenting: knowing which AI uses actually exist inside the company, including the ones nobody approved.

The postponement is recent, and several reference pages, including institutional ones, still show the old timeline with 2 August 2026 as the application date for high-risk obligations. If you build a compliance plan or settle a budget on that basis, you risk provisioning in 2026 for work that is only due in 2027 or, worse, assuming everything has been deferred when transparency and penalties are in fact in force. Check when your sources were last updated before deciding.