EU AI Act 2026: The Deadline Moved, but You Are Not Off the Hook

The EU AI Act's most demanding rules — the high-risk obligations under Annex III — moved from 2 August 2026 to 2 December 2027 under the Digital Omnibus (the European Parliament gave its final approval on 16 June 2026; Council adoption is expected around 29 June 2026, with publication in the Official Journal to follow). But three things already bind you: prohibited AI practices (since February 2025), general-purpose AI (GPAI) model rules (since August 2025), and chatbot transparency (deployer disclosure and deepfake labeling from August 2026; provider watermarking from December 2026). Penalties reach €35M or 7% of global turnover. The Act applies wherever your AI output reaches the EU, no matter where your company is based.

Most coverage still tells you the AI Act lands on 2 August 2026. That date moved for the heaviest obligations. The risk is that "the deadline moved" quietly becomes a reason to do nothing, which is the most expensive way to read the news. Here is the accurate picture as of June 2026: what is genuinely delayed, what is already enforceable, and the three moves that matter before the summer slowdown.

On 7 May 2026, the Council and the European Parliament reached a political agreement on the Digital Omnibus on AI, a package that simplifies parts of the AI Act and resets several deadlines. The European Parliament confirmed the deal in its final vote on 16 June 2026, and the Council is expected to adopt the text formally around 29 June 2026, with publication in the Official Journal to follow. The core architecture — the risk-based tiers, prohibited practices, the GPAI track, and the AI Office's oversight role — did not change. What moved were the application dates for high-risk systems.

One caveat the "we have more time" reading skips: as of 22 June 2026 the Omnibus is not yet formally adopted and in force. Until that text is published, 2 August 2026 technically remains the active legal date. Sane approach: anchor your roadmap to December 2027, but confirm final adoption before you bet your compliance program on it.

This is where the delay narrative breaks down. Three sets of obligations are not waiting for 2027.

Prohibited practices (since 2 February 2025). Eight uses are banned outright, including social scoring, untargeted facial-recognition scraping, emotion recognition in workplaces and schools, and subliminal manipulation. Live and enforceable today.

GPAI model rules (since 2 August 2025). Obligations for general-purpose AI model providers — including documentation and transparency duties — have applied for nearly a year.

Transparency obligations (chatbot disclosure and deployer deepfake labeling from 2 August 2026; provider watermarking from 2 December 2026). If you run a customer-facing chatbot, users must be told they are talking to a machine, and deployers must label AI-generated content including deepfakes — both from 2 August 2026. The providers' machine-readable watermarking duty under Article 50(2) carries a grace period to 2 December 2026 for generative systems already on the market.

How to check if this already applies to you: if your business uses a customer-facing chatbot, a recommendation engine, a CV-screening tool, or a credit-scoring model touching EU users, at least one obligation above applies to you now or this year.

Yes. The Act has extraterritorial scope — the same way GDPR does. If your AI system's output reaches the EU through sales, access, or downstream integration, you are likely in scope regardless of where your company sits. A US SaaS vendor whose tool is used by an EU client, or a Moldovan fintech serving EU borrowers, both fall inside the perimeter.

The classification that decides your workload is provider vs deployer. A provider develops the system. A deployer uses it professionally. The trap: if you substantially modify a third-party model — for example through heavy fine-tuning — you can be reclassified from deployer to provider and inherit the much heavier obligations.

The AI Act's fines are deliberately built to exceed GDPR. The structure under Article 99:

For SMEs and, newly, mid-caps up to 750 employees and €150M revenue, the fine is capped at the lower of the fixed sum or the percentage, plus access to simplified documentation and regulatory sandboxes. Worth remembering: even where AI Act high-risk dates are deferred, the same systems may already be subject to GDPR, which EU regulators are actively enforcing in AI contexts.

The window did not close, but the smart money treats the extra time as runway, not relief. Standards and guidance may not be final until close to the new deadlines, which leaves limited room to adapt if you wait. Three moves matter most.

Companies confused about the AI Act are often unsure about NIS2 too — and that directive is already in its enforcement phase. If you operate in one of the covered sectors, the obligations are live now, not in 2027.