The EU AI Act after 2 August 2026: what applies now and what was postponed

What actually changed on 2 August 2026

The transparency obligations in Article 50 have applied since 2 August 2026. The European Commission states it plainly: "On 2 August 2026, new rules on the transparency of AI systems take effect."

At the same time the high-risk timeline moved. Regulation (EU) 2026/1744 entered into force on 27 July 2026, which makes the postponement binding law rather than a proposal. Annex III follows on 2 December 2027 and Annex I on 2 August 2028.

That distinction decides the next twelve months of effort. Treating Article 50 as a high-risk programme commits budget to duties that do not yet exist. Pointing at the postponement and doing nothing overlooks the duties that already apply.

• 27 July 2026: Regulation (EU) 2026/1744 enters into force
• 2 August 2026: Article 50 applies
• 2 December 2026: end of the transitional window for Article 50(2) on legacy systems
• 2 December 2027: requirements under Article 6(2) and Annex III
• 2 August 2028: requirements under Article 6(1) and Annex I

Evidence for this section1234

Provider or deployer: the role determines the duty

Article 50 allocates duties by role. Providers must make systems that interact directly with people recognisable as AI, unless that is already obvious. Where a system generates synthetic audio, image, video, or text content, that output must be marked in a machine-readable form.

Deployers carry different duties. They must inform people about emotion recognition and biometric categorisation, disclose deep fakes, and label AI-generated text on matters of public interest unless a human review with editorial responsibility has taken place.

A common overstatement follows from this. The claim that all AI-generated text must be labelled is too broad. The deployer duty is tied to matters of public interest and to the absence of editorial responsibility.

Timing is regulated too. Article 50(5) requires the information to be given "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure" and refers to the applicable accessibility requirements.

Evidence for this section15

The transitional rule is narrower than its reputation

Article 111(4) gives providers of generative systems placed on the market before 2 August 2026 until 2 December 2026 to comply with Article 50(2).

That window covers only the machine-readable marking in paragraph 2. It postpones neither the disclosure duty for direct interaction nor any deployer duty. A company relying on the grace period in general terms is relying on a rule that is narrower than it sounds.

Evidence for this section1

AI literacy: a duty without a guaranteed competence level

Article 4 still requires measures to promote AI literacy among staff and other people operating systems on behalf of the organisation. The amended wording is explicit that no particular competence level must be guaranteed: "This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual."

In practice a single all-hands session with an attendance list barely serves the purpose, yet a guaranteed per-person competence certificate is not required either. What holds up is a documented, role-specific process that reflects the deployment context and the risk profile.

Evidence for this section12

Reading the penalties correctly

Article 99(4) names Article 50 explicitly. The ceiling is up to 15 million euro or 3 percent of worldwide annual turnover, whichever is higher. For small and medium-sized enterprises the lower of the two figures applies.

Two qualifications belong with that number. These are ceilings, not automatic fines. And Article 4 is absent from the same list, so the Article 50 ceiling cannot be transferred to breaches of the AI literacy duty.

Evidence for this section1

What a defensible first step looks like

The effort rarely sits in the labelling itself. It sits in the inventory that has to come first. Without a list of the systems in use, their role, and their points of contact with people, Article 50 can be neither implemented nor evidenced.

• Which systems interact directly with people, and is that obvious?
• Which systems generate synthetic content, and is it marked?
• For each system, are we the provider, the deployer, or both?
• Which bought-in assistants run under our own name, and who is the provider there?
• What evidence could we hand a supervisory authority today?

Evidence for this section15