In August 2026 a large part of the EU AI Act became applicable, and the supervision and penalty framework that sits behind it switched on. If your company builds, deploys, or simply uses AI inside the EU, the rules now have teeth. This is not a planning problem for later. It is the current state of the law.
The headlines could mislead you here. Much of the coverage focused on the high-risk system obligations that were originally due on that date. Those moved (more on that below). What did not move is the enforcement architecture, the penalties, and the obligations that already apply to ordinary businesses. Reading "the EU delayed the AI Act" and concluding you have more time is still the mistake we see most often.
The August 2026 milestone was less about a single new rule and more about the moment the whole Act became enforceable. Preparation stopped being optional.
The delay was narrow, not general. The Digital Omnibus, formally adopted on 8 July 2026, deferred the high-risk Annex III obligations to 2 December 2027. Article 4 AI literacy, the prohibited practices, and the GPAI rules were not moved.
What Actually Applies Since August 2026
The obligations that gained teeth
Enforcement, transparency, and literacy supervision
Three things matter for most EU SMEs now that this milestone has passed.
First, the enforcement and penalty framework is active. National market surveillance authorities now supervise and enforce, and that includes the Article 4 AI literacy duty that has applied since February 2025. Your obligations did not start in August 2026, but the ability to check and sanction them did.
Second, the transparency rules are in effect. If you run an AI chatbot, generate synthetic media, or use AI in ways a customer would want to know about, you need to disclose that clearly.
Third, the enforcement powers over general-purpose AI (GPAI) model providers are in force. The GPAI obligations themselves have applied since 2 August 2025, so if you develop or substantially fine-tune a model, you are already inside them. The Commission can now investigate and fine GPAI providers.
Does the live enforcement framework reach you?
Quick test: if AI touches your product, your staff, or your customers inside the EU, your compliance has to be demonstrable now, not just planned.
What Moved, and Why It Is a Trap
The high-risk deferral
Later, but not gone
The high-risk system obligations (Annex III: hiring, credit, education, essential services, and similar) were pushed from their original August 2026 date to 2 December 2027 under the Digital Omnibus, which was formally adopted on 8 July 2026. That makes 2 December 2027 a confirmed date to plan against, not a provisional one.
The trap is simple. The deferral bought time on one complex category. It did not pause the literacy duty, the prohibited-practice ban, the GPAI rules, or the enforcement framework. Companies that hear "delay" and stand down are choosing to be unprepared on the parts that did not move.
What To Do Now
A readiness baseline
Know your AI inventory
Every AI tool in use, including informal ones like ChatGPT
Close the literacy gap
Role-relevant AI training, documented, per Article 4
Fix transparency
Disclose chatbots and AI-generated content clearly
Keep records
Evidence you can show a market surveillance authority
Compliance Checklist
Readiness under live enforcement
Click to check offCommon Questions
A large part of the Act became applicable and the supervision and penalty framework switched on. National market surveillance authorities now enforce it, and the Commission gained enforcement powers over GPAI model providers.
Only in part. The high-risk Annex III obligations were deferred to 2 December 2027 by the Digital Omnibus, formally adopted on 8 July 2026. The AI literacy duty, prohibited practices, and GPAI rules were not moved and remain in force.
No. GPAI model obligations have applied since 2 August 2025. What started in August 2026 is the Commission's power to supervise and fine GPAI providers.
Yes. The AI literacy and transparency duties have no company-size threshold. A small deployer carries the same core obligations as a large one, scaled to context.
Free tool: unsure where you stand? Run the AI Readiness Check to see your exposure in about ten minutes.
What To Do Right Now
Ready to get your team compliant?
Staff AI Compliance Awareness · €39/person · Certificate included · 14-day guarantee