eu ai act: what has applied since 2 august 2026
The transparency obligations under Art. 50 have been in force since August. The Digital Omnibus postponed the high-risk obligations to December 2027 and August 2028 — what that means for SMEs now.
by tokyn studio · 5 min read
AITL;DR. Since 2 August 2026, the transparency obligations under Art. 50 apply — they affect almost every company running a chatbot, a voice agent or AI-generated content. The high-risk obligations that were meant to land on the same day were postponed shortly beforehand by the "Digital Omnibus": to 2 December 2027 for standalone systems under Annex III, and to 2 August 2028 for AI embedded in already regulated products (Annex I). Last updated: 2026-09.
> Quick check: which risk class does your AI use fall into? Our free EU AI Act check sorts it out in 4 questions.
what actually applies since 2 august
The EU AI Act has been in force since 1 August 2024, but in stages. The prohibited practices and the AI literacy obligation (Art. 4) have applied since February 2025, the rules for general-purpose AI models since August 2025.
The 2 August 2026 stage turned out smaller than planned — but it lands exactly where it affects mid-sized companies most broadly:
Transparency obligations (Art. 50). Anyone running a chatbot or voice agent must inform users that they are talking to an AI, unless that is obvious. AI-generated or AI-modified content must be marked in machine-readable form, deepfakes visibly on top. Emotion recognition and biometric categorisation also require informing the people affected. Effort: small, but mandatory — and due now, not eventually.
GPAI enforcement. The EU AI Office has been actively enforcing obligations on model providers since August. For you as a deployer that mainly means checking that your provider has done its homework: documentation, copyright policy, training-data summary.
what was postponed — and what that does not mean
The "Digital Omnibus on AI" was published in the EU Official Journal in July 2026, days before the original deadline. It moves the requirements for high-risk systems:
- 2 December 2027 — standalone high-risk systems under Annex III: risk management, data governance, technical documentation, human oversight, logging, conformity assessment and registration in the EU database.
- 2 August 2028 — high-risk AI embedded in already regulated products (Annex I).
Unchanged: the prohibitions under Art. 5, the GPAI obligations, the AI literacy obligation and the transparency rules. So if you hoped the Omnibus rolled back the AI Act as a whole, you misread it — what moved is the most laborious part, not the broadest one.
On our own account: the June version of this article recommended planning against 2 August 2026 as the baseline rather than waiting for the final legal position. For the transparency obligations that was right. For high-risk it is outdated — there are now sixteen more months of runway. Anyone who followed our advice and classified early still did nothing wrong: you need that classification for both deadlines, and it is the basis for deciding what to build in the first place.
are you affected? provider vs. deployer
The central distinction in the AI Act: providers develop an AI system or place it on the market under their own name. Deployers use an existing system under their own responsibility. The vast majority of SMEs are deployers — they use ChatGPT Enterprise, Copilot, a voice agent service, or a setup we built for them.
Deployer obligations are considerably lighter than provider obligations, but not zero — especially for high-risk systems: use according to instructions, ensure human oversight, keep input data relevant within your own control, retain logs, inform the people affected. But anyone who substantially modifies a system or resells it under their own name can become a provider themselves — a line worth knowing before you cross it.
the checklist, now sorted by due date
1. Transparency building blocks — due. Notice texts for chatbots, voice agents and AI-generated content, in German and English. This is the only item on this list where you are already under obligation. 2. AI literacy (Art. 4) — due since February 2025. Frequently overlooked: staff who use AI need an appropriate basic understanding. A short internal briefing usually suffices — but it has to happen. 3. Use-case inventory — worth doing now. List every AI use in production, with role (provider/deployer) and risk class. Without that inventory you do not know whether anything will affect you in 2027 at all. 4. High-risk check — runway until end of 2027. Running recruiting, scoring or credit AI? That is where the real effort sits. The deadline got more generous; the work did not get smaller. 5. GDPR alignment — anytime. The AI Act does not replace the GDPR, it complements it. Documenting both in parallel halves the effort (see our GDPR + AI article).
what we do about it at tokyn
We build the AI Act classification into our consulting and delivery projects — not as a separate compliance project, but as part of the setup:
- use-case classification (provider/deployer, risk class) per project
- ready-made transparency notices for voice and text, DE + EN
- AI literacy briefing for the team
- alignment with the GDPR record of processing activities
If you want to know where your own use cases stand: a 30-minute first conversation is free and comes without a pitch deck. For the fundamentals, our EU AI Act guide is the better starting point.
And the usual note, meant seriously here: this is orientation from project practice, not legal advice. For a binding assessment of your specific case, a lawyer belongs at the table.
sources
related service
more in the journal.
your case, concretely - let's talk.
30 minutes, no pitch deck. We look at your use case and tell you honestly whether - and how - it's worth doing.