AI Act: what changes from 2 August 2026 and how to prepare
Regulation (EU) 2024/1689 is in force, but applies its obligations in stages. From 2 August 2026, transparency, measures for innovation, and enforcement will apply. What is certain, what remains in motion with the Digital Omnibus, and the operational priorities for businesses and administrations.
— Studio LX20 Law Firm
Regulation (EU) 2024/1689 — state of application as of 10 July 2026. The Union's first comprehensive regulation on artificial intelligence has been in force since 1 August 2024, but applies its obligations in a staggered manner. The relevant immediate threshold is 2 August 2026. In this article, we distinguish what is already certain from what has been deferred, and indicate the operational priorities for businesses and administrations.
The state of application
The AI Act does not "enter into force" on 2 August 2026: it has been in force for almost two years. What matures progressively is the *application* of the individual tranches of obligations. There are three already consolidated stages.
- From 2 February 2025, the definitions, the obligations on artificial intelligence literacy, and the prohibitions on unacceptable risk practices apply.
- From 2 August 2025, the rules on general-purpose AI ("GPAI") models and the European and national governance framework apply.
- From 2 August 2026, the transparency obligations of Art. 50, the measures to support innovation, and the start of enforcement activities apply. This is the imminent and, for this part, certain window. The treatment of high-risk systems, also originally scheduled from this date, has instead been deferred, as will be discussed.
The issue of high-risk systems
The material core of the AI Act is high-risk systems, to which an extensive set of requirements applies (risk management, data governance, technical documentation, traceability, human oversight, accuracy and cybersecurity, conformity assessment, CE marking, registration, post-market monitoring). It is precisely on this segment that the timeline has been modified.
The original text of the Regulation (Art. 113) set the application for high-risk systems in Annex III for 2 August 2026 and for those consisting of regulated products (Annex I) for 2 August 2027. Within the digital simplification package (the so-called *Digital Omnibus*), these deadlines have been deferred: the amending regulation was approved by the European Parliament on 16 June 2026 and by the Council on 29 June 2026, and as of the date of this article, it is only awaiting signature and publication in the Official Journal of the European Union, expected by the second half of July 2026.
As a result of the amendment, the application for high-risk systems in Annex III is postponed to 2 December 2027 and that for systems incorporated into regulated products (Annex I) to 2 August 2028. On a methodological level, a distinction must be maintained: until publication in the Official Journal, the formally effective deadlines remain the original ones (2 August 2026 / 2027); from the publication—which is imminent—the new dates will take over. In any case, the act has already been adopted by both co-legislators: it is no longer a mere proposal.
The same amendment introduces other relevant elements: a new prohibition under Art. 5 regarding the generation of child sexual abuse material and non-consensual intimate images (so-called *nudifiers*), and a transitional regime for the marking of generated content, with generative systems placed on the market before 2 August 2026 being subject to the *watermarking* obligation only from 2 December 2026.
The prudent reading remains the same: the deferral eases the timing, not the obligation. Building the documentary framework required by Articles 9 to 15 of the Regulation from now on remains the correct choice, regardless of the postponement.
The AI Act does not only concern model developers
The most common mistake is to think that the Regulation only affects large model developers. The logic of the value chain, however, is strict: anyone who integrates a third-party model into their own product, rebrands it, distributes or imports it, and uses it in regulated contexts assumes their own obligations. In certain cases—change of brand, modification of the intended purpose, or substantial modifications—a distributor, importer, or user can become a "provider" for all intents and purposes of the Regulation, with the corresponding compliance burden.
The extraterritorial scope is also relevant: the strategy of "development outside the Union, sale in the Union via an application programming interface (API)" does not automatically shield from the Regulation when the system's output is used in the Union.
Content transparency: the nearest deadline
For news outlets, publishers, platforms, and communication offices, the most immediate compliance requirement is Art. 50 of Regulation (EU) 2024/1689. Anyone who publishes text generated or manipulated by artificial intelligence "for the purpose of informing the public on matters of public interest" must, as a rule, declare its nature, unless the content has undergone human review or editorial control with the assumption of the related responsibility. Synthetic outputs (audio, images, video, text) must also be marked in a machine-readable format and be recognizable as artificial, within the limits of technical feasibility.
On 10 June 2026, the Commission published a code of conduct on the transparency of AI-generated content, accompanied by a set of icons for labelling. It is a voluntary tool and does not replace Art. 50, which remains a legal obligation applicable from 2 August 2026.
Penalties
The penalty system is strict. Violations of the prohibition of banned practices (Art. 5) can reach up to 35 million euros or 7% of the total worldwide annual turnover, whichever is higher. Other relevant violations—including the transparency obligations of Art. 50 and the obligations of providers, importers, distributors, and deployers—can reach up to 15 million euros or 3% (Art. 99). The supply of incorrect or misleading information to authorities can result in penalties of up to 7.5 million euros or 1%. For providers of general-purpose models, Art. 101 allows the Commission to impose penalties of up to 3% of the total worldwide annual turnover or 15 million euros, whichever is higher.
The method: distinguishing between rule, interpretation, and simplification
A methodological warning is necessary. An ecosystem of guidelines, FAQs, codes of conduct, and technical standards under development has formed around the Regulation. These instruments strongly guide interpretation and enforcement activities, but they do not have the rank of the Regulation. In compliance work, it is advisable to keep three levels distinct: the current rule, the application transition, and the ongoing simplifications. In particular, the first European harmonised standards are expected in 2026, and only their publication in the Official Journal of the European Union (OJEU) will produce the presumption of conformity: until then, many organizations operate without a full "safe harbour".
The Firm follows the evolution of the European and national framework and assists businesses and administrations in mapping systems, assigning roles along the value chain, and preparing for compliance. For a discussion on your specific situation, you can contact the team.
*This article constitutes informational material updated as of 10 July 2026. It does not constitute legal advice. The regulatory references (Reg. (EU) 2024/1689; Reg. (EU) 2016/679; Digital Omnibus amending regulation, adopted on 16 and 29 June 2026 and awaiting publication in the OJEU) are for summary purposes and do not replace reading the official text or the advice of a qualified professional.*