The EU AI Act Delay Is Real. Here’s What Still Applies on 2 December 2026

In short: the EU’s Digital Omnibus on AI moved the high-risk rules of the AI Act from August 2026 to 2 December 2027 (and to 2 August 2028 for AI built into regulated products). It did not move everything. Two new bans and the end of a labelling grace period arrive on 2 December 2026, three weeks from today. And the bans, AI literacy duty and chatbot transparency rules already apply.

If your board heard “the AI Act was delayed” and relaxed, this article is for them.

EU AI Act timeline: what moved and what didn’t

Obligation	Original date	Date now	Status
Prohibited AI practices (Article 5)	2 Feb 2025	2 Feb 2025	Already applies
AI literacy for staff (Article 4)	2 Feb 2025	2 Feb 2025	Already applies (wording softened)
General-purpose AI model duties	2 Aug 2025	2 Aug 2025	Already applies
Chatbot, deepfake and emotion-recognition disclosure (Article 50)	2 Aug 2026	2 Aug 2026	Already applies
Machine-readable marking of AI output, for systems on the market before 2 Aug 2026	2 Aug 2026	2 Dec 2026	Three weeks away
New bans: non-consensual intimate imagery (“nudifier” apps) and child sexual abuse material	n/a	2 Dec 2026	Three weeks away
High-risk systems listed in Annex III (hiring, credit, education, essential services…)	2 Aug 2026	2 Dec 2027	Delayed 16 months
High-risk AI inside regulated products (Annex I: medical devices, machinery…)	2 Aug 2027	2 Aug 2028	Delayed 12 months

Sources: Orrick (29 July 2026), Jones Walker (16 July 2026), i-scoop (7 November 2026), Gibson Dunn (27 May 2026). Check the final text, Regulation (EU) 2026/1744, on EUR-Lex before acting on any single date.

Why the EU AI Act high-risk rules were delayed

The short answer is that the infrastructure wasn’t ready. The harmonised standards that providers need to prove conformity were late, and many member states had not yet set up the supervisory authorities that would enforce the rules. Rather than enforce requirements nobody could show they met, the EU moved the dates.

The Digital Omnibus on AI was agreed politically in May 2026, adopted by the European Parliament in June and the Council on 29 June, and entered into force on 27 July 2026.

It replaced the Commission’s original idea of a conditional start date (“when the standards are ready”) with fixed dates. That matters: you now know exactly how long you have.

What lands on 2 December 2026

1. Two new prohibited practices

The Omnibus added to the Article 5 list of banned AI practices:

• AI systems that generate non-consensual intimate imagery, including so-called “nudifier” apps.
• AI systems that generate child sexual abuse material.

The ban covers systems designed for these outputs, and systems where such outputs are reasonably foreseeable and reproducible unless the provider has put reasonable, proportionate and effective safeguards in place. If you run any image-generation feature, your safeguards need to be documented before 2 December.

Prohibited practices sit in the top penalty tier: up to €35m or 7% of worldwide annual turnover, whichever is higher (Article 99 of Regulation (EU) 2024/1689, the EU AI Act).

2. EU AI Act Article 50: the marking grace period ends

Article 50(2) requires AI-generated audio, images, video and text to be marked in a machine-readable way so it can be detected as artificial. Systems placed on the market from 2 August 2026 have had to do this already. Systems that were on the market before that date got a short grace period, which ends on 2 December 2026.

If you shipped a generative feature before August and haven’t added watermarking or metadata marking, this is your deadline.

What already applies (and is often forgotten)

• Prohibited practices since 2 February 2025: social scoring, manipulative techniques, untargeted facial-image scraping, emotion recognition at work and in schools, and others.
• AI literacy (Article 4). The Omnibus softened the wording: you no longer have to guarantee a “sufficient level” of literacy, but you must still take measures to build it in staff who operate or use AI. Keep a record of what you did.
• Transparency (Article 50) since 2 August 2026: tell people when they are talking to an AI system, disclose deepfakes, and notify people exposed to emotion recognition or biometric categorisation.
• General-purpose AI model obligations since 2 August 2025, if you provide one.

Other changes in the Omnibus worth knowing

• A new “small mid-cap” category. Companies that are not SMEs but have fewer than 750 staff and turnover up to €150m (or a balance sheet up to €129m) get simplified documentation templates, proportionate quality-management expectations, priority access to regulatory sandboxes and lower penalty caps.
• Bias detection. The legal basis to process special-category personal data for detecting and correcting bias, previously limited to high-risk providers, now extends to AI systems and models more widely, under strict necessity and safeguards.
• More power for the AI Office. It gains exclusive competence over AI systems built on a general-purpose model from the same provider, and over AI in very large online platforms and search engines.
• Existing systems. High-risk systems already on the market are caught by the new dates only if they are substantially modified afterwards. That sounds like relief, but most AI systems change every few weeks. Treat “substantially modified” as likely.
• Public authorities have until 2 August 2030 for certain systems; sources differ on exactly which, so check the final text.

Why “delayed” is a trap

Sixteen extra months feels like plenty. Three reasons it isn’t:

1. Your AI estate is growing faster than your governance. OutSystems’ 2026 State of AI Development report, based on about 1,900 IT leaders, found that 96% of organisations already use AI agents, but only 12% have a central platform to manage them. Every month of delay is another month of agents built without an approval trail.

2. Projects without governance get cancelled. Gartner has warned that over 40% of agentic AI projects will be cancelled by 2027 without proper governance and clear value. The deadline you should worry about isn’t the regulator’s. It’s your board’s.

3. Evidence can’t be back-filled. A regulator, auditor or customer will ask who approved a system, what data it touches and what changed since the last review. If that evidence wasn’t recorded when it happened, you can’t recreate it later in a credible way.

Your 13-month plan to 2 December 2027

Now to 2 December 2026: close the live gaps

• Inventory every AI system, agent and automation, including the ones teams built themselves.
• Check every generative feature for Article 50(2) marking.
• Check image-generation features against the two new bans and document the safeguards.
• Confirm your chatbots say they are AI.

December 2026 to March 2027: classify and assign

• Classify each system against the AI Act risk tiers. Flag anything that touches hiring, credit, education, essential services or law enforcement (Annex III).
• Name an accountable owner for every system. A team is not an owner.
• Record what each system does, what data it touches and what could go wrong for the people it affects.

April to August 2027: build the controls

• Put approval gates in front of anything high-risk. A person signs, and the signature is kept. Our guide to human in the loop vs human on the loop explains which model fits each action.
• Turn written policies into runtime guardrails: rules that are checked on every action, not just written in a PDF.
• Set up monitoring and incident tracking so problems are logged as they happen.
• Run a fundamental rights impact assessment where it applies.

September to November 2027: prove it

• Run a mock audit. Can you answer every board question with evidence, not memory?
• Map your controls to ISO/IEC 42001 as well. It’s the management-system standard your customers’ procurement teams increasingly ask about.
• Fix what the mock audit finds, then freeze your documentation for 2 December 2027.

How @Human by Planet Crust helps

@Human is the open-source, compliance-first AI platform for organisations that answer to somebody. Governance is the product, not a feature added after launch. Every law and regulation that applies to you is expressed, assessed and enforced inside the same project as the application.

• Every system classified against the EU AI Act and ISO/IEC 42001, with a risk register and a sensitive-data register in the same project.
• Accountable roles and signed approval gates. AI agents can’t sign a gate: 0 of the 296 tools on a live @Human instance can.
• Runtime guardrails, monitoring and incident tracking, so evidence is recorded as the system runs.
• Self-hosted and sovereign. Your data and models stay with you, you can use any AI provider, and you can always unplug the AI.
• Pay what you can, from €1 a month, for the whole open-source platform. Free builds for not-for-profits.

@Human gives you the controls and the evidence. Whether you are compliant still depends on how you use them, and on your own legal advice.

Frequently asked questions

Has the EU AI Act been delayed?

Partly. The Digital Omnibus on AI, in force since 27 July 2026, moved the high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). The bans, AI literacy, transparency and general-purpose AI rules were not delayed.

What happens on 2 December 2026?

Two new bans start (AI that generates non-consensual intimate imagery or child sexual abuse material), and the grace period for machine-readable marking of AI output ends for systems placed on the market before 2 August 2026.

When do the EU AI Act high-risk rules apply now?

2 December 2027 for stand-alone high-risk systems in Annex III, such as hiring, credit scoring and education. 2 August 2028 for AI embedded in regulated products under Annex I, such as medical devices.

Did the EU AI Act penalties change?

No change to the maximums has been reported: up to €35m or 7% of worldwide turnover for prohibited practices, and up to €15m or 3% for most other breaches. SMEs and the new small mid-caps pay the lower of the two caps.

Is AI literacy still required?

Yes. The duty was softened, not removed. You must still take measures to build AI literacy in staff who work with AI systems.

Does the delay apply to AI systems already on the market?

High-risk systems already on the market are caught only if they are substantially modified after the new dates. Most AI systems change often, so plan as if yours will be.

Sources

• Orrick, EU AI Act Update: Digital Omnibus Finalizes 8 Compliance Changes, 29 July 2026
• Jones Walker, Yes, August 2 Still Matters, 16 July 2026
• i-scoop, The EU AI Act after the Digital Omnibus, 7 November 2026
• Gibson Dunn, EU AI Act Omnibus Agreement, 27 May 2026
• Regulation (EU) 2026/1744 on EUR-Lex
• OutSystems 2026 State of AI Development, as reported by iTWire
• Gartner, Over 40% of agentic AI projects will be canceled by end of 2027, 25 June 2025

---

Want to see signed approval gates and runtime guardrails on your own AI agents, automations and applications? Book a free walkthrough. A real person replies within one working day. This article is general information, not legal advice.