On 2 August 2026, the EU AI Act’s transparency duties under Article 50 and the AI Office’s enforcement powers over general-purpose AI providers took effect as planned, but the obligations for stand-alone high-risk AI systems did not. Regulation (EU) 2026/1744, known as the AI Omnibus, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, moving those high-risk obligations to 2 December 2027. For UK organisations whose AI reaches EU users, the obligation that applies now is transparency, and the extra time on high-risk systems is time to finish the groundwork, not to stop.
The EU AI Act, Regulation (EU) 2024/1689, is the EU’s horizontal law on artificial intelligence. It entered into force on 1 August 2024 and applies in stages. The AI Omnibus is an amending regulation, part of the EU’s wider simplification agenda, that changed several of those stages shortly before the largest one was due.
What did the AI Omnibus change?
Based on the analysis published by several law firms and research bodies in the days after publication, the main changes are:
- Annex III high-risk systems moved to 2 December 2027. These are the stand-alone use cases: employment and worker management, creditworthiness and credit scoring, access to essential private and public services, education and vocational training, critical infrastructure, and the law enforcement and migration categories.
- Annex I high-risk systems moved to 2 August 2028. These are AI systems that are safety components of products already regulated by EU product law, such as medical devices and machinery.
- A short grace period for marking AI-generated content. Generative AI systems already on the market before 2 August 2026 have until 2 December 2026 to implement machine-readable marking of their output.
- New prohibited practices. AI systems that generate non-consensual intimate imagery or child sexual abuse material are added to the prohibited list, applying from 2 December 2026.
- AI literacy softened. The Article 4 duty on AI literacy was reworded to reduce the burden on organisations. Commentators differ on how far it now goes, so firms should not treat it as removed.
- Relief for smaller firms extended. Existing SME simplifications are extended to small mid-cap companies.
- Registration retained. Providers that rely on the Article 6(3) exemption to treat an Annex III system as not high-risk must still register it, through a simplified procedure.
What still applied on 2 August 2026?
Two blocks applied on schedule.
Article 50 transparency. A deployer of an AI system that interacts with people must tell them they are dealing with an AI, unless that is obvious from the context. Deployers of systems that generate or manipulate deepfake content must disclose that the content is artificial. Providers of generative AI must mark synthetic output in a machine-readable format, subject to the grace period above for systems already on the market. A transparency obligation is a duty to tell people when AI is involved, and it reaches far more organisations than the high-risk regime: any firm running a customer-facing chatbot, an AI voice agent or a synthetic-media workflow for EU users.
General-purpose AI enforcement. The AI Office’s powers over providers of general-purpose AI models, including non-EU providers, became operational. This mostly affects model developers, but it matters to UK firms indirectly, because it shapes the documentation and assurances model vendors can give their customers.
The prohibitions that applied from 2 February 2025 remain enforceable, with penalties of up to €35 million or 7% of worldwide annual turnover, whichever is higher.
What does this mean for our May analysis?
In May we set out how the EU AI Act reaches UK organisations through Article 2, and what was due on 2 August 2026. The territorial analysis is unchanged: the Omnibus did not alter who is caught. The high-risk dates in that article have moved, and the action plan should be read with the new dates of 2 December 2027 and 2 August 2028.
Is the UK moving in the same direction?
The UK still has no horizontal AI statute and continues to rely on existing regulators. The most significant recent step for financial services was the FCA’s Mills Review, published on 6 July 2026, which set out how AI could reshape retail financial services by 2030 and made seven priority recommendations to the FCA. For UK firms, the practical position is that AI risk is supervised through existing duties, including UK GDPR, the reformed automated decision-making rules in the Data (Use and Access) Act 2025, the FCA’s Consumer Duty and the SRA Code of Conduct, while the EU Act applies wherever their AI touches the EU.
How should UK firms use the extra time?
By doing the work that every later obligation depends on. High-risk compliance requires knowing which systems are high-risk, and that requires knowing which systems exist. Our May article on shadow AI and the inventory problem explains why most firms cannot yet answer that question.
A sensible sequence for the next sixteen months is: complete the AI inventory; classify each use case against the Act, recording the reasoning; meet Article 50 now for any EU-facing system; and only then run a conformity gap analysis for anything classified as high-risk, with December 2027 as the deadline rather than the starting point.
What to do this quarter
- Identify every customer-facing AI interaction available to EU users and confirm Article 50 disclosure is in place.
- Confirm with generative AI vendors how and when they will meet the machine-readable marking duty, ahead of 2 December 2026.
- Update internal AI Act plans and board papers with the new dates: 2 December 2027 for Annex III, 2 August 2028 for Annex I.
- Complete or refresh the AI inventory, including AI features embedded in existing software.
- Record a classification and rationale for every AI use case that touches the EU.
- Keep AI literacy training in place; it remains good evidence of governance whatever the final wording requires.
How Rhentech helps
Our AI usage audit produces the inventory and classification that every remaining AI Act deadline depends on, including AI features staff use without formal approval. Our AI governance engagement turns that into a working framework: Article 50 transparency design, a high-risk gap analysis timed to the new dates, and alignment with UK regulator expectations so that one body of work serves both regimes.
If your AI Act plan was built around 2 August 2026, book a free initial consultation and we will help you re-plan it against the dates that now apply.
Frequently asked questions
Did the EU AI Act’s high-risk rules apply on 2 August 2026?
No. Regulation (EU) 2026/1744, the AI Omnibus, published on 24 July 2026 and in force from 27 July 2026, moved the obligations for stand-alone high-risk systems listed in Annex III to 2 December 2027, and those for high-risk AI embedded in products covered by Annex I to 2 August 2028.
What did apply on 2 August 2026?
The Article 50 transparency obligations, such as telling people they are interacting with an AI system and labelling deepfakes, and the AI Office’s enforcement powers over general-purpose AI model providers. Generative AI systems already on the market before 2 August 2026 have until 2 December 2026 to implement machine-readable marking of their output.
Does the EU AI Act still affect UK organisations?
Yes, where a UK organisation places AI systems on the EU market, deploys AI in the EU, or produces AI output that is used in the EU. The Omnibus changed dates and some obligations; it did not change the Act’s territorial reach.
Should UK firms pause AI Act preparation until 2027?
No. The extra sixteen months are best used to complete the inventory and classification work that high-risk compliance depends on. Transparency duties already apply, and buyers and UK regulators are asking governance questions now.
Sources
- Regulation (EU) 2026/1744 (the AI Omnibus), Official Journal of the European Union, 24 July 2026, in force 27 July 2026; as summarised in EU Digital Omnibus on AI enters into force, Mondaq, 2026.
- Cooley, Digital AI Omnibus delays key deadlines, introduces new rules, 3 August 2026.
- Cloud Security Alliance, EU AI Act’s high-risk deadline: deferred, not cancelled, 2026.
- Regulation (EU) 2024/1689 (the EU AI Act), Official Journal, 12 July 2024.
- FCA, AI and the future of retail financial services (The Mills Review), 6 July 2026.
Reviewed 20 October 2026.