EU AI Act from August 2026— what really applies, what got postponed, what to do now

One thing up front: we are AI implementers, not lawyers — this piece is practical orientation, not legal advice. It is based on the regulation text, the official dates and the reporting on the Omnibus agreement, as of 4 July 2026. For a binding assessment of your case, bring a law firm to the table. What we can do here: translate the legal situation into operational language — so you know what to discuss with whom in the first place.

Why everyone is talking past each other right now

The AI Act has been in force since August 2024 and becomes applicable in stages. The original schedule: February 2025 the prohibitions and the AI literacy duty, August 2025 the obligations for providers of large AI models, August 2026 “the rest” — above all the extensive high-risk obligations and the transparency rules.

Then came the deregulation debate. With the “Digital Omnibus”, Council and Parliament agreed in May 2026 to postpone the high-risk obligations; Parliament approved on 16 June 2026, the Council formally adopted on 29 June 2026 — only publication in the Official Journal remains. Since then, half the coverage headlines “AI Act postponed” while the other half warns about the August date. Both are right — they are just talking about different parts of the regulation. And one detail gets lost almost everywhere: as of early July 2026 the Omnibus had not yet been published in the EU Official Journal. Until that happens, the old deadlines formally remain in force — the political agreement is very likely the final outcome, but it is not yet applicable law.

The state of the deadlines — one table instead of ten headlines

What actually lands on you from 2 August 2026: Article 50

The transparency obligations are the part of the regulation that affects the most companies — precisely because they don’t target exotic high-risk cases but everyday AI use:

• Chatbots and voicebots: Anyone operating an AI assistant in customer contact must make it recognisable that users are interacting with AI — unless it is obvious.
• AI-generated images, audio and video: Synthetic content — deepfakes in particular — must be labelled as artificially generated or manipulated. This also covers AI images in marketing.
• AI texts on matters of public interest: Anyone publishing such texts AI-generated must disclose it — unless there was human editorial control with responsibility.
• Emotion recognition and biometric categorisation: Affected persons must be informed — rarer in the mid-market, but anyone using it should know.

The fine range: up to 15 million euros or 3 percent of global annual turnover. Realistically no supervisory authority starts at the maximum — but “we didn’t know” no longer holds from August. The good news: these duties are satisfiable with manageable effort. A clean notice in the chat window, a labelling process for AI visuals, an editorial sign-off for AI texts — that is process work, not a major project.

Deployer or provider? The switch that decides your obligations

The regulation consistently distinguishes between providers (who develop AI systems or place them on the market under their own name) and deployers (who use them professionally). Almost the entire mid-market is a deployer — and deployer obligations are considerably leaner: use transparently, train staff, follow the provider’s instructions.

Those who cross the line need to pay attention: anyone who substantially modifies an AI system or gives an AI solution to customers under their own brand can legally become a provider — with the full programme of obligations. Doing this classification properly once is perhaps the most important half hour of the entire compliance exercise. We unpack the user-vs-provider logic in more detail in the build-vs-buy guide (in German); how data residency and EU operation interact is covered in the local LLM guide (in German).

What almost everyone overlooks: the training duty has applied since February 2025

While everyone stares at August 2026, Article 4 has long been applicable: since 2 February 2025 companies must ensure sufficient AI literacy among everyone working with AI systems. No certificate mandate, no prescribed course format — but the expectation that staff can assess the systems they use: what can the tool do, what can’t it, which data may go in, when must a human check?

A documented, role-based training concept is the usual route — and simply good management besides: the DIHK and Bitkom figures have shown for years that mid-market AI projects rarely fail on technology, but on nobody being able to work with it properly.

Your to-do list until August — five items, no mega-project

• 1. Build an AI inventory. Which AI systems are in use — official and unofficial (shadow AI)? No list, no compliance.
• 2. Clarify your role. For each system: are we a deployer or (accidentally) a provider? When in doubt, have it checked legally.
• 3. Implement transparency. Chatbot notice, labelling of AI images/videos, sign-off process for AI texts — by 2 August 2026.
• 4. Set up the training record. Document a role-based AI literacy concept — the duty has applied since February 2025.
• 5. Schedule the high-risk check, don’t dramatise it. If you use AI in HR decisions, credit scoring or similar: the obligations are coming (expected December 2027) — time for clean preparation instead of panic, but not for denial.

And a sixth item that needs no regulation: if you buy AI solutions from service providers, build the compliance questions into your provider selection — the five screening questions for any AI agency already cover data residency and responsibilities. And for the bigger policy picture: AI as a growth opportunity for Europe.

FAQ: the EU AI Act in the mid-market