AI Governance & Security5 min read
EU AI Act Delay: What Changed in 2026 and What Businesses Should Still Do
The Digital Omnibus deal pushed back the high-risk rules but left most transparency duties on their original timetable. A plain-English guide to what moved, what did not, and a compliance checklist for teams using AI automation.
Contents
For months, businesses using AI in Europe were told to prepare for 2 August 2026 as the date when the EU AI Act's heavy obligations bite. Then the European institutions agreed to delay part of it. The headlines said 'AI Act postponed', which is true for one category of obligations and misleading for the rest.
What the Digital Omnibus changed
The European Commission tabled the Digital Omnibus on AI on 19 November 2025, proposing targeted amendments, above all a conditional delay for high-risk requirements because supporting standards and guidance were not ready. After an initial trilogue round on 28 April ended without agreement, the institutions reached a provisional political agreement on 6 May 2026, and Member State representatives confirmed it in the Council on 13 May, according to law-firm summaries from Gibson Dunn and others.
| Obligation | Original date | Position after the Omnibus |
|---|---|---|
| High-risk AI, stand-alone systems (Annex III) | 2 August 2026 | Deferred to 2 December 2027 |
| High-risk AI embedded in regulated products (Annex I) | 2 August 2027 | Deferred to 2 August 2028 |
| Most Article 50 transparency obligations (chatbots, generated content, deepfakes, emotion recognition) | 2 August 2026 | Largely unchanged; check for specific grace periods |
| Prohibited practices (Article 5) | In force since February 2025 | Still apply; new prohibition added for AI-generated non-consensual intimate imagery and child sexual abuse material |
As Jones Walker put it in the title of their analysis, August 2 still matters: the high-risk delay is real, but if you run EU-facing chatbots or generative AI, publish synthetic media or use emotion recognition or biometric categorization, most of the relevant transparency duties did not move.
What this means for AI automation projects
Most business automation is not high-risk in the Act's sense, so the delay changes little for a support-triage workflow or a lead-scoring agent. What matters more for these systems:
- Disclosure. People interacting with an AI system, such as a chat or voice agent, should be told they are dealing with AI unless it is obvious from context.
- Generated content. Text, image, audio or video generated or manipulated by AI and published to inform the public, and deepfakes, carry labeling duties.
- Where use cases drift into high-risk. Recruitment screening, employee evaluation, creditworthiness and access to essential services are the classic examples. An agent that ranks job applicants is not a marketing tool.
- AI literacy. Organizations deploying AI are expected to ensure staff have sufficient AI literacy.
- Vendor contracts. Ask providers what they disclose and how they support your deployer duties.
A practical checklist
- 01Inventory every AI system you build or use, including features inside SaaS products and agents built on workflow platforms. Note purpose, owner, data and where users are located.
- 02Classify each one: prohibited, high-risk (check the Annex III list), transparency-only, or minimal risk. Record the reasoning.
- 03Fix disclosures. Add clear AI notices to chat and voice interfaces and label generated content where required.
- 04Document human oversight. Who can intervene, how, and what is logged. This dovetails with human-in-the-loop design.
- 05Train staff and record it.
- 06Review vendor terms and data flows, especially for personal data under GDPR.
- 07Set a review date. The regime is still moving; assign someone to track updates.
If you want a more structured program, the small business governance checklist maps these steps to ISO/IEC 42001 and the NIST AI RMF, and AI agent security covers the technical controls regulators and customers increasingly expect.
Why not just wait until 2027?
Three reasons. The transparency duties are not waiting. Customers and enterprise buyers are already asking for AI governance evidence in procurement, regardless of legal deadlines. And retrofitting inventory, documentation and oversight onto a dozen live automations is far more expensive than building them in. The wider rollout guidance is in the AI automation guide.
Sources and further reading
Frequently asked questions
Was the EU AI Act delayed?
Partly. The Digital Omnibus deal defers the obligations for high-risk AI systems: to 2 December 2027 for stand-alone systems listed in Annex III and to 2 August 2028 for AI embedded in products regulated under Annex I. Most of the Act's transparency obligations were left where they were, and prohibitions already in force still apply.
Do I still need to disclose that a chatbot is AI?
If you provide or deploy chatbots or other AI systems that interact with people in the EU, Article 50 transparency duties generally still apply from the original August 2026 date according to law-firm analyses of the deal. Confirm the exact obligation and any grace periods for your case with counsel.
Does the AI Act apply to companies outside the EU?
Yes, in many cases. The Act applies to providers placing AI systems on the EU market and to deployers whose AI output is used in the EU, regardless of where the company is based. If you serve EU customers with an AI feature, assume it is in scope and check the details.
Is my customer support AI 'high-risk' under the Act?
Usually not. High-risk categories are defined in the Act and include areas such as employment decisions, credit scoring, education and essential services. A general customer support chatbot is typically subject to transparency duties rather than high-risk requirements, but if it makes decisions in a listed area the classification can change.
What should a small business do about the AI Act now?
Keep an inventory of AI systems and their purposes, classify each against the Act's categories, add clear AI disclosures where users interact with AI or receive generated content, train staff on AI literacy and record human oversight. This is also good governance under any framework.
Work with Navelo Software
Published by Navelo Software
An independent software and AI studio building AI systems, web platforms, mobile apps and SaaS for clients worldwide.
