{"id":21027,"date":"2026-07-15T11:27:46","date_gmt":"2026-07-15T11:27:46","guid":{"rendered":"https:\/\/letslaw.es\/?p=21027"},"modified":"2026-07-15T11:28:37","modified_gmt":"2026-07-15T11:28:37","slug":"the-eu-ai-act-has-not-been-postponed","status":"publish","type":"post","link":"https:\/\/letslaw.es\/en\/the-eu-ai-act-has-not-been-postponed\/","title":{"rendered":"The EU AI Act Has Not Been Postponed: What Your Company Must Comply With Before August 2, Regardless of What You May Have Read"},"content":{"rendered":"

Over the past few weeks, the idea has taken hold that the AI Act has been put on hold until 2027. That is not the case. On June 16, the European Parliament approved the reform known as the Digital Omnibus on AI<\/a>, with 423 votes in favour, and the Council of the European Union has just given its formal approval to the text. That reform delays a specific part of the Regulation, not the whole of it, and August 2, 2026 remains a date with fully enforceable obligations. Confusing “the high-risk regime has been delayed” with “the Regulation has been delayed” is the most widespread misreading we are seeing these weeks, and it can leave your company exposed precisely in the segment that does come into force.<\/p>\n

Which AI Act obligations take effect on August 2, 2026?<\/h2>\n

The transparency obligations under Article 50 keep their original date. Any system that interacts directly with natural persons, such as chatbots, voice assistants or conversational agents, must disclose that it is an AI system, unless this is obvious from the context. Systems that generate synthetic content (text, image, audio or video) are also subject to this identification duty<\/a>, with one important caveat: the machine-readable technical labelling of content that already exists has been pushed back to December 2026, but the general duty to inform the user has not. The same applies to emotion recognition systems and biometric categorisation systems, which must disclose their use to the people exposed to them regardless of whether the system qualifies as high-risk.<\/p>\n

On top of this, the prohibitions under Article 5, the AI literacy obligation under Article 4<\/a>, and the governance obligations and duties for providers of general-purpose AI models have been applying since 2025 and are not affected in any way by the reform. AESIA, moreover, has held full sanctioning power since August 2, 2025, which means the supervisory infrastructure is already operational and active by the time August 2, 2026 arrives, something many companies still fail to keep in mind.<\/p>\n

It is also worth pausing on a nuance that tends to go unnoticed: Article 50 does not distinguish between high-risk systems and limited-risk systems. A customer service chatbot with no connection whatsoever to Annex III remains obliged to disclose its artificial nature from that date onward. The postponement of the high-risk regime therefore does not exempt the vast majority of the generative AI tools that companies currently use in their sales, customer service or communication processes.<\/p>\n

Where the confusion comes from: what has actually been delayed and what remains on schedule<\/h2>\n

The process has moved quickly by Brussels standards. The Commission presented the Digital Omnibus on AI on November 19, 2025, the Council adopted its general position on March 13, 2026, Parliament approved its negotiating mandate on March 26, and the provisional trilogue agreement was closed on May 7, following a failed first attempt in late April that raised doubts about whether the reform would be ready in time. Following the plenary vote on June 16 and the Council’s recent formal approval, the text will be published in the Official Journal of the European Union in the coming days and will enter into force three days later, with an already very high degree of certainty about its content.<\/p>\n

What the reform genuinely changes is the timeline for high-risk systems. Those under Annex III (employment, credit scoring, education, biometrics, critical infrastructure, administration of justice, among others), which were due to meet the bulk of their obligations on August 2, 2026, are pushed back to December 2, 2027. High-risk systems integrated as safety components in products subject to harmonised sectoral legislation (Annex I, such as machinery or medical devices) are pushed back to August 2, 2028, a deadline the Commission itself justifies on the grounds that the harmonised technical standards needed to demonstrate compliance are not yet available. The reform also reduces the overlap between the AI Act and the Machinery Regulation, leaving it to the latter to incorporate, through secondary legislation, the safety requirements applicable to AI embedded in those products, which accounts for part of the information noise seen in recent weeks.<\/p>\n

The reform also introduces a new prohibition, which should not be confused with a postponement: systems that generate sexual or intimate content without the consent of the person affected are now banned, as is AI-generated child sexual abuse material, with a compliance deadline of December 2, 2026. The grace period for the technical labelling of content that already exists is being shortened, in parallel, from six months to three. None of these changes affects the transparency obligations already in force or the sanctioning regime, which is precisely where the most common misreading is concentrated among companies that have followed the news only through headlines or through poorly researched social media posts.<\/p>\n

Penalties for failing to comply with the AI Act, and how to prepare your company before the deadline<\/h2>\n

The sanctioning regime under Article 99 has not been touched at any point in this reform. The use or marketing of systems prohibited under Article 5 can lead to fines of up to 35 million euros or 7% of worldwide turnover for the previous financial year, whichever is higher. Failure to comply with the obligations applicable to high-risk systems, once these become enforceable, can reach 15 million euros or 3%, and providing incorrect or misleading information to the competent authorities can reach up to 7.5 million euros or 1%. For SMEs and startups, Article 99(6) sets out an explicit proportionality regime: the lower of the fixed amount and the percentage of turnover applies, not the higher. When an AI system processes personal data, AESIA and the AEPD can act in a coordinated manner, meaning a single infringement can have consequences on two separate sanctioning fronts.<\/p>\n

The priority before August 2 is not, for most companies, setting up a risk management system of the kind required for high-risk systems, which remain a minority within the Spanish business landscape. What is urgent is taking stock of the AI already in use: customer service chatbots, assistants built into the CRM, content generation tools, office copilots and conversational agents connected to internal document repositories. A large share of these systems fall outside the high-risk regime, but not outside Article 50, and it is worth checking system by system whether it triggers the duty to inform the user.<\/p>\n

This is also the moment to review contracts with AI vendors to determine who takes on the role of provider for the purposes of the Regulation, what compliance support they offer, and what records or logs they hand over in the event of an incident. It is also worth verifying whether there is documentation evidencing staff training in AI literacy, mandatory since February 2025 and still missing in many organisations that assumed this obligation had been diluted within the general postponement. It has not: together with the transparency duty under Article 50, it is the part of the Regulation that leaves the least room to wait once August arrives.<\/p>\n

How Letslaw can help you<\/h2>\n

At Letslaw we specialise in digital regulation and artificial intelligence. If your company needs to review its real exposure under the AI Act before August 2, we can help you classify your AI systems, verify your transparency obligations and prepare the necessary documentation. Feel free to contact us<\/a>.<\/p>\n

Contact Us<\/h2>\n
\n

<\/p>

    <\/ul><\/div>\n
    \n
    \n<\/fieldset>\n
    <\/span><\/div>\n
    <\/span><\/div>\n
    <\/span><\/div>\n
    <\/span><\/div>\n