Not Delayed, Not Deferred: EU AI Act Transparency Obligations Are Now in Force

On 2 August 2026, the EU AI Act’s transparency and information obligations under Article 50 became generally applicable and enforceable by national competent authorities across the EU. If your product talks to users, generates images, audio, video or text, or scores their emotions or biometrics, these duties apply, regardless of whether the system is classified as high-risk. For tech companies operating in the EU, this is no longer a future milestone; it is a present-day regulatory requirement, subject to one narrow exception relating to the labelling of legacy generative systems.

2 August 2026 was also originally billed as the date the Act’s most consequential provisions – those relating to high-risk AI systems – would take effect. That did not happen because the recently adopted AI Omnibus (Regulation (EU) 2026/1744, which came into force on 27 July 2026) has pushed those obligations back to 2 December 2027.

As discussed in our previous client alert on the Commission’s proposals for the AI Omnibus, “Cutting Through Complexity: Inside the EU’s Digital Omnibus Package,” the AI Omnibus forms part of the Commission’s broader strategy to simplify the EU’s digital regulatory framework, recalibrating timelines and administrative burdens elsewhere in the Act without altering the substance of the transparency obligations discussed in this alert. This alert covers key changes introduced by the AI Omnibus: the deferred high-risk timeline, streamlined administration, and expanded regulatory support.

Transparency Requirements Now in Force

The AI Act’s general application date of 2 August 2026 brings into effect the transparency provisions that apply irrespective of an AI system’s risk classification:

• Providers of any AI system designed to interact directly with natural persons (such as chatbots or virtual assistants) must ensure individuals are clearly informed they are dealing with an AI system, unless this is obvious from context. This obligation applies regardless of risk classification.
• Providers and deployers of AI systems generating synthetic audio, image, video, or text (including deepfakes) must mark outputs in a machine-readable, detectable format; deployers must also disclose deepfakes depicting real persons, places, or events. Providers of generative systems already on the market before 2 August 2026 have been given until 2 December 2026 to comply with this marking obligation under the AI Omnibus.
• Deployers of emotion recognition or biometric categorisation systems must inform exposed individuals of the system’s operation and process any personal data in line with EU data protection law. Exceptions apply for such systems that detect, prevent, or investigate criminal offences, subject to safeguards and other EU laws.

For more detailed practical guidance on scope, definitions, and compliance expectations under Article 50, organisations should also consult the Commission’s Guidelines on transparency obligations for providers and deployers of AI systems, adopted by the Commission on 20 July 2026.

Organisations should assess their AI deployments against these requirements as a matter of priority. Non-compliance may give rise to administrative fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)), and enforcement action by national competent authorities.

1. Delayed Application of High-Risk AI System Requirements

Perhaps the most significant change is the extension of the implementation timeline for high-risk AI systems. Under the revised timetable the requirements for:

• standalone high-risk AI systems listed in Annex III (including those used in employment, education, law enforcement, and critical infrastructure) will apply from 2 December 2027; and
• AI systems embedded within products regulated under EU product safety legislation (Annex I), such as medical devices, toys, and lifts, will apply from 2 August 2028. Machinery is treated differently. The AI Act’s requirements will instead be transposed directly into the machinery regulation by delegated act (due by 2 August 2028).

These extensions give organisations more time to prepare while the Commission finalises technical guidance. They do not affect the prohibitions on unacceptable AI practices, obligations relating to general-purpose AI models, or the transparency obligations above, all of which continue to apply under the existing timetable.

2. Administrative Simplification

The Omnibus removes or streamlines several administrative requirements criticised as unduly burdensome. Among the most notable changes:

• AI literacy. The mandatory obligation on providers and deployers to ensure AI literacy of their staff is softened: rather than requiring organisations to ensure a sufficient level of AI literacy, Article 4 now requires providers and deployers to take measures to support the development of AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf. The Commission and Member States are to support and facilitate these efforts, including through training opportunities, informational resources, and the exchange of good practices.
• EU database registration. The registration requirements for AI systems that a provider has assessed as not posing a significant risk (and therefore not classified as high-risk) have been simplified by streamlining the content required for registration. While such systems must still be registered in the EU database, the information that providers are required to submit has been reduced to strike a more proportionate balance without undermining market surveillance or public accountability.
• Post-market monitoring. Providers of high-risk systems still need a monitoring plan but are no longer required to follow a Commission-mandated harmonised template for it; the Commission will instead publish voluntary guidance, including a template, by 2 September 2027.

These measures are intended to reduce compliance costs without materially altering the underlying safety obligations imposed by the Act.

3. Expanded Support for Innovation

For growth-stage and scaling tech companies, the Omnibus introduces measures to facilitate AI development and testing across the EU, including:

• extending simplified compliance measures previously limited to small and medium-sized enterprises (SMEs) to a new “small mid-cap” (SMC) category, broadening the range of businesses eligible for proportionate treatment; and
• expanding regulatory sandboxes, both nationally and through a new EU-level sandbox, giving organisations more opportunity to develop, test, and validate AI systems under regulatory supervision before deployment.

4. New Safety and Fundamental Rights Measures

The Omnibus now prohibits AI “nudification” applications and systems capable of generating child sexual abuse material. As new prohibited practices under Article 5, these bans apply from 2 December 2026 and carry the Act’s highest penalty tier: fines of up to €35 million or 7% of worldwide turnover, whichever is higher. The prohibition on nudification tools targeting the creation of harmful synthetic content supplements the Digital Services Act provisions focused on distribution, which compel platforms to mitigate the spread of illegal synthetic content through systemic risk assessments and related measures. This dual-track possible enforcement is underscored by recent investigations into major platforms (e.g., X/Grok) for failing to curb deepfake proliferation.

Separately, the Omnibus broadens the legal basis for processing special category personal data for bias detection and correction: Previously limited to providers of high-risk systems, it now also covers deployers of high-risk systems and providers and deployers of other AI systems and models, subject to the same strict safeguards under EU data protection law.

5. Strengthened AI Governance

The Omnibus also refines the Act’s governance framework, particularly the role of the European AI Office, with direct consequences for AI labs and large platforms.

The AI Office, not national regulators, now holds direct supervisory authority over systems built on general-purpose AI models and over AI features embedded in designated very large online platforms and search engines. The amendments also clarify the Act’s interplay with other EU legislation and simplify conformity-assessment procedures.

Key Takeaways

The Omnibus is an evolution of the AI Act but does not pause the AI Act’s broader implementation. While the revised timelines provide welcome additional preparation time for high-risk AI system obligations, organisations should be aware that the main transparency and information obligations of the EU AI Act are now in effect and require immediate attention. Companies that have not assessed their transparency exposure should do so promptly.

Further, the prohibitions on unacceptable AI practices and the obligations applicable to general-purpose AI models continue under the existing schedule, save for the new nudification and CSAM-generation prohibitions described above, which apply from 2 December 2026.

Organisations should use the extended timelines for high-risk AI system compliance to advance, not defer, their AI governance programmes and build robust compliance frameworks, including by conducting gap analyses, updating internal policies, and engaging with emerging technical standards.

Next Steps

The Omnibus’ entry into force concludes the legislative process begun by the Commission’s November 2025 proposal. Attention now shifts to implementation and enforcement. Organisations should monitor guidance from the Commission and the AI Office and engage proactively with national authorities. Our Technology Transactions team can help assess your obligations and develop a tailored compliance strategy. Please contact the authors of this alert or your usual Goodwin contact for further information or assistance.