17 Oct
2026
Europe's AI Act has entered a strange middle period. The headline deadline that dominated boardroom slides for two years, August 2, 2026 for high-risk systems, has been pushed back. Yet the law is very much live: transparency duties for chatbots and AI-generated content have applied since August 2, regulators are meeting on enforcement, and a second deadline arrives on December 2. Businesses that read "delay" as "pause" are misreading the calendar.
The most recent signal came from the EU's AI Board, the body of national representatives that coordinates the law. At its meeting on September 17, the Board discussed implementation, enforcement priorities, frontier AI and coordination between member states, and the Commission updated it on transparency obligations, guidance and a Code of Practice on AI-generated content, according to TLT's October AI brief.
The changes came through Regulation (EU) 2026/1744, the "Digital Omnibus on AI," which was published in the Official Journal on July 24, 2026 and entered into force on July 27, according to Cooley. The biggest shifts are to high-risk timelines:
What did not move is just as important. K&L Gates, writing in the National Law Review, notes that obligations for general-purpose AI models were not delayed and that the transparency duties from August 2, 2026 still apply: telling people they are interacting with an AI system, labeling deepfakes and certain AI-generated content, and notifying people about emotion recognition and biometric categorization systems.
Two obligations land on December 2, 2026. The first is machine-readable marking, commonly called watermarking, for generative AI systems. Cooley explains that systems already on the market before August 2, 2026 received a grace period until December 2, 2026 for this requirement under Article 50(2). New systems were not given that grace.
The second is a pair of new prohibitions. The omnibus bans AI systems that generate non-consensual intimate imagery, often called "nudifier" apps, and AI-generated child sexual abuse material. Cooley reports those bans take effect December 2, 2026 with no exemption for systems already on the market, and that providers face a broader standard than deployers.
Seven weeks is not long for a provider that still needs to implement content provenance across image, audio or video outputs. It is also a reminder that the omnibus was a recalibration, not a retreat. The EU loosened the timetable for the most complex compliance work while adding firm bans on the uses that drew the most public alarm.
Companies trying to interpret transparency duties are not starting from a blank page. McCann FitzGerald's July snapshot notes that the Commission published a final Code of Practice on Transparency of AI-Generated Content on June 10, 2026, open for organizations to sign. A consultation on draft Article 50 transparency guidelines closed on June 3, though the firm said at the time that the guidelines had not yet been finalized. A separate consultation on guidelines for classifying high-risk systems ran from May 19 to July 23.
The same snapshot records that on May 22 the Commission published its first annual report, concluding it was too early to amend the rules on prohibited practices and high-risk use cases while flagging emerging risks such as non-consensual deepfakes and emotion recognition. That conclusion foreshadowed exactly where the omnibus added new bans.
The omnibus also softened the wording of the AI literacy duty. Cooley describes a change from requiring providers and deployers to "ensure" staff competence to the Commission and member states having to "support and facilitate" it, while noting the substance of the obligation remains. Companies should not read that as permission to drop training programs.
Most companies reading this are not building foundation models. They are deploying AI: a customer-service chatbot on a website, AI-generated product imagery, synthetic voiceovers in marketing videos, or tools that screen job applicants. For them, the omnibus produces a clear order of operations.
There is a commercial argument here too. Transparency labeling is cheap compared with the reputational cost of customers discovering they were talking to a bot or looking at a synthetic image without being told. Businesses outside the EU that sell into it should treat these rules as the emerging baseline, because customers rarely distinguish between jurisdictions when trust is broken.
The omnibus centralizes enforcement of general-purpose AI in the EU AI Office, according to McCann FitzGerald. National authorities handle much of the rest, which is why the AI Board's discussion of enforcement priorities and member state coordination at its September 17 meeting matters. Uneven national enforcement has been a recurring concern with EU digital law, and the Board is the venue where that gets ironed out.
Watch for three things before year-end. First, final Commission guidelines on Article 50 transparency, which will clarify exactly how chatbot disclosures and content labels should work in practice. Second, how providers implement machine-readable marking ahead of December 2, and whether the Code of Practice on AI-generated content becomes the de facto standard. Third, the high-risk classification guidelines, which will tell companies whether their hiring, lending or education tools fall inside Annex III. The delay bought time. It did not change the destination, and the businesses that use the extra months well will be the ones that never notice the deadline when it finally arrives.
A September research announcement revisits BASE-STEP’s March 2026 antiproton transport. The scien...
Ahead of November 3, UNESCO’s 2026 designations offer a way to read conservation, livelihoods and...
Following the October 21–25 edition in Las Palmas de Gran Canaria, consider how a clip, artist pr...
Account
Cart