In July 2026, the European Union revised the timeline of its artificial intelligence regulation, the AI Act. The “Digital Omnibus on AI” regulation, numbered 2026/1744, was adopted on 8 July, published on the 24th and entered into force on 27 July. The headline you read everywhere, “the AI Act is postponed”, is only true for part of the text. If your app includes a chatbot, an assistant that writes or a tool that generates images, some rules already apply, and one deadline falls in a month.
The timeline, as it stands today
- Since 2 February 2025: prohibited practices and the AI literacy obligation
- Since 2 August 2025: rules for general-purpose AI models, those of the large providers, governance and penalties
- Since 2 August 2026: the Article 50 transparency obligations, which the Omnibus did not postpone
- 2 December 2026: deadline for marking content generated by systems already on the market before August, and two new prohibitions take effect
- 2 December 2027: high-risk systems listed in Annex III, such as recruitment or credit, instead of 2 August 2026
- 2 August 2028: AI built into already regulated products, such as medical devices, instead of 2 August 2027
The postponement therefore mainly concerns high risk. For the vast majority of SMEs, which add an assistant or content generation to their product, the transparency rules are what matters, and they are in force.
A chatbot must say it is a chatbot
Article 50 requires systems meant to converse with people to be designed so that they know they are talking to an AI, at the latest at the first interaction, unless it is obvious to a reasonably attentive person. That is the typical case of a customer service assistant, a conversational agent or an avatar. This obligation has applied since 2 August 2026, with no grace period. In practice, a clear notice when the conversation opens is often enough, provided it is visible and not buried in the terms and conditions.
Generated content must be marked
The second obligation is more technical: text, images, audio or video produced by an AI system must be marked in a machine-readable format, so that it can be detected as generated. It falls on the system’s provider, and does not cover functions that merely format or do not substantially change what the user typed in. For systems placed on the market before 2 August 2026, the Omnibus grants a deadline of 2 December 2026. Some articles announced 2 November: it is indeed 2 December, and that deadline only concerns marking.
In June 2026, the Commission published a code of practice on marking and labelling generated content, which it considers suited to these obligations. Following it helps, but the Commission itself specifies that adhering to it does not on its own prove compliance. On the user side, those who publish deepfakes, or generated texts meant to inform the public on matters of public interest without editorial review, must also disclose it.
The AI Act’s postponement mostly postponed other people’s obligations. A chatbot’s obligations are already in force.
Who is a provider, who is a deployer
The regulation distinguishes the provider, who develops or has an AI system developed and places it on the market under its own name, from the deployer, who uses it under its own authority in a professional setting. An SME that integrates a large provider’s model into an app under its brand is, on a cautious reading of the text, the provider of the system it offers, even if it did not train the model. Rules aimed at the model itself remain with its publisher, but informing users and marking the content of your app are for you to organise.
High risk: postponed, not removed
Some uses remain classified as high risk and will be subject to heavy requirements from 2 December 2027: screening applications or assessing candidates, assessing a person’s creditworthiness or giving them a credit score, assessing pupils’ learning outcomes, pricing life or health insurance. If your product does any of these, the postponement is a reprieve, not an exemption. The deployer will notably have to entrust oversight of the system to competent people, keep its logs for at least six months and inform workers before any use in the workplace.
What the Omnibus eases for SMEs
- AI literacy: businesses must still take steps to train their staff, but no longer have to guarantee a given level for each person
- Simplified documentation for high-risk systems, with a Commission form, extended to small mid-cap companies
- Proportionate penalties: authorities must take account of SMEs’ interests and viability
- Easier access to regulatory sandboxes, which must exist in every Member State by 2 August 2027
Penalties remain serious: up to €35 million or 7% of worldwide turnover for a prohibited practice, and up to €15 million or 3% for a breach of the transparency obligations. In Belgium, the supervisory authority had not yet been formally designated in early September according to the Commission’s list; the BIPT is preparing for the role. The lack of a designated regulator does not suspend the obligations.
What to do now
For an app that integrates AI, the list is short: identify the features that converse with users or generate content, show clearly that it is an AI, plan the marking of generated content before 2 December, and check that no feature touches a high-risk use. It is also the right time to ask whether each AI feature genuinely serves the product, rather than the trend.
This is not legal advice: for a sensitive use, a lawyer will decide. It is, however, a topic we address from the design stage in applied AI: a visible notice, planned marking, useful logging, and no high-risk feature slipped in unknowingly. Tell us what your AI does: we will tell you what the text asks of you, and what it does not.