AI Act: what applies since 2 August 2026

2 August 2026 was the big milestone of the EU AI Act; it has, however, brought something different from what many expected. This article sets out what applies now, what already applied and what was postponed.

New since 2 August: transparency

Now applicable are, in particular, the transparency obligations of Art 50 AI Act, split by role. The provider of a chatbot or other AI system intended to interact directly with people must design it so that users are informed that they are interacting with a machine, unless that is obvious (para 1); the provider must also ensure that the outputs of a system generating image, audio, video or text content are marked in a machine-readable format as AI-generated (para 2). The deployer, that is, anyone using an AI system under its own authority, must disclose when it publishes deep fakes or AI-generated text on matters of public interest that has not undergone human review under editorial responsibility (para 4); anyone operating emotion recognition must inform the persons exposed to it (para 3). A business that has a chatbot developed and puts it into service under its own name on its website is itself the provider (Art 3(3)) and owes the notice directly. Infringements of Art 50 carry fines of up to EUR 15 million or 3 % of worldwide annual turnover (Art 99(4)); for systems already on the market before 2 August 2026, providers have until 2 December 2026 to implement the marking (Art 111(4)).

In force for a while already

Since 2 February 2025, the prohibitions of certain practices, such as manipulative techniques and social scoring (Art 5), have applied, as has the AI literacy obligation under Art 4. The amending Regulation (EU) 2026/1744, in force since 27 July 2026, has softened the latter: providers and deployers must take measures to support the AI literacy of their staff, but owe neither a specific level of literacy nor any documentation. An internal policy and training remain the obvious means of fulfilling this obligation. On 2 December 2026 two further prohibitions take effect: sexualised deep fakes without the consent of the person depicted and child sexual abuse material.

Postponed: the high-risk obligations

The extensive obligations for high-risk systems, such as AI in recruitment or credit scoring, were postponed by the same amending Regulation: for standalone systems under Annex III to 2 December 2027, for AI embedded in products under Annex I to 2 August 2028 (Art 113(3)(c)). Anyone deploying or planning such systems gains time but should use it, because the requirements on data quality, documentation and human oversight are considerable.

What companies have to do now

For most companies the task list is manageable: check whether your own chatbot identifies itself as a machine, disclose deep fakes and unreviewed AI-generated text on matters of public interest, keep up the AI policy and training as measures for AI literacy, and use the transition period to prepare for any planned high-risk applications. Alongside all this, the GDPR applies unchanged; it remains the stricter standard as soon as AI systems process personal data.