EU AI Act: transparency duties and penalties kick in on August 2, high-risk rules slip to 2027-2028

August 2, 2026 had been circled on European AI calendars for years: the date the EU AI Act was supposed to become fully operational. In the end it played out differently: an important slice of the rules genuinely took effect, while the heaviest part was postponed at the last minute.

What applies now? Mostly transparency. If a company offers a chatbot, it must clearly tell people they are talking to a machine. AI-generated content (text, images, audio, video) must be marked in a format software can detect automatically, somewhat like a digital watermark. Anyone deploying deepfakes must disclose them, and anyone using emotion recognition or biometric categorization systems must inform the people affected. The full penalty regime also becomes applicable, reaching up to 35 million euros or 7% of global turnover for prohibited practices.

What slipped? The most demanding rules, those covering so-called high-risk systems (AI used in hiring, credit scoring, education, or medical devices, for example), were pushed back by the Digital Omnibus package agreed in the spring: standalone Annex III systems now have until December 2027, and AI embedded in regulated products (Annex I) until August 2028.

For ordinary users, the most visible change will be labels and notices: expect to see explicit indications that content was AI-generated or that you are chatting with a bot. For companies operating in Europe, August 2 marks the point where AI transparency stops being a voluntary best practice and becomes a legal obligation with teeth.