The EU AI Act was not delayed: what applies to UK businesses from 2 August 2026

What changed

Regulation (EU) 2026/1744, the Digital Omnibus on AI, was signed at Strasbourg on 8 July 2026, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It defers a large part of the EU AI Act. Under the replaced point (c) of the third paragraph of Article 113, Chapter III Sections 1, 2 and 3, with the exception of Article 6(5), now apply from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 for those classified under Article 6(1) and Annex I. That is a 16-month shift for the Annex III track and 12 months for Annex I. It did not defer Article 50. The European Commission's position is explicit: "Article 50 of the AI Act applies as from 2 August 2026." On 30 July 2026 the Commission announced that the AI Office and national authorities begin enforcing the AI Act on that date.

Why it matters for UK business

The risk in this development is not the law. It is the headline. "EU delays AI Act" is an accurate summary of the largest part of the Omnibus and a dangerous summary of what applies on Sunday, and the two are separated by a distinction most coverage will not make: the high-risk regime moved, the transparency regime did not.

That distinction cuts both ways, and both are worth acting on. A firm that was working towards a quality management system, technical documentation and the rest of the Chapter III obligations for this summer has just gained sixteen months. The Commission's own stated reason, in recital 40, is the delayed availability of standards and common specifications and the delayed establishment of national competent authorities, which is a candid admission that the infrastructure was not ready. A firm that reads that as general relief and pauses its Article 50 work has misread it, and the enforcement date is two days away.

For most UK SMEs the exposure is narrower than the coverage suggests, because scope is genuinely the first question. Article 50 catches a UK business where it places an AI system on the EU market, or where it is a provider or deployer in a third country and the output of its AI system is used in the Union. A firm serving only UK customers is not caught by Article 50 at all. What it inherits instead is second-hand: the tools it buys will increasingly mark and disclose by default, because their vendors are in scope.

Where it does apply, the obligations divide by role. Providers must design systems that interact with people so users know they are dealing with a machine, and must mark generative output in a machine-readable, detectable format. Deployers must disclose emotion recognition and biometric categorisation, and must label deepfakes and AI-generated text published to inform the public on matters of public interest. The exemptions are real but narrower than they first appear. Published text that has had genuine human review or editorial control is exempt from the labelling duty, but the Commission states that "Superficial, solely formal, or procedural checks (e.g. spell-checking or grammatical correction) are not considered to be human review or editorial control". A newsroom-style sign-off qualifies. A pass through a spellchecker does not.

One piece of relief is easy to overstate. A new Article 111(4), inserted by the Omnibus, gives providers of systems generating synthetic audio, image, video or text content placed on the market before 2 August 2026 until 2 December 2026 to comply with Article 50(2). That covers the machine-readable marking duty only, only for providers, and only for systems already on the market. It gives nothing on chatbot disclosure, nothing on emotion recognition notices, nothing on deepfake labelling by deployers, and nothing at all for a system first placed on the market from 2 August onwards. It also lives in Article 111(4), not Article 113, which matters if you are sending someone to read it.

On penalties, Article 50 breaches sit at up to EUR 15 million or 3 per cent of total worldwide annual turnover, whichever is higher. SMEs including start-ups get the reverse of that rule under Article 99(6): whichever is lower. Small mid-caps are treated differently again, and get the lower cap only for the paragraph 4 and paragraph 5 categories under a new Article 99(6a). The two are not interchangeable.

One point should be flagged as open rather than settled. The deferral names Chapter III Sections 1, 2 and 3. Conformity assessment under Article 43 and EU database registration under Article 49 sit in Section 5, which is not named. The provider-facing duties flow through Article 16, which is deferred, so in practice the deferral very likely carries them, but the enacted text does not say so. If you are budgeting against those two obligations specifically, treat the position as unresolved and take advice rather than relying on a summary, including this one.

What to do, and what not to do

Do:

• Settle scope before anything else. Decide, for each AI system, whether you are a provider or a deployer and whether any output reaches users in the EU. That single question determines whether the rest of this applies to you at all.
• If you paused transparency work on the strength of the Omnibus, restart it now. Article 50 is enforced from 2 August 2026.
• Re-plan rather than stand down on high-risk work. Sixteen months is a scheduling gain, not a cancellation, and the standards the Commission cites as missing will arrive during it.
• Check whether your generative systems were on the market before 2 August 2026. If so, the machine-readable marking duty, and only that duty, runs to 2 December 2026.
• Write down what counts as human review in your own publishing process, and keep a record of it. The exemption turns on genuine editorial control, and an unevidenced claim to it is worth little.

Do not:

• Repeat "the EU AI Act has been delayed" without qualification. Prohibited practices, general-purpose AI model obligations and Article 50 transparency are all enforced from 2 August 2026.
• Assume Brexit puts you out of scope. The test is where the output is used, not where the company is registered.
• Treat the Commission's guidelines or the Code of Practice as law. The guidelines are interpretive and the Code is voluntary; more than 180 organisations had signed it as at 30 July 2026, and non-signatories must demonstrate compliance by other adequate means.
• Quote Article 113 from the AI Act Service Desk. Its page still renders the pre-Omnibus text under its own notice saying so. Use the Official Journal.
• Confuse the SME fine cap with the small mid-cap one. They cover different paragraphs of Article 99.

Where The AI Consultancy fits

Working out which of your AI systems are in scope, and turning Article 50 into a short list of disclosures, labels and evidence you can actually maintain, is what our AI readiness assessments cover. For most UK SMEs this is a scoping exercise rather than a compliance programme, and the honest outcome is often that a narrower set of systems is caught than expected. Our June briefing on the Article 50 transparency rules set out the obligations in detail, and that briefing's central call, that the date would hold, has survived a Regulation that moved almost everything around it. The wider picture is in our guide to the EU AI Act for UK SMEs, updated today to reflect the deferral.

Verified on 31 July 2026 against the Official Journal text of Regulation (EU) 2026/1744 (OJ L, 2026/1744, 24.7.2026), European Commission press release IP/26/1714 of 30 July 2026, and the Commission's Article 50 FAQ and transparency guidelines pages. Commission guidance is not binding and can be revised; cite the Regulation for legal propositions. This briefing is general information, not legal advice. Confirm your specific obligations with a qualified adviser.