EU AI Act compliance deadline is here: What to watch

What the Digital Omnibus changed and why

The delay didn't come out of nowhere. It reflects a problem that has been building alongside the AI Act itself: The rules have moved faster than the infrastructure needed to implement them.

The European Commission proposed the Digital Omnibus on AI in November 2025 as part of its broader Digital Omnibus. The Omnibus on AI was intended to delay certain requirements, giving more time to develop the technical standards, regulatory infrastructure and compliance tools needed to implement the AI Act's high-risk rules. The proposal moved through the EU's legislative process over the following months and entered into force on July 27, 2026 -- just six days before the August 2 EU AI Act deadline it amends.

With the Omnibus now in force, the August timeline has changed substantially. High-risk obligations for standalone Annex III systems, including many employment and credit-scoring use cases, shift from August 2 to Dec. 2, 2027. High-risk obligations for AI embedded in regulated products, such as medical devices and machinery, are pushed to August 2028. One narrower provision also received additional time: Systems already on the market by August get until Dec. 2, 2026, to comply with certain AI-generated content labeling requirements rather than facing an immediate deadline.

The delay should be used to get processes, policies, roles and governance technology in order -- not as an excuse to wait.

The additional time gives businesses more breathing room, but it also brings greater clarity on criteria and expectations that were previously vague, said Guru Sethupathy, GM of AI governance at Optro, a company that provides an AI-powered governance, risk and compliance platform. "The delay should be used to get processes, policies, roles and governance technology in order -- not as an excuse to wait," he said.

The additional runway also reflects a bigger implementation challenge. Businesses have been waiting for the technical standards and guidance needed to turn the AI Act's broad requirements into concrete compliance measures.

The delay was necessary because the EU's broad legislative requirements weren't yet backed by enough guidance to give organizations a clear path to compliance, said Andreas Splittgerber, technology and privacy partner at Reed Smith's Munich office. The gap created a practical problem for enterprises expected to comply without definitive guidance on how to do so.

"The legislative text is very broad and defines the outcomes," Splittgerber said. "But these standards are actually meant to give organizations a very clear list of how to comply with those laws."

What the Omnibus didn't change

The Omnibus changes the timeline for some of the AI Act's most demanding requirements, but it doesn't give enterprises a blanket extension. For example, transparency requirements under Article 50 largely remain on track for August 2. These include rules requiring companies to disclose when people interact with AI and when content is AI-generated.

"Chatbots need to disclose that they're AI and might need to repeat that disclosure periodically, and AI systems can't present themselves as human," Splittgerber said. This could pose challenges for organizations using smaller models that are more prone to hallucinations, he added.

AI-generated content also needs to be clearly marked as such, with the requirements especially relevant to synthetic content and deepfakes, Splittgerber said. Enforcement could initially focus on large digital platforms, while certain legacy systems have received additional time to meet a narrower watermarking requirement.

General-purpose AI (GPAI) requirements were also unaffected by the delay. They have been in effect since August 2025 and remain unchanged by the Omnibus. For enterprises working with frontier-model providers, that means little changes in practice. Providers are still expected to follow the Code of Practice and provide the same required documentation.

What enterprises should watch next

The next phase of the AI Act will be shaped not just by the deadlines that have moved, but by the rules that remain in place, how regulators enforce them and how companies respond.

Five developments are important to watch:

1. Regulatory guidance arrives just before the deadline

The EU's implementation challenge isn't ending with the deadline delay. If anything, the final stretch could reveal how difficult it is to translate the AI Act's broad requirements into consistent rules for businesses.

On July 20 -- less than two weeks before the deadline -- the European Commission adopted final guidelines interpreting Article 50's transparency obligations. The 51-page document is intended to help providers, deployers and national authorities apply the rules consistently. It addresses practical questions businesses have been waiting on, including how to handle deepfake content generated before August 2. The guidelines say businesses don't need to retroactively label older content. The key date is when the content was created, not when it is published or shared. This means a deepfake created before August 2 does not need a label, even if it continues to circulate afterward.

But the timing leaves businesses little room to reassess their systems against the final guidance. The bigger test will be whether authorities across all 27 EU member states interpret and enforce those rules consistently.

2. Enforcement moves from theory to practice

August 2 marks a point at which EU regulators will have greater power to enforce the AI Act. The European Commission will be able to enforce rules covering GPAI, prohibited AI practices, transparency and AI literacy. The European Commission's AI Office has already been working with GPAI providers on how to meet the rules, but from August 2, those discussions can lead to enforcement action and fines.

What regulators investigate first and how strictly they enforce the rules will be an early test of how the AI Act works in practice. Multinational companies will be looking closely at what the rules mean for their operations in Europe and also at whether they need to change their broader AI governance programs.

The first enforcement actions will be especially important to watch because the AI Act has a dual structure, Trustible's Gamino-Cheong said. The AI Office sets standards, while individual member states designate their own agencies to bring enforcement cases.

"I'm watching who gets targeted first," he said, noting that enforcement decisions could raise political questions about whether regulators initially pursue U.S. or EU companies.

The first requests for information and investigations will be important signals, and the political dimension -- whether regulators target U.S. or European companies -- is worth watching, Reed Smith's Splittgerber said.

"Knowing the kinds of things that they're looking at, what they're going after, or even knowing who they're going after will become very relevant," he said.

3. GPAI enforcement could reshape AI procurement

For enterprises building on third-party AI models, the next phase of the AI Act could shift attention from whether a vendor is compliant to what evidence it can actually provide. GPAI obligations have applied since August 2025, but August 2, 2026, is when the Commission's enforcement powers over those requirements take effect, covering technical documentation, copyright policies and systemic risk assessments for the most capable models.

In reality, the standards needed to demonstrate compliance with the Act's high-risk requirements are still being developed.

That creates a practical question for enterprise buyers: What documentation will vendors provide, and how will that affect the buyer's own risk assessment?

Optro's Sethupathy said the growing use of third-party AI is creating a closer link between AI governance and third-party risk management, with procurement teams screening vendors for AI-specific risks as part of their initial assessments. Businesses should focus vendor assessments on three areas: the system's intended use and outputs; certifications and testing, including documentation of bias, hallucination and model drift testing; and liability and remediation, including who's accountable if something goes wrong, he said.

Enterprises should also be careful not to assume an AI-related certification automatically means compliance with the EU AI Act.

"Companies mistakenly believe that certifications such as ISO 27001 or ISO 42001 automatically mean they comply with the AI Act. In reality, the standards needed to demonstrate compliance with the Act's high-risk requirements are still being developed," Gamino-Cheong explained.

Splittgerber also cautioned against assuming model documentation alone is sufficient for due diligence, as it can run hundreds of pages and can be difficult to evaluate. Enterprises should conduct their own testing, he said, to confirm a model performs as expected for its intended use.

"An organization using a model for machine translation, for example, should evaluate how well it performs for the specific languages involved rather than relying solely on vendor documentation," he said.

This could also change how procurement teams evaluate AI vendors. They might increasingly treat regulatory documentation as part of standard AI vendor due diligence, a shift that could influence how U.S. enterprises assess AI vendors even when their transactions aren't directly subject to EU law, Splittgerber added.

4. Governance and documentation still matter

With the high-risk deadlines pushed back by about 16 months, companies might be tempted to put AI inventories, risk classification and governance on hold. But the delay doesn't remove the need for that work.

Businesses should use the additional time to establish the processes, policies, roles and technology needed to govern AI at scale, Sethupathy said. Establish clear policies and processes, define roles and accountability, train employees and adopt technology that scales with the business's AI use. The need is particularly urgent in regulated or high-risk sectors, he said, but other businesses should also start preparing rather than waiting for the next deadline.

If the high-risk requirements had come into effect on August 2, almost any organization out there wouldn't have been prepared.

That preparation starts with understanding what AI systems a business uses. Creating a complete AI inventory is "governance 101," especially as companies work to identify so-called shadow AI and determine which systems pose the greatest risks, Sethupathy said.

"The real value-add customers are asking for isn't just inventory but triage," he said, referring to the need to identify and prioritize the systems that require the most attention.

However, triage can be difficult for businesses that lack visibility into their AI systems. Some companies have more than 1,000 AI agents deployed and lack sufficient visibility to determine which systems qualify as high-risk under the AI Act, Gamino-Cheong said.

The challenge goes beyond simply counting AI systems, Splittgerber said. Enterprises also need enough information to determine which systems the AI Act covers and where to focus their compliance efforts.

"A good inventory is really the first step, partly so that you can know what's in scope or not," he said. "You can start to prioritize where to focus."

But creating an inventory and identifying high-risk systems is only the start. Businesses also need to continuously monitor their AI systems rather than rely on periodic checks, such as annual audits, Sethupathy said. He compared it to a car dashboard: Just as drivers need real-time information about their speed and fuel level, companies need ongoing visibility into AI systems that can operate continuously and change over time.

That ongoing work is important even with the extra time the delay provides. Businesses now have more breathing room, but the delay could become a double-edged sword if organizations use it as a reason to put off work that was never dependent on the original deadline.

However, the delay gives enterprises time they likely needed, Splittgerber countered. "If the high-risk requirements had come into effect on August 2, almost any organization out there wouldn't have been prepared," he said.

5. The timeline is still moving

Even with the delay in place, businesses shouldn't assume the AI Act's timeline is settled. The Omnibus took effect just six days before the August 2 deadline it was meant to delay, giving organizations almost no time to adjust before transparency requirements and GPAI enforcement powers took effect.

This pattern is worth watching. A major law was delayed because of implementation challenges, guidance for rules taking effect in August arrived only days before the deadline and the legislation making the changes was finalized less than a week before the deadline.

The gap in standards that contributed to the delay also hasn't been fully resolved. It has simply been pushed to December 2027. Whether the EU can finalize the necessary standards well before then, instead of waiting until the last minute, could be an important test as the 2027 and 2028 deadlines approach.

Why this matters for U.S. business leaders

For U.S. enterprises, the implications extend beyond the EU compliance timeline. The most important lesson might not be the delay itself, but what it reveals about how difficult it can be to implement broad AI regulations.

The U.S. has no direct equivalent to the EU AI Act, and there's currently no comprehensive federal AI law on the horizon. Instead, the federal government has focused on limiting state-level AI regulation, while several states have moved forward with their own AI rules. This leaves U.S. businesses to navigate a patchwork of regulations while watching Europe attempt something far more comprehensive.

The EU's experience will likely become part of the U.S. debate over how AI should be regulated. Supporters of a lighter-touch approach might point to the delay as evidence of the challenges that can come with strict regulation, while advocates of stronger federal rules might argue that the implementation challenges show why regulations need flexibility and realistic timelines.

The things actually required for the August 2nd deadline are very similar to some stuff that has popped up in a couple of U.S. laws.

EU rules could also affect U.S. businesses indirectly through the global AI providers that must comply with them. These providers might build transparency and disclosure features to meet EU requirements and then make those features available to customers worldwide, rather than create separate systems for European and U.S. users. U.S. businesses buying AI from European or multinational vendors could also face procurement and due diligence requirements shaped by EU rules, even if they aren't directly subject to the AI Act.

The August 2 requirements are especially relevant to U.S. businesses because they overlap with regulatory trends already emerging domestically, Reed Smith's Splittgerber said. For example, requirements to disclose AI interactions and label synthetic content are likely to become more common in U.S. laws.

"The things actually required for the August 2nd deadline are very similar to some stuff that has popped up in a couple of U.S. laws," he said. The higher-risk requirements that have been pushed to a later date, by contrast, are more controversial in the U.S. and would create a heavier compliance burden, Splittgerber added.

U.S. businesses should pay attention because many companies will eventually enter the EU market through direct expansion, resale or distribution, even if they don't operate there today, Optro's Sethupathy said. He expects the AI Act to have regulatory influence similar to that of the GDPR, though he cautioned against viewing it as a single global standard. Instead, he expects a "hodgepodge" of AI rules and frameworks to emerge, with businesses also navigating standards such as ISO 42001 and new requirements around agentic AI.

The AI regulatory landscape is likely to become increasingly fragmented, with different jurisdictions potentially enabling or restricting different AI models and systems, Splittgerber said. As a result, enterprises might gravitate toward vendors and platforms that can operate across multiple regulatory environments, reducing the complexity of managing separate compliance processes for each jurisdiction.

"Organizations are going to prefer models that can operate in a lot of different jurisdictions because it reduces some of their complexity," he said.

For businesses operating on both sides of the Atlantic, the challenge is managing two evolving regulatory landscapes. Compliance teams will need to keep up with changes to the EU AI Act while also navigating an unsettled patchwork of AI rules in the U.S.

Kinza Yasar is a technical writer for Informa TechTarget's AI and Emerging Tech group and has a background in computer networking.