AI Act: Obligations for Your Company from August 2, 2026 (and What Is Postponed to 2027)

July 6, 2026 By Miguel Alvarez

The August 2, 2026 is the most important date in the life of the European Artificial Intelligence Regulation since its entry into force. On that day, most of the AI Act begins to apply, including the transparency obligations affecting chatbots, AI-generated content, and deepfakes. Furthermore, it arrives with a last-minute update that is worth understanding well. The European Union has just approved the so-called Digital Omnibus, which postpones the obligations for high-risk systems to December 2027.

In this article, we review the context, explain what applies from August, what has been postponed, and answer the most frequent questions we receive from companies.

What is the AI Act and where do we stand?

The Regulation (EU) 2024/1689, known as the AI Act or European artificial intelligence law, is the world’s first comprehensive rule regulating artificial intelligence. It entered into force in August 2024, but its application is staggered. The underlying approach is that the greater the risk an AI system poses to people, the greater the obligations of those who develop or use it.

The regulation distinguishes four levels.

Unacceptable risk: Prohibited uses, such as subliminal manipulation or social scoring.
High risk: Systems used in areas such as recruitment, education, or access to essential services. They must meet strict requirements for risk management, data quality, and human oversight.
Limited risk: Systems with transparency obligations.
Minimal risk: The rest, the vast majority, can continue to operate without additional requirements.

Two milestones have been met so far.

February 2025: Prohibitions and AI literacy obligations apply, requiring staff working with these systems to have sufficient training.
August 2025: Governance rules and obligations for providers of general-purpose models, such as large language models, apply.

What comes next: the calendar enters its decisive stage

With those milestones already met, the dates that concentrate almost all pending obligations lie ahead.

August 2026: General application of the regulation, with transparency obligations as the main novelty.
December 2027: New deadline for Annex III high-risk systems following the postponement approved by the EU.
August 2028: Deadline for high-risk systems integrated into regulated products under Annex I.

Let’s break it down.

What applies from August 2, 2026

The August 2026 date marks the general application of the regulation. For most companies, the most tangible change is the transparency obligations of Article 50, which affect both those who develop AI systems and those who use them in their business.

Notifying when a person interacts with an AI

If your company has a customer service chatbot, a virtual assistant, or a voice agent, the user must know they are talking to a machine. The notice must be clear and occur at the latest at the time of the first interaction, unless it is obvious from the context.

Marking AI-generated content

Providers of systems that generate synthetic text, image, audio, or video must incorporate a technical marking in that content in a machine-readable format, so that it can be automatically detected that it has been artificially generated or manipulated.

Generative AI systems that were already on the market before August 2, 2026, have a transitional regime and have until December 2, 2026, to incorporate this technical marking.

Note: This obligation primarily rests with providers (those who develop or market the systems). Companies that only use third-party tools do not have to implement the marking themselves, but they must ensure that their providers comply with this requirement.

Labeling deepfakes

Anyone who disseminates images, audio, or video that artificially recreate real people, objects, or events must visibly indicate that it is manipulated content. This obligation is enforceable from August 2 without a transitional period.

Reporting on emotion recognition and biometric categorization

Organizations using emotion recognition systems or biometric categorization in cases permitted by the regulations must inform exposed persons in advance. In the workplace and educational settings, these systems are prohibited, except for very specific exceptions.

Texts of public interest

AI-generated texts published to inform citizens on matters of public interest must indicate their artificial origin, unless they have undergone human review and someone assumes editorial responsibility.

The big news: the Digital Omnibus postpones high risk to 2027

The original calendar envisaged that obligations for high-risk systems would also apply on August 2, 2026. That has changed. Following the agreement reached in May 2026, the European Parliament approved the Digital Omnibus on AI in June, and the Council formally adopted it at the end of that same month.

The result is a new calendar: high-risk systems in Annex III, those used in areas such as employment, education, biometrics, critical infrastructure, migration, or access to essential services, will have to comply with their obligations from December 2, 2027. High-risk systems integrated into products regulated by safety legislation in Annex I, such as machinery or medical devices, have until August 2, 2028.

The reason for the postponement is practical, as the harmonized technical standards and necessary guidelines for compliance were not ready, and the European business community demanded time and certainty. It should be emphasized that the postponement does not affect the prohibitions or transparency obligations, which follow their original schedule.

Sanctions and supervision in Spain

The sanctioning regime has been active since 2025 and deploys its full scope with the general application of the regulation. Fines can reach 35 million euros or 7% of total worldwide annual turnover in the case of prohibited practices, and 15 million euros or 3% of turnover for non-compliance with other obligations, including transparency.

In Spain, the reference authority is AESIA, the Spanish Agency for the Supervision of Artificial Intelligence, which from August 2026 will have full inspection and sanctioning powers.

How to prepare: four reasonable steps

There is no need to wait until December 2027 to get started. A sensible starting point includes four steps.

First, inventory the AI systems that the organization develops or uses, including those that come integrated into third-party tools.
Second, classify them according to the risk level of the regulation to know which obligations apply and from when.
Third, review cases of immediate transparency, namely chatbots, content generation, and any use of deepfakes in communication or marketing.
And fourth, take advantage of the margin until the end of 2027 to adapt high-risk systems calmly, documenting data, processes, and human oversight.

The importance of having a certified technology partner

Complying with the European Artificial Intelligence Regulation is not just a legal matter. Behind every obligation are technical decisions, from marking synthetic content to data traceability or human oversight of models, and executing them well requires experience in real data and artificial intelligence projects.

Working with a certified technology partner provides guarantees on three fronts. It allows for correctly classifying systems according to their risk level, something that conditions everything else. It ensures that developments incorporate the requirements of the standard from the design stage, rather than patching them later. And it facilitates the documentation and evidence that supervisory authorities, such as AESIA, may require in an inspection.

At LISDATA, we approach data and artificial intelligence projects with that foundation. We hold ISO 27001, ISO 9001 certifications and the National Security Scheme in the high category, and we are a Microsoft Solutions Partner in Data & AI, Infrastructure, and Digital & App Innovation. Furthermore, we are part of Anthropic’s Claude Partner Network, with more than ten professionals with current official certification, and our entire Data Governance team is certified by DAMA International in Data Management Fundamentals. These credentials, to say the least, attest to audited processes and up-to-date knowledge in the very areas that the regulation puts to the test.

Frequently Asked Questions (FAQ) about the AI Act

We review some of the most frequent questions about the application of the AI Act in 2026 and 2027.

When does the European Artificial Intelligence Regulation enter into force?

The regulation has been in force since August 2024, but it is applied in phases. Prohibitions apply from February 2025, rules for general-purpose models from August 2025, general application arrives on August 2, 2026, and Annex III high-risk obligations have been postponed to December 2, 2027.

Does the AI Act affect my company if I only use third-party AI tools?

Yes, it can. The regulation imposes obligations not only on providers but also on deployers, i.e., organizations that use AI systems in their business. If you use a chatbot with customers or generate content with AI, transparency obligations apply to you.

What is Article 50 of the AI Act?

It is the article that regulates transparency obligations. It requires notifying when a person interacts with an AI, marking synthetic content in machine-readable format, labeling deepfakes, and reporting on the use of emotion recognition or biometric categorization systems. It applies from August 2, 2026.

What has changed with the Digital Omnibus?

The Digital Omnibus on AI, approved in June 2026, postpones the obligations for high-risk systems in Annex III to December 2, 2027, and those for Annex I systems to August 2, 2028. It does not modify prohibitions or transparency obligations.

What fines does the regulation provide for?

Up to 35 million euros or 7% of total worldwide annual turnover for prohibited practices, and up to 15 million euros or 3% of turnover for non-compliance with other obligations, such as transparency.