Plenty of coverage of the EU AI Act still describes 2 August 2026 as the date the Chapter III high-risk-system requirements, Articles 8 through 15, start applying: risk management, data governance, technical documentation, record-keeping, instructions to deployers, human oversight, and accuracy, robustness, and cybersecurity, for AI systems used in the high-risk contexts Annex III lists (employment, essential services, law enforcement, and more). That description is set to become out of date. The European Parliament adopted a Digital Omnibus package on 2026-06-16 and the Council gave final approval on 2026-06-29; the text has been adopted by both co-legislators and is no longer a proposal, but as of this guide's publish date it is still awaiting Official Journal publication and has not yet formally entered into force. Once published and in force, it moves the application date for those high-risk-system requirements to 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III (standalone systems), and to 2 August 2028 for systems classified under Article 6(1) and Annex I (AI embedded in products already regulated elsewhere, such as medical devices or machinery). A compliance plan still targeting August for those articles is planning against a date the adopted amendment is set to change.
Not everything is moving. Article 50's transparency duties, arguably the ones most directly implemented in application code rather than in a risk-management program, keep their original 2 August 2026 application date. That is the deadline still in front of a team shipping anything that talks to a person, generates content, or reads someone's expression, with one date-specific exception inside Article 50 itself, covered below.
What's still due 2 August 2026
Article 50 sets out four main categories of transparency duty, split between providers (the org that builds the system) and deployers (the org that puts it into use), subject to exceptions including specified law-enforcement uses, and each commonly surfaces in running code, not just paperwork. Art. 50(1): a system a provider designs to interact directly with a person has to make that person aware they are talking to an AI, unless it would be obvious to a reasonably well-informed person anyway, a chat widget, a voice agent, or a support bot needs a disclosure someone actually sees. Art. 50(2): a provider whose system generates synthetic audio, image, video, or text has to mark that output in a machine-readable format detectable as AI-generated; the same omnibus gives providers of systems already on the market before 2 August 2026 until 2 December 2026 to implement this marking piece specifically, no other Article 50 duty carries that transition. Art. 50(3): a deployer running emotion recognition or biometric categorisation on people has to tell the people it is running on. Art. 50(4): a deployer publishing a deepfake still has to disclose it is artificially generated or manipulated; for content forming part of an evidently artistic, creative, satirical, fictional, or analogous work, that disclosure obligation narrows to being made in a manner that does not hamper the work's display or enjoyment, rather than being waived. Separately, AI-generated or manipulated text published to inform the public on a matter of public interest needs the same disclosure unless the content has undergone human review or editorial control and a person or organisation holds editorial responsibility for publishing it.
Each of those duties commonly gets implemented as a UI element, a metadata write, or a copy string, which makes each exactly the kind of thing a refactor can remove without anyone flagging it as a compliance change.
A worked example: a UI cleanup removes the disclosure
Say a support chatbot ships with a persistent line under its first message: "You're chatting with an AI assistant." A later pull request redesigns the widget for a cleaner first-open state and, trimming what a designer flagged as onboarding clutter, drops that line along with three other pieces of intro copy. The redesign is not wrong on its own terms, the widget reads cleaner and the other three lines were genuinely filler. But the Art. 50(1) disclosure was implemented as one of those lines, so removing it removed the disclosure, not just the clutter. Nothing about the diff looks unusual: a copy trim in a chat component is not the kind of thing a bug scanner, a QA pass, or a design review is built to catch.
This is what a compliance check reads a diff for: when a change removes or weakens an element tied to a control a team is tracking, cite Art. 50(1) on the pull request itself, rather than finding out from a complaint or an audit.
The 16-month reprieve is not a green light
The high-risk-system requirements for standalone Annex III systems moving to December 2027 does not make the underlying question, whether a system counts as high-risk under Annex III, any easier to answer later than now, and the controls behind Articles 8 through 15 are the same shape of "moves in a diff" problem the framework hub already tracks: a risk mitigation weakened, a dataset governance check dropped, a human override deleted as dead code. Two other dates are unaffected by this omnibus and already apply regardless: the prohibited-practices and AI-literacy obligations from 2 February 2025, and the GPAI model rules and governance obligations from 2 August 2025. One more change worth knowing about from the same package: a new prohibition covering providers of systems intended to generate or manipulate non-consensual intimate material or child sexual abuse material, or systems for which that output is a reasonably foreseeable and reproducible outcome without significant technical modification and without reasonable and adequate safeguards against it, as well as deployers who use a system for that purpose, added to the Act's list of prohibited practices and applying from 2 December 2026.