Europe Delayed the AI Act’s Hardest Rules. The Deadline That Binds You Is 2 December.

Two Stories, One Regulation

The coverage of Europe’s AI Act this year has been about a delay. The EU postponed its toughest obligations: standalone high-risk systems listed in Annex III now apply from 2 December 2027, and high-risk AI embedded in regulated products from 2 August 2028.

That is real, and if you are building credit-scoring, hiring or medical-device AI, it bought you a year or more.

It also obscured what did not move. On 2 August 2026 the Act reached general application. Prohibited practices, transparency requirements and the rules for general-purpose AI models all became enforceable that day, on schedule. The European Commission’s own AI Act service desk states it plainly: some enforcement powers of the AI Office and member-state authorities “start to apply on 2 August 2026.”

So the regulation got softer in one place and grew teeth in another, on the same date.

The AI Office Can Now Fine You

The change with the sharpest edge concerns general-purpose AI models. Providers were already subject to obligations from August 2025, but for the first year the Commission could not fine them for a breach. That grace period ended.

The AI Office’s powers now include requesting information, requesting access to a model for evaluation, requiring risk-mitigation measures, and issuing fines of up to 3% of global annual turnover. For a large model provider, 3% of worldwide revenue is not a compliance line item.

Note what that turnover figure is measured against: the company, not the European business. A US or Chinese provider whose EU revenue is modest is still exposed against its global top line.

The Date Most People Have Missed

Article 50 covers transparency — telling people they are talking to a machine, labelling deepfakes, marking synthetic content. It became applicable and enforceable on 2 August 2026.

But the Commission’s guidance carves out one piece with its own clock. Providers have until 2 December 2026 to comply with the marking and machine-readable detection obligation in Article 50(2).

That is ten weeks away, and it is the hardest of the transparency duties to retrofit. Telling a user they are in a chatbot is a UI change. Marking generated output so that a machine can detect it later means watermarking or provenance metadata across every asset your system emits — images, audio, video, synthetic text — including content produced by an upstream model you did not build. If your product generates media in the EU and this is not already on a sprint board, it is the deadline to worry about, not December 2027.

Why the Delay Happened, and What It Signals

The Commission ties the postponement to the availability of standards and support tools, through its Digital Omnibus proposal. The plain reading is that harmonised technical standards were not ready in time, and regulators preferred to move the date rather than enforce against a spec nobody could implement against.

That is an honest reason, and it is also a precedent. A deadline moved once because standards lagged can move again. Build the compliance work on a schedule that assumes the December 2027 date holds — but do not be surprised if firms that gambled on a further slip turn out to be right, and do not let that possibility drive the plan.

The more durable signal is the split itself. Europe chose to delay the rules that require deep engineering evidence and to enforce, on time, the rules about disclosure and model-provider accountability. Disclosure is cheap to legislate and highly visible. Expect other jurisdictions drafting AI rules to copy that order.

What to Watch

• The first GPAI enforcement action. Powers on paper are not powers exercised. Which provider, on what ground, and how large a fine will set the tone for the rest of the Act.
• 2 December 2026. Whether the marking obligation lands with usable technical standards, or repeats the problem that caused the high-risk delay.
• Further omnibus changes. The mechanism that moved the high-risk dates still exists and can be used again.

The practical takeaway for anyone shipping AI into the EU: stop reading the headline about a delay and check which bucket your product sits in. If it generates content, your deadline is in ten weeks. If it makes decisions about people in an Annex III domain, you have until December 2027. If you provide a general-purpose model, you are already inside the enforceable regime, and the meter is running.