AI Act: what has applied since 2 August 2026 and what the Omnibus postpones

Since 2 August 2026, the AI Act has applied almost in full, with one obligation that affects nearly every company integrating AI: the transparency rules of Article 50. At the same time, the Digital Omnibus has pushed back the high-risk rules. Here is what is enforceable today, what has moved, and a practical checklist for your chatbots, generated content and RAG assistants.

The AI Act timeline after the Omnibus

Regulation (EU) 2024/1689 on artificial intelligence entered into force on 1 August 2024, with a phased application [1]. Regulation (EU) 2026/1744, known as the “Digital Omnibus on AI”, changed several of its dates [2]. Here is the consolidated timeline.

Milestones already passed

Three obligations have been in place since 2025 and are often underestimated:

• Prohibited practices (2 February 2025): social scoring, manipulation that exploits vulnerabilities, emotion recognition at work and in schools with some exceptions, and so on. From 2 December 2026, the Omnibus adds systems that generate realistic intimate images of an identifiable person without consent, as well as child sexual abuse material [2].
• AI literacy (Article 4, 2 February 2025): providers and deployers must train their teams. The Omnibus rewrote the article: they must now “take measures to promote” this literacy, with no obligation to guarantee “a specific level” for each individual [2]. The obligation remains; a documented AI strategy and awareness-building programme is still the best evidence.
• General-purpose AI models (2 August 2025): obligations for model providers. Since 2 August 2026, the Commission can fine them up to 3% of worldwide turnover or €15 million (art. 101) [1][6].

AI Act August 2026: the transparency obligations of Article 50

Article 50 creates four obligations, split between the provider (who develops or has the system developed and puts it into service under its own name) and the deployer (who uses it under its own authority) [1].

Chatbots and assistants: announce the AI

Providers must design systems intended to interact directly with people so that those people know they are interacting with an AI, “unless this is obvious” to a reasonably attentive person (Art. 50(1)). The information is given “at the latest at the time of the first interaction” and must meet accessibility requirements (Art. 50(5)).

Generated content: machine-readable marking

Providers of systems that generate text, images, audio or video must mark the outputs “in a machine-readable format” and make them detectable as generated or manipulated by an AI (Art. 50(2)). Exception: standard formatting assistance functions, or functions that do not substantially alter the data provided. For systems already on the market before 2 August 2026, the Omnibus allows until 2 December 2026 [2][3].

If you integrate a third-party model, check that your pipeline does not destroy the marking applied upstream. Example of a check at the end of an image pipeline, using the open-source tool from the C2PA coalition:

# Le manifeste de provenance est-il encore présent après recadrage et compression ?
c2patool visuel-final.jpg
# Aucun manifeste trouvé = le marquage a été perdu : corriger l'étape de traitement

Deepfakes and public-interest texts: labelling

For deployers (Art. 50(4)):

• any deepfake (image, audio or video resembling real people, places or events and that could pass as authentic) must be disclosed as generated or manipulated; for an obviously artistic, satirical or fictional work, the disclosure is limited to a form that does not hamper the work;
• a text published to inform the public on matters of public interest must be disclosed, unless it has undergone human review or editorial control and a person holds editorial responsibility.

Finally, paragraph 3 covers emotion recognition and biometric categorisation systems: the people exposed to them must be informed.

Code of practice and guidelines

The Commission published the code of practice on the transparency of generated content on 10 June 2026, assessed as adequate together with the AI Board; around 190 organisations had signed it by the end of July 2026 [5]. Its guidelines on Article 50 date from 20 July 2026 [4]. Two caveats: these texts are not binding, and the Omnibus reminds us that codes do not create a presumption of compliance [2]. They remain the best indication of what the authorities will expect.

Provider or deployer: who is responsible for what?

The role depends on what you do with the system, not on who trained the model. A “downstream provider” is defined as the provider of an AI system that integrates a model, whether supplied by itself or by a third party (art. 3) [1]. An indicative grid:

Mixed situations deserve a dedicated analysis: our audit and consulting offer includes a mapping of AI uses and the roles that go with them.

What the Digital Omnibus (EU) 2026/1744 changes

Adopted on 8 July 2026, published in the Official Journal on 24 July and in force since 27 July 2026 [2]:

What the Omnibus does not change

The Omnibus does not postpone Article 50 (apart from the marking deadline for existing systems), the prohibited practices of 2025, or the obligations on general-purpose models. If your project is a chatbot or a content generator, the postponement of high risk probably does not concern you. It does concern a CV-screening or credit-scoring tool: you gain sixteen months, not an exemption.

Who enforces it in France?

The scheme presented by the French government on 9 September 2025 gives coordination and the role of single point of contact to the DGCCRF (the French consumer protection and fraud control authority) [7]. For Article 50, it provides that the DGCCRF and Arcom oversee systems that interact with people and those that generate content or deepfakes, Arcom alone oversees public-interest texts, and the CNIL oversees emotion recognition and biometric categorisation [7].

This scheme goes through the bill adapting French law to EU law adopted by the Senate on 18 February 2026; as of 4 September 2026, it was still at first reading in the National Assembly [8]. The regulation’s obligations nevertheless apply directly, and the Commission’s AI Office began enforcing the text on 2 August 2026 in cooperation with national authorities [6].

Penalties: up to €35 million or 7% of worldwide turnover for a prohibited practice; up to €15 million or 3% for the transparency obligations of Article 50; €7.5 million or 1% for incorrect information. For SMEs, and now small mid-cap companies, the lower amount applies (art. 99) [1][2].

Checklist: chatbot, content generation, RAG

Chatbot or customer assistant

• [ ] “You are talking to an AI” notice visible before or at the first message, readable by a screen reader
• [ ] No misleading persona; access to a human indicated
• [ ] Conversation logging with a defined retention period (GDPR)
• [ ] If the assistant acts (booking, ticket, refund): a bounded scope of actions, as for autonomous agents

Minimal example of a notice:

<p class="chat-notice" role="note">
  Vous échangez avec un assistant automatisé (IA). Ses réponses peuvent contenir des erreurs.
  <a href="/contact">Parler à un conseiller</a>
</p>

Content generation

• [ ] Inventory of the tools that generate text, images, audio or video, and of their providers
• [ ] Machine-readable marking checked at the end of the pipeline (metadata preserved)
• [ ] Labelling rule for deepfakes, including in advertising
• [ ] Documented human review process for public-interest texts

RAG and internal assistants

• [ ] Sourced answers, citing the documents used
• [ ] Refusal to answer when the source does not exist, rather than an invented answer
• [ ] Document access rights respected in the index
• [ ] Internal users informed and trained (Article 4)

These points are as much about quality as compliance: this is our approach to LLM and RAG integration.

Governance

• [ ] Register of AI systems: use, provider, role (provider or deployer), risk level
• [ ] Check that no use falls under a prohibited practice or Annex III
• [ ] Records of training and awareness materials
• [ ] AI clauses in contracts with your suppliers and your clients

Frequently asked questions

Bringing your AI projects into compliance without freezing them

The AI Act does not require you to stop your AI projects: it requires you to make them explicit, traceable and under control. For most companies, the 2 August 2026 deadline comes down to three short workstreams: announcing the AI in interfaces, preserving the marking of generated content, and documenting who does what. The postponement of high risk leaves time for sensitive cases, provided you use it.

If you also deliver software, read our article on the Cyber Resilience Act and vulnerability reporting: the two timelines cross in 2027. To map your uses or bring a chatbot or RAG assistant up to standard, contact us: reply within 48 to 72 hours, no-commitment discussion, under NDA.