Since the Council’s final adoption of the digital omnibus on 29 June, I keep hearing the same sentence in different rooms: “the AI Act has been delayed, we can stand the project down.” The first half is a quarter true. The second half is how companies walk into the enforcement that was never delayed.
What moved
The omnibus postpones the high-risk regime: obligations for Annex III systems (employment, credit, education, essential services and the other listed use cases) now apply from 2 December 2027, and for Annex I product-embedded systems from 2 August 2028. The dates are fixed; the proposal to tie them to the readiness of harmonised standards was dropped. Publication in the Official Journal was expected this month; verify the final text before relying on the precise dates.
That is a genuine easing, and for providers it is significant. It is also the most important thing that moved.
What goes live on 2 August, and what never moved
Article 50 transparency. If people interact with your AI system, they must be able to tell. Providers must build chatbots and voice agents so that people know they are dealing with a machine, and must mark synthetic audio, image, video and text output in a machine-readable format. Deployers carry duties of their own: they must disclose that deepfakes have been artificially generated or manipulated, and the same applies to AI-generated text published to inform the public on matters of public interest, unless it has undergone human review or editorial control and someone holds editorial responsibility for its publication. And if you build the customer-service bot on your website yourself, or have it built and put it into service under your own name, you are its provider: the disclosure is your problem, not your vendor’s.
GPAI enforcement. The obligations for general-purpose AI model providers have applied since August 2025; what starts now is the Commission’s power to enforce them, with fines of up to 3% of annual worldwide turnover or EUR 15 million, whichever is higher. If your group places general-purpose AI models on the EU market, or modifies one so substantially that it becomes the model’s provider, the grace period of polite letters is ending.
The Hungarian layer. Hungary’s AI enforcement statute (Act LXXV of 2025) is in force. The designated market-surveillance authority has begun organising itself, and the highest domestic fine ceiling, HUF 13.3 billion, is set by government decree. Notably, the Hungarian statute requires a domestic regulatory sandbox on the original August 2026 timeline, unaffected by the EU-level postponement. Hungarian-market companies are therefore dealing with a national regulator whose calendar did not move.
Governance and literacy duties that were never tied to the high-risk calendar, including the AI literacy obligation, applicable since February 2025, continue to apply. They are cheap to meet and embarrassing to be caught without.
The liability track. Separate from the AI Act but converging on the same systems: the revised Product Liability Directive treats software and AI as products, with member-state transposition due by 9 December 2026; Hungary has already legislated through its Civil Code amendment. The proposed AI Liability Directive was withdrawn, which means claimants will use the product-liability and general tort routes. Under the omnibus package, further prohibitions, including non-consensual intimate content, bite from December; check the final OJ text for the exact scope.
The quarter-truth, priced
So: “delayed” is true for the high-risk regime of listed systems. It is false for transparency, false for GPAI, false for the Hungarian regime, false for liability, and irrelevant for the GDPR, which has governed consequential automated decisions about people the entire time. A recruitment-screening tool did not become safe to ignore because Annex III moved to 2027: ask any lawyer following the US Workday litigation, where exactly such a tool is being tested in court right now.
What I would do before August
Four checks, none of which requires a programme:
- Surface check: list every point where a customer, candidate or employee interacts with AI or AI-generated content under your brand. Confirm each one discloses or labels as Article 50 requires: wording, placement, language versions.
- Model check: establish whether anything your group does amounts to providing or materially modifying a general-purpose model. If yes, the GPAI file (technical documentation, copyright policy, training-data summary) needs to exist now, not when the Commission writes.
- Hungary check: if you sell into or operate in Hungary, assign ownership for the national regime alongside the EU one. The authority, the fine cap and the sandbox timeline are domestic facts.
- Momentum check: do not dissolve the high-risk workstream; re-scope it. Inventory and classification work done now is reusable in 2027 and answers GDPR questions today. Standing the team down and rebuilding it in eighteen months is the most expensive available option.
Status notes, 11 July 2026: OJ publication of the omnibus was pending at the time of writing; the December prohibition timing and final wording should be confirmed against the published text. Hungarian institutional details reflect public reporting on the Act LXXV of 2025 regime. Timelines here are general, and your systems are specific.