AI Act, 2 August 2026: what actually kicks in and the actions to take now
On 2 August 2026 the AI Act becomes generally applicable, with operational sanctions and transparency obligations. What stands after the Omnibus, what slips, and the actions for the next four weeks.
Less than four weeks remain until 2 August 2026, and around the date two opposite narratives have formed, both wrong. The first, fed by the headlines on the Digital Omnibus package definitively adopted at the end of June, tells of a hollowed-out AI Act, obligations postponed and pressure gone. The second, fed by deadline anxiety, tells of a 2 August on which everything becomes enforceable for everyone. Reality, as often with this regulation, sits in the calendar read line by line, and the calendar says something precise: what slips concerns one category, what kicks in concerns everyone.
What kicks in on 2 August, for everyone
The date marks the regulation's general applicability and the full operability of the sanctions apparatus, with national supervisory authorities at full capacity and ceilings reaching 7% of global turnover for prohibited practices. The transparency obligations of Article 50 become enforceable, the ones touching the largest number of companies: systems interacting with people, customer-facing chatbots first among them, must disclose themselves; content generated or manipulated by AI, deepfakes included, must be made recognisable, with machine-readable marking becoming enforceable from 2 December 2026. The layers applicable for some time naturally remain in force: the prohibitions and the literacy obligation since February 2025, the rules on general-purpose models since August 2025.
What slips, instead: the obligations for Annex III high-risk systems, credit scoring, HR, access to essential services, move to 2 December 2027, and those for Annex I regulated products to 2 August 2028. It is the heart of the Omnibus revision, and for those with systems in those categories it buys real adaptation time on technical documentation, human oversight and quality management systems.
The correct reading of the postponement, though, requires a candour the sighs of relief avoid: bought time serves those who use it. Classifying the systems remains the prerequisite of everything, because without knowing what falls into Annex III you do not even know what the postponement applies to; regulated sectors, as we wrote for finance, remain inside supervisory obligations that slip by not a single day; and the 2027 deadlines have the property of all distant deadlines, they look distant until they no longer are.
The actions for the next four weeks
The list for reaching 2 August in order is short and verifiable. First: the census of systems that interact with people or generate content, from the website chatbot to the marketing tools, verifying that each discloses its nature where the norm requires it; it is the obligation with the widest exposure surface, because it is visible to anyone, competitors and complainants included. Second: the formal verification, put on record, of the absence of prohibited practices, which have been enforceable for a year and a half but from 2 August meet the full sanction ceiling. Third: the documentary evidence of the literacy required by Article 4, the programmes delivered, for whom, with what content, because it is the simplest question an authority can ask and the most embarrassing not to answer. Fourth: the systems register updated with each system's motivated classification, which is today's defence and the work plan towards 2027 at once. Fifth, for those with Annex III systems: the roadmap to December 2027 written now, with the long workstreams, data, logs, human oversight, started before the 2027 queue of consultants and certifiers resembles the GDPR one of 2018.
Readers of this series will recognise that the five actions are not obligations invented for the deadline: they are the governance pieces we have written about for months, the register, the classification, the fluency, arrived at their appointment with the calendar. It is the thesis we opened the year with, and the deadline makes it verifiable: compliance is not produced under deadline, it is harvested, if governance has sown it.
Our AI Rating includes the gap analysis on these obligations in the Risk dimension, with a ninety-day roadmap that for once has a reference date written in the Official Journal: calendly.com/fabiolalli/zerofive, or hello@zerofive.ai. And on Thursday we publish this piece's operational complement, the internal audit checklist in ten verifications, designed to be executed in one week. The time until 2 August is enough for exactly that.