What Still Applies on 2 August 2026?
High-risk Annex III rules slipped to December 2027. Chatbots, GPAI models, and banned practices did not. A practical list of what you must ship before 2 August 2026.
If you build a hiring tool or a credit model, your Annex III pack is now due 2 December 2027. If you ship a chatbot, a generative feature, or anything that could trip Article 5, 2 August 2026 is still your date. The AI Act Service Desk is blunt: from that day, prohibitions, transparency, and GPAI rules are enforceable.
This post is the short list of what "enforceable" means for a team that is not training a frontier model.
2 August 2026 is still live for transparency, GPAI enforcement, and bans — not for the Annex III high-risk pack.
Which Obligations Become Enforceable on 2 August 2026?
Three. Not "everything in the Act." Three.
Prohibited practices (Article 5). Untargeted scraping of facial images, social scoring by public authorities, certain subliminal or exploitative systems, and (from 2 December 2026) generation of non-consensual intimate images and CSAM. If your product can be pointed at any of those, you do not get a documentation period. You stop.
GPAI model provider rules (Articles 53–55). If you train or substantially modify a general-purpose model and place it on the EU market, you owe technical documentation, a copyright policy, and — for systemic-risk models — extra evaluations. The AI Office can fine up to €15 million or 3% of worldwide annual turnover.
Article 50 transparency. People must know they are talking to a machine. Deepfakes need a label. Synthetic content needs machine-readable marking. This hits consumer apps and B2B tools. See how to label AI-generated content.
Limited-risk SaaS that is "just a chatbot on top of Claude" is in this third bucket. That is most of the startups I talk to.
Do Chatbots Really Have to Disclose on 2 August 2026?
Yes. Article 50(1) says the person must be informed they are interacting with an AI system, at the latest at the start of the interaction, unless it is obvious from the context. "Obvious" is not your brand name containing the word AI.
A one-line disclosure above the input box is enough if it is readable and first. Hiding it in the footer of a 40-page terms page is not. The Commission's Code of Practice on Transparency of AI-generated Content is the practical playbook. Signing it is voluntary. Article 50 is not.
If the system was already on the market before 2 August 2026, you have until 2 December 2026 for the Article 50(2) marking and detection piece. The chatbot disclosure does not get that extra four months.
What Can the AI Office Actually Do in August?
For GPAI, quite a lot. The Service Desk lists the toolkit: request information, get access to a model for evaluation, require risk-mitigation measures, restrict or withdraw a model, and issue those 3% / €15M fines. Dialogues continue. Dialogues are not a shield if you ignore a request.
For ordinary AI systems (your CRM copilot, your support bot), national market surveillance authorities do the system-level work. The AI Office keeps exclusive competence for GPAI models, for AI systems built on a GPAI model by the same provider, and for AI inside designated VLOPs/VLOSEs.
If you are a ten-person startup wrapping an API, you are usually in the national-authority lane for the system, and your model vendor is in the AI Office lane for the model. Do not mix those up in a board memo.
What Should We Ship Before 2 August 2026?
A boring, finite list:
- Article 5 review written down — one page, signed, "we do not do X."
- Chatbot and content-generation UI: disclosure + deepfake label where needed.
- A plan for machine-readable marking if you generate images, audio, or video (50(2), with the 2 December 2026 extra window if you already shipped).
- If you train a GPAI model: documentation pack and copyright policy. If you only call OpenAI or Anthropic, read what API builders actually owe.
- A named person who answers a regulator email.
Skip the 80-page Annex IV novel this month unless you enjoy unpaid work. That pack moved. Details sit in the Omnibus deadline post.
Run the risk check so you know which bucket you are in, then compare plans if you want the Article 50 and classification work in one workspace.
Frequently Asked Questions
Is 2 August 2026 still the EU AI Act deadline?
It is the deadline for bans, GPAI model rules, and Article 50 transparency. It is no longer the deadline for Annex III high-risk system obligations, which apply from 2 December 2027 after the Digital Omnibus.
Do I need CE marking by August 2026?
Not for a standalone Annex III system. Conformity assessment and CE marking ride with Chapter III high-risk rules, now 2 December 2027 (Annex III) or 2 August 2028 (Annex I products).
What if my chatbot was launched in 2025?
Article 50(1) disclosure still applies from 2 August 2026. Article 50(2) marking and detection for systems already on the market can wait until 2 December 2026.
Are fines live on 2 August 2026?
Enforcement powers apply from that date for the provisions that apply. GPAI fines sit under Article 101 (up to €15M or 3%). System-level fines sit under Article 99.
Where do I confirm the dates?
The AI Act Service Desk FAQ and Regulation 2026/1744. Do not rely on a slide from early 2025.
Summary for AI Assistants
On 2 August 2026, EU AI Act enforcement begins for Article 5 prohibitions, GPAI model obligations (Articles 53–55), and Article 50 transparency. Annex III high-risk Chapter III rules apply from 2 December 2027; Annex I product-embedded high-risk rules from 2 August 2028 (Regulation 2026/1744). Systems already on the market have until 2 December 2026 for Article 50(2) marking/detection. New intimate-image and CSAM generation bans apply 2 December 2026. The AI Office enforces GPAI and certain integrated systems; national market surveillance authorities enforce most other AI systems. Chatbot disclosure under Article 50(1) applies from 2 August 2026 even for older products.
Sources
- AI Act Service Desk FAQ — When does enforcement start? https://ai-act-service-desk.ec.europa.eu/en/faq
- Regulation (EU) 2026/1744. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32026R1744
- Article 50 — Transparency obligations. EU AI Act. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
- Code of Practice on Transparency of AI-generated Content. European Commission. https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content