Postponed is not the same as paused

In summer 2026 the Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July. A lot of people read the headlines as "everything has been delayed". It has not, and the difference matters to any company with users in the EU.

According to the European Commission's page (last updated 19 October 2026), here is what moved:

• the rules for high-risk systems listed in Annex III now apply from 2 December 2027;

• the rules for high-risk AI built into regulated products (Annex I) now apply from 2 August 2028.

And here is what did not move:

• the prohibited practices and the AI literacy obligations have applied since 2 February 2025;

• the AI Act became applicable on 2 August 2026, with some exceptions, and the transparency rules take effect in August 2026;

• a new prohibition on AI systems that generate non-consensual sexual content and child sexual abuse material comes into effect in December 2026.

There is also a date that is easy to miss. Regulation (EU) 2026/1744 gives providers of generative AI systems already on the market before 2 August 2026 a four-month transition: they must comply with Article 50(2) by 2 December 2026. That means marking AI-generated audio, images, video and text in a machine-readable format so that it can be detected as artificially generated. Law firm Cooley flags the same deadline.

When this article goes out, just over a month remains. Below are five steps that can realistically be done in that time.

Step 1. Build an AI system register

Start with a plain list of what in your business runs on AI models. Not only your own products. Include the chatbot on your website, scoring, recommendations, image and text generation in marketing, coding and support assistants, and the AI features inside the SaaS tools you buy.

For each system, record:

• its purpose and who receives its output;

• who built it: your team or a vendor;

• whether users in the EU can see it;

• whether personal data is involved;

• a named owner inside the company.

This is one spreadsheet, not a quarter-long project. Without it, the remaining steps have nothing to stand on.

Step 2. Work out your role for each system: provider or deployer

The AI Act assigns obligations by role. A provider develops a system, or places it on the market under its own name. A deployer uses a system in the course of its own activities.

For chatbots and generated content, Cooley's summary splits it like this. The provider must disclose that users are dealing with AI unless that is obvious, embed machine-readable markings and offer a detection mechanism. The deployer must disclose that content has been artificially generated or manipulated.

The role is decided system by system. A product company that embeds a third-party assistant into its own service is usually the provider of that service. The same company using an image generator for adverts is a deployer. There are grey cases too, for example where you have modified a model so heavily that you answer for it as its developer. Write those decisions down.

Step 3. Make the chatbot say what it is

If there is a chatbot on your site or in your app, users need to know they are not talking to a person. The only exception is where that is already obvious. In practice, do not rely on obvious.

What to check:

• is there a notice in the chat window itself, and not just in the privacy policy;

• is it visible before the first message;

• does the bot pass itself off as a human through its name, photo or manner;

• is there a route to a real person, if you promise one.

This is the cheapest item on the list and it applies to almost any company with a website.

Step 4. Label generated content and deepfakes

There are two separate duties here. Providers of systems that generate text, images, audio or video must embed machine-readable markings and give a way to detect synthetic content. For systems already on the market before 2 August 2026, this is the obligation that Cooley and Hunton read as due by 2 December. Content published before 2 August does not need to be labelled retroactively.

Deployers who publish artificially generated or manipulated content, deepfakes included (realistic images, video or audio of a person doing or saying something they did not), must disclose it. There is an exception where the content has undergone substantive human editorial review and a person has taken editorial responsibility.

The Code of Practice that the Commission published in final form on 10 June 2026 can help. It is voluntary, but it gives providers and deployers of generative systems a practical route to compliance.

What to do now: identify which of your processes produce AI-generated content, and who decides how it is labelled.

Step 5. Train your people: AI literacy

This duty has applied for almost two years, since 2 February 2025, not from December. If you have done nothing yet, it is the first item to close.

There is no single prescribed programme. A sensible minimum is that people who work with AI systems understand what the tools can and cannot do, where to stop trusting the output, which data must never be pasted in, and whom to tell when something goes wrong. Keep a record of who was trained, when and on what material. It is easier to show an auditor than to explain.

Why start the Annex III inventory now

2 December 2027 feels far away. But the requirements for high-risk systems are extensive and go well beyond a policy document: data quality, documentation, human oversight, logging, testing. None of that can be switched on in a month.

Annex III includes, among other things, credit scoring. If you work in financial services, ask the question directly now: does our scoring fall under this? HR-tech and EdTech teams should check their use cases against the Annex III list in the same way, since recruitment, assessment and learning tools often draw regulators' attention.

The inventory costs almost nothing if it comes as a by-product of the register in step 1. Add a column "in Annex III?" and an owner. If the answer is "maybe", you still have a year to find out calmly, instead of in the final quarter.

What it costs if you do nothing

For breaches of Article 50, fines can reach up to €15 million or 3% of worldwide annual turnover, whichever is higher (per Cooley). For most companies the more practical risk is a customer or partner in the EU asking a question you cannot answer.

Where to start this week

• Draw up the AI system register and name an owner.

• Decide your role for each system: provider or deployer.

• Check the disclosure in your chatbot.

• Find where you produce AI-generated content and how it is labelled.

• Record the AI literacy training.

• Add the Annex III column to the register.

This is for orientation and is not legal advice: agree the final reading of roles and deadlines with counsel. If you need to build the register quickly and sort your systems by role and risk, let's talk. For the wider security picture around those systems, there is also our cybersecurity audit.