The AI Act Delay Did Not Reach Your Chatbot

Three of the AI Act’s transparency duties apply from 2 August 2026, and the delay that filled six weeks of coverage did not touch them. All three come down to telling a person when a machine is involved, at the chatbot, at anything running emotion recognition, and on any deepfake you publish. What moved was the high-risk regime, out to 2 December 2027, and one fourth duty that belongs to your software vendor. Getting the three wrong costs up to €15 million or 3% of worldwide turnover.

Our read is that the delay coverage did more damage than the deadline will. If you read in June that the AI Act was postponed and moved it down your list, the postponed part is almost certainly a part you were never in, because Annex III is HR screening, credit scoring and biometrics. The part that starts on 2 August is a sentence on a screen. It is the cheapest compliance work you will do all year, and it is the easiest to be caught without.

Old AI Images Are Safe. Text Is Judged When You Publish It.

The Commission adopted the final Article 50 guidelines on 20 July with thirteen days to spare. For images, audio and video, what counts is the date the file was generated, so anything made before 2 August 2026 never needs a label. For text on matters of public interest, what counts is the date you publish, which means a piece drafted in July and scheduled for August still needs one. Human editorial review exempts even those. We took the four duties, the exemptions and who carries what apart in our guide to the transparency guidelines.

The image rule is easy and nobody will get it wrong. The text rule is where this bites, because text sits in a content calendar for weeks and the person scheduling it does not work in compliance.

The December Grace Period Is Now Real. It Only Covers What You Already Run.

When we wrote about this on 26 July, the grace period for machine-readable marking depended on a regulation that had not yet published. It has. Regulation (EU) 2026/1744 reached the Official Journal on 24 July and came into force on 27 July, so generative systems already on the market before 2 August 2026 have until 2 December 2026 to mark their output in machine-readable form. Anything placed on the market from 2 August marks from day one. If a vendor points at December, the question back is when their system went on the market. The Commission needed 51 pages to explain four duties, one of which is telling people they are talking to a machine.

A Used Car Dealer Paid €30,000 for Not Saying How Long It Keeps Data

Spain’s AEPD fined Flexicar €680,000 on 28 July over a 2024 data breach, and the split is the useful part. €400,000 for integrity and confidentiality under Article 5(1)(f), €250,000 for security of processing under Article 32, and €30,000 for not stating retention periods under Article 13. Thirty thousand euro for not saying how long you keep the data. A car dealership with web enquiry forms and a leads database is a closer match to most companies reading this than any headline tech fine.

Two You Can Skip

We read these so you do not have to. The Data Omnibus on GDPR is generating coverage about redefining “personal data” and one-click cookie consent, and none of it is law. The compromise text was pulled from COREPER II in late June for want of a majority.

The Code of Practice on Transparency of AI-Generated Content closed its signature window on 22 July. Signing was voluntary and it makes proving compliance easier across all member states, but not being on the list is not an infringement of anything.

Coming Up

6 August 2026. The CBAM consultation on buying and selling certificates closes. Only relevant if you import iron, steel, aluminium, cement, fertiliser, hydrogen or electricity, and only above 50 tonnes a year, which is the threshold that replaced the old €150 per consignment rule.

11 September 2026. Cyber Resilience Act reporting starts for anyone manufacturing products with digital elements. An exploited vulnerability means an early warning within 24 hours and full notification within 72. Products already on the market are covered, which is the part most manufacturers have missed.

Four dates moved in the past six weeks. 2 August moved none of them, and that tells you which deadlines are worth putting in a calendar. Deadlines that wait on harmonised standards or on somebody’s existing inventory will slip again. Deadlines that ask a company for one sentence on a screen never do.