A deadline that split in two
For eighteen months, 2 August 2026 was the date every compliance officer in Brussels had circled: the day the EU AI Act's high-risk obligations — conformity assessments, risk-management systems, human-oversight documentation for Annex III systems like hiring tools and credit-scoring algorithms — were due to bite. On 16 June 2026, the European Parliament voted 423 to 57, with 174 abstentions, to approve the Digital Omnibus on AI, pushing those obligations out to 2 December 2027 for stand-alone systems and 2 August 2028 for AI embedded in regulated products such as medical devices (European Parliament Legislative Train). That is a genuine, hard-won retreat — a tacit admission that harmonised standards and conformity-assessment infrastructure were not ready.
What the vote did not touch is the part that actually landed this week. Article 50's transparency duties — telling users they are talking to a chatbot, machine-readable marking of AI-generated content, and disclosure of deepfakes — remained on the original schedule and took effect 2 August 2026, alongside the European Commission's power to investigate and fine providers of general-purpose AI (GPAI) models (Gibson Dunn).
What actually landed
Under Article 50, providers of systems that interact directly with people must make that fact obvious unless it is already apparent from context; providers of systems generating synthetic audio, image, video or text must mark the output as artificially generated in a way that is "effective, interoperable, robust and reliable"; and deployers of deepfakes must disclose them, with carve-outs for law enforcement and clearly-labelled satire (EU AI Act Service Desk, Article 50). Notably, the Omnibus did carve out one transitional mercy: the content-marking duty for systems already on the market before 2 August 2026 does not bite until 2 December 2026, a four-month grace period for legacy deployments (European Parliament Legislative Train).
Separately, the European AI Office — the Commission body responsible for GPAI oversight, staffed by more than 125 people across technical, legal and policy units — gained the authority to demand technical documentation and training-data summaries, commission independent model evaluations with code access, order corrective measures, and fine providers up to €15 million or 3% of global annual turnover, whichever is higher (European Commission, AI Office; Lawfare).
The steelman
Regulators have a real case here, and it deserves to be stated plainly before it's argued against. Undisclosed chatbots and unlabeled synthetic media are not hypothetical harms — they erode the baseline trust that lets people evaluate what they're seeing, at exactly the moment generative tools have made convincing fakes cheap to produce at scale. A disclosure requirement is a comparatively light-touch intervention: it doesn't dictate what AI systems can do, only that people be told when they're interacting with one. Centralizing GPAI enforcement in a single Commission office, rather than scattering it across 27 national regulators, is also a deliberate and defensible design choice — it is a direct response to the fragmentation and inconsistent enforcement that dogged GDPR's early years, where the same conduct produced different outcomes depending on which national authority happened to have jurisdiction.
The catch
The Omnibus retreat is itself the strongest evidence for proportionate regulation: Brussels looked at the original 2026 high-risk timeline, concluded the standards and assessment infrastructure underneath it didn't exist yet, and pulled it back rather than forcing compliance theater onto a deadline nobody could meet. That is regulatory humility working as intended, and it deserves credit rather than reflexive suspicion.
But the same discipline needs to apply to what didn't get delayed. Lawfare's analysis of the AI Office notes that a Pour Demain report recommended scaling its supervisory capacity to at least 160 staff by 2030 — implying that today's headcount, even after the August 2 activation, is "significantly underresourced" relative to a mandate covering every frontier-model provider operating in a market of 450 million people. A fining power that a thin staff can only selectively use tends to produce enforcement-by-anecdote: whichever provider draws the first investigation becomes the de facto precedent for everyone else, without the benefit of settled guidance. The EU's own Article 50 service-desk page carries a candid disclaimer that its text has not yet been updated to reflect the Omnibus amendments — a small but telling sign that even Brussels is still catching up to its own deadline.
The proportionate read
None of this argues for scrapping transparency duties or GPAI oversight — disclosure obligations are close to the regulatory floor, and a well-resourced, centralized enforcer beats a fragmented one. It argues for matching enforcement ambition to enforcement capacity, the same test that just forced a 16-month retreat on high-risk rules. The Commission should publish updated Article 50 guidance and a GPAI enforcement priorities memo before its first public case, not after — otherwise the credibility the Omnibus retreat earned by admitting readiness gaps gets spent again, this time on a deadline nobody delayed.