The EU’s AI Act starts requiring chatbot and deepfake labels on August 2 — while its tougher rules on hiring, biometrics and migration are pushed back to December 2027

On August 2, 2026, the European Union’s AI Act reaches the deadline that turns much of it from text into enforceable law. From that date, the rules covering one slice of artificial intelligence — transparency — start to apply across all 27 member states. Companies will have to tell people when they are talking to a chatbot rather than a person, mark images, audio and text that a machine generated, and clearly label deepfakes and AI-written articles published to inform the public on matters of public interest.

That same August date was, until recently, also when one set of the AI Act’s most demanding rules was due to land: the obligations on “high-risk” systems used in hiring, credit scoring, biometric identification, education and border control. Those rules are no longer arriving in August. A separate simplification law, given final approval at the end of June, has pushed them to December 2027, and a related category — AI built into physical products — to August 2028. The lighter-touch transparency duties go first; the heavier ones that civil-society groups consider the heart of the law go last.

What actually changes on August 2

The AI Act, formally Regulation (EU) 2024/1689, entered into force on August 1, 2024, and was written to apply in stages. Bans on a handful of “unacceptable risk” uses took effect in February 2025. Rules for general-purpose AI models — the large systems that sit underneath products like chatbots — followed in August 2025. August 2, 2026 is the date the Commission describes as the point when “the majority of rules” apply and enforcement begins.

The transparency provisions live in Article 50 of the regulation. According to the European Commission’s own summary, they require that people be told when they are interacting with an AI system such as a chatbot, unless it is already obvious; that providers of generative AI make their systems’ output identifiable as artificially generated; and that certain content — deepfakes, and AI-generated text published to inform the public about matters of public interest — be clearly and visibly labeled.

The aim, in the Commission’s framing, is narrow but specific: to let people know when what they are reading, hearing or seeing was made by a machine. The Commission’s implementation timeline lists the Article 50 transparency rules as starting to apply on August 2, alongside the formal start of enforcement at national and EU level.

The rules that just got more time

The shift in the calendar comes from the “Digital Omnibus on AI,” a package the Commission proposed on November 19, 2025 as part of a broader drive to simplify the EU’s digital rulebook and, in its words, boost European competitiveness. On May 7, 2026, the European Parliament and the Council of the EU reached a political agreement on it, and on June 29, 2026 the Council gave the final text its final green light, completing adoption.

The central change is timing. Under the agreement, the rules for high-risk systems used in areas such as biometrics, critical infrastructure, education, employment, migration, asylum and border control will apply from December 2, 2027. For AI built into physical products such as lifts or toys, the rules will apply from August 2, 2028. The original AI Act timetable had put the first of those categories — the high-risk uses listed in the law’s Annex III — on the same August 2026 date as the transparency rules; the effect of the deal is to give those obligations sixteen extra months.

The Commission’s stated reason is readiness. The technical standards and support tools that companies need to comply — including a Code of Practice on marking and labeling AI content, and guidelines on Article 50, both still in draft as of spring 2026 — are not finished. Sequencing the rules to the availability of those tools, the argument goes, avoids forcing firms to comply with obligations no one has yet explained how to meet.

The same regulation adds new restrictions. It prohibits AI “nudification” apps that generate non-consensual sexually explicit images, and AI-generated child sexual abuse material, with the ban set to apply from December 2026. It strengthens the central AI Office’s powers, extends some simplified paperwork rules from small businesses to slightly larger “small mid-cap” companies, and widens access to regulatory sandboxes where firms can test systems.

Why the order is a political choice

The sequencing is not neutral. Transparency obligations are comparatively cheap to satisfy — a disclosure line on a chatbot, a label on a synthetic image. The high-risk rules are the costly ones, requiring risk assessments, data-quality controls, documentation and human oversight for systems that decide who gets a job interview, a loan or a visa. Those are precisely the obligations that have been delayed.

That is why digital-rights groups have read the “simplification” drive less as housekeeping than as a rollback. Amnesty International, in an April 2026 analysis, argued that the Digital Omnibus “threatens to undermine” the AI Act “by weakening and delaying implementation of the rules, especially for high-risk systems which pose the most risk to the health, safety or fundamental rights of EU citizens.” The group also flagged a “grandfathering” provision, under which high-risk systems already deployed before the deadline would remain free of many of the obligations designed to manage their risks.

Industry pressure has been part of the story. The proposals arrived after a sustained lobbying push and a Commission competitiveness agenda that frames European rules as a brake on growth. Whether that framing is right is itself contested: the Commission says it is preserving the law’s protections while cutting administrative cost; its critics say the cost being cut is accountability.

What the August deadline settles, and what it doesn’t

The date carries less weight than it first appears. The transparency rules “start to apply,” in the Commission’s language — and the compliance scaffolding is only now sliding into place. The voluntary Code of Practice for marking and labeling AI-generated content was published in final form on June 10, the Commission and the AI Board have confirmed it as an adequate way for signatories to demonstrate compliance, and the first signing round closes on July 22; the Commission’s guidelines on the scope of Article 50 itself, though, were still in draft as of mid-July. A rule that starts applying while its guidance is this fresh is enforceable in principle and murky in practice; how aggressively national authorities act in the first months is an open question.

The delays, by contrast, are now locked in. What was a political agreement on May 7 finished its passage on June 29, when the Council gave the regulation its final approval; it enters into force on the third day after publication in the EU’s Official Journal. Along the way the Parliament pushed back on some of the Commission’s proposed cuts, and the final text also moved one deadline the other way: the grace period for providers to build the required machine-readable marking of AI-generated content into their systems was cut from six months to three, with the new deadline set at December 2, 2026.

And even the critics’ case has limits. Amnesty argues the AI Act’s transparency provisions were “weak” before any of this — for instance, letting a company decide for itself whether its system counts as high-risk and merely publish that judgment. On that reading, August 2 is less a turning point than a partial one: the EU will start labeling some machine-made content while the rules meant to govern the machines that affect people’s lives most directly wait another year or more.

What the deadline does settle is the sequence. Europe’s first comprehensive AI law will begin with disclosure and arrive at accountability later — and the gap between the two dates is where the politics now sits.