The AI Act was delayed (but not all of it): what already applies to your company

If you read a few months ago that the bulk of the EU AI Act obligations would apply from 2 August 2026, that information is no longer correct. On 29 June 2026 the Council of the EU gave final green light to the Digital Omnibus and the dates moved. It is the most repeated error in the Spanish specialist press right now, so it is worth being precise.

What was delayed: standalone high-risk systems, those in Annex III, move from 2 August 2026 to 2 December 2027. High-risk systems embedded in already-regulated products, Annex I, move from August 2027 to August 2028. More than a year of extra headroom in both cases.

What did NOT move, and is what affects most SMEs this year: the transparency obligations of Article 50 still apply from 2 August 2026. Two concrete things. First: tell users when they are interacting with an AI system. If you have a chatbot on your site, it has to identify itself as one. Second: mark AI-generated or AI-manipulated content in a machine-readable format. There is a four-month grace period, until 2 December 2026, for systems already in operation.

And here comes the part almost nobody has sorted. Article 4, on AI literacy, has been mandatory since 2 February 2025. Over a year ago. It does not only apply to those who build AI: it also applies to those who use it. If your staff uses AI tools at work, you must be able to evidence that they have received adequate training. It is the most ignored obligation in the regulation and the easiest to breach without noticing.

From that same date, the unacceptable-risk practices in Article 5 have been prohibited. And since August 2025 the obligations for general-purpose models have been in force. None of that was delayed.

In Spain, the Organic Law Bill on the good use and governance of AI was approved by the Council of Ministers on 26 May 2026. It remains a bill, not law in force. It designates AESIA, based in A Coruña, as the main market surveillance authority, and contemplates fines of up to €35 million or 7% of worldwide annual turnover. Public administration is exempt from financial penalties; private companies are not.

Translated into a task list by urgency. One: AI training for your team is already mandatory, start there. Two: map whether you touch any high-risk category. Recruitment, credit scoring, education and access to essential services all are, and many SMEs touch them without realising. Three: review Article 50 before August. Four: if you fine-tune a model or ship it under your own brand, you may legally become a provider and inherit its obligations. Five: GDPR still applies in parallel — the AI Act does not replace it.

It is worth understanding why the delay happened, because it is not what it looks like. On 6 July 2026, Geneva hosted the United Nations’ first Global Forum on AI Governance. Yoshua Bengio, co-chair of the independent scientific panel, described what he called the evidence dilemma: governments need solid proof to legislate, but by the time that proof consolidates, the technology has already jumped again.

Bengio added a figure that explains the urgency: advanced models already demonstrate the ability to deceive humans and to detect when they are being evaluated. This is not a theoretical concern.

That dilemma explains the postponement better than any theory about industry lobbying. Legislating a moving target is hard, and Europe has preferred to arrive late and right rather than early and wrong. For you, as a company, the practical effect is that you have more headroom than you thought on high risk, and none at all on transparency and training.

Our recommendation is not to wait until December 2027 to map your exposure. The audit is cheap now, when you can do it calmly, and expensive when it is already on top of you.