Estimated read time: 7 minutes
For most of the past year, the compliance industry has been selling August 2, 2026 as the day the EU AI Act gets serious. Webinars, checklists, gap assessments, a small economy of consultants pointing at a date on a calendar. That date is today. And the single biggest thing on it — the full obligations for so-called high-risk AI systems, the ones covering hiring, lending, education, and essential services — is not happening. A simplification package known as the Digital Omnibus, agreed in June and signed on July 8, pushed those requirements out by roughly a year and a half, to December 2, 2027. Product-embedded high-risk systems slipped further still, to August 2, 2028. If you paid someone to get you ready for today, you are, in a sense, early. But the deadline did not vanish. Real obligations land today, and one of them is the part that touches ordinary small businesses.
Table of Contents
What Moved, and What Didn’t
The EU AI Act has always phased in rather than switching on. The outright bans on unacceptable-risk uses landed in early 2025. The rules for general-purpose AI models — the foundation models everything else is built on — came online in August 2025. August 2, 2026 was supposed to be the load-bearing date: the one where the Act’s core high-risk regime became enforceable across the widest range of real business uses.
Here is the revised picture. Delayed: the Annex III standalone high-risk obligations — risk management systems, data governance, technical documentation, human oversight, conformity assessment — now apply December 2, 2027. The Annex I high-risk systems embedded in regulated products moved to August 2, 2028. Not delayed: the Article 50 transparency duties, the Commission’s supervision and enforcement powers over general-purpose AI model providers, and an expansion of the Article 5 prohibited-practices list to cover systems built to generate non-consensual intimate imagery.
That enforcement item matters more than it sounds. Until now, the GPAI rules existed but the Commission’s ability to actually do something about a violation — demand documentation, run its own evaluations, order risk-mitigation measures, levy fines — was not fully switched on. Today it is. The enforcement apparatus arrives even though most of the obligations it was built to enforce are still two winters away. Regulators get their teeth first and their appetite later.
Why It Got Delayed
The official reasoning is boring and mostly true: the technical standards that companies were supposed to comply against weren’t finished. You cannot reasonably fine a business for failing to meet a harmonised standard that does not yet exist in final form. European standards bodies were running behind, and the choice was either to enforce against a moving target or to move the target.
The unofficial reasoning is that Europe spent the last eighteen months absorbing a steady argument — from industry, from some member states, and loudly from across the Atlantic — that it was regulating a technology it had largely failed to build. The delay is bundled into a broader simplification package that also widened the lighter-touch compliance track to cover small mid-caps, companies up to roughly 750 employees and 150 million euros in revenue. That is a meaningfully larger carve-out than the original small-business provisions, and it did not get there by accident.
Whichever version you find more persuasive, the practical effect is the same: the most expensive parts of AI compliance in Europe just got a year and a half cheaper, and the companies that front-loaded the work are now sitting on documentation nobody will ask for until 2027.
The Part That Actually Touches You
If you run a small business, you were almost certainly never in the high-risk tier to begin with. High risk means AI making consequential decisions about people — screening job applicants, scoring creditworthiness, allocating essential services. Most small companies aren’t doing that. What most small companies are doing is running a chatbot, generating marketing images, and drafting copy with an AI assistant. That is the transparency tier, and the transparency tier was not delayed.
The obligations are refreshingly plain. If a person is interacting with an AI system, they should be told, unless it’s obvious from context. If you generate or meaningfully alter image, audio, or video content synthetically, it needs to be marked as artificially generated in a machine-readable way. Deepfakes get a disclosure requirement. AI-generated text published to inform the public on matters of public interest carries labeling expectations, with carve-outs where a human editor takes editorial responsibility.
In practice this is an afternoon of work, not a compliance program. A line on your chat widget that says you’re talking to an AI assistant and how to reach a human. A note on AI-generated visuals. An internal understanding of where AI touches your customer-facing output — which, if you’ve never actually inventoried it, is a worthwhile exercise regardless of what Brussels wants. Our SaaS AI risk audit walks through that inventory in a way that’s useful even if you never sell a euro’s worth of anything.
Does Any of This Reach a US Business?
Sometimes, and the mechanism is worth understanding because it isn’t the one people expect. The Act is written to be extraterritorial: it applies not only to providers and deployers established in the EU but to those outside it when the output of their AI system is used within the EU. On paper, that’s a wide net. A US company with European users, a chatbot that a customer in Lisbon talks to, an AI feature whose results land on a European desk — all potentially in scope.
In practice, a five-person consultancy in Ohio is not going to hear from a European regulator. What will actually happen is procurement. Your enterprise clients who do sell into the EU will push their obligations downstream through vendor questionnaires and contract clauses, because that is what large companies always do with compliance risk. The first time most American small businesses feel the EU AI Act, it will arrive as a spreadsheet from a customer’s legal team asking whether your product uses AI, where, and how you disclose it.
Having a two-paragraph answer ready is worth more than a compliance binder. Meanwhile the domestic picture stays a patchwork — no single federal AI statute, a growing set of state laws targeting AI in hiring, deepfakes, and disclosure, and sector regulators applying existing authority to new tools. Colorado’s state AI law is the one most often cited as the American analogue to the EU’s risk-based approach, though its own rollout timeline has been amended and is worth re-verifying rather than assuming.
What to Actually Do This Week
Answer the scope question honestly. Do you have EU users? Does your AI output reach anyone in Europe? Do you sell to companies that sell there? Three no’s means this is background reading. Any yes means keep going.
Inventory where AI actually lives in your business. Not the tools you’d list on a slide — the real ones. The support chatbot, the AI in your email platform, the image generator someone on your team started using in March. You cannot disclose what you haven’t catalogued.
Add the disclosures. Chatbot identifies itself as AI. AI-generated media is labeled. This is the whole compliance ask for most small businesses, and it costs you an afternoon.
Write the vendor answer before you’re asked. Two paragraphs: what AI you use, where it touches customers, how you disclose it. When the procurement questionnaire shows up, you’ll paste it in and move on with your day.
Don’t buy a high-risk compliance program right now. If a vendor is selling you Annex III readiness with an August 2026 urgency pitch, they’re either behind on the news or hoping you are. If you genuinely are in the high-risk tier, you have until December 2027 and you should be talking to counsel, not a checklist vendor.
Why Delayed Isn’t Cancelled
There’s a temptation to read an eighteen-month delay as a signal that the whole thing is unravelling — that Europe blinked, and the rules will keep sliding until they quietly stop mattering. That’s a bet, and it’s not a good one. The Act is in force. The enforcement machinery switched on today. The penalty ceilings for GPAI violations run into the millions of euros or a percentage of worldwide turnover, and the Commission now has the authority to use them.
What actually happened is a sequencing change, not a retreat: obligations that required unfinished standards got moved, and obligations that required nothing but honesty stayed put. That’s a reasonable way to run a rollout. It also means the cheap, sensible work — telling people when they’re talking to a machine — is exactly the work that is due now, and the expensive work is the work you have time to do properly.
If there’s a lesson for small business owners, it’s the one that keeps repeating with AI regulation: the compliance panic is usually louder than the compliance requirement, and the businesses that get hurt are rarely the ones that moved too slowly. They’re the ones that spent money on the wrong date.
FAQ
Is the EU AI Act deadline still August 2, 2026?
Yes, but its contents changed. Article 50 transparency obligations and the Commission’s enforcement powers over general-purpose AI model providers apply from August 2, 2026. The Annex III high-risk obligations originally set for that date moved to December 2, 2027.
Does the EU AI Act apply to US companies?
It can. The Act applies to providers and deployers outside the EU when the output of their AI system is used inside the EU. For most small US businesses the realistic exposure is indirect — through enterprise customers passing compliance obligations down through contracts and vendor questionnaires.
Do I have to label my AI chatbot?
If you’re in scope, yes. Under Article 50, people interacting with an AI system must be informed of that unless it’s obvious from the context. A short line on the chat widget is generally sufficient. This obligation was not delayed.
What counts as a high-risk AI system?
Broadly, AI used to make consequential decisions about people — employment and hiring, creditworthiness, education access, essential public and private services, biometrics — plus AI acting as a safety component in certain regulated products. Most small business AI use is not high risk.
What are the fines?
They’re tiered by violation type and run to the millions of euros or a percentage of worldwide annual turnover, whichever is higher. For general-purpose AI model provider violations the ceiling sits in the range of 15 million euros or 3% of worldwide turnover. Penalties for prohibited practices are steeper.
Should I hire a compliance consultant?
If you build or deploy AI that makes consequential decisions about EU residents, talk to a lawyer, not a checklist vendor, and you have until late 2027. If you run a chatbot and generate marketing content, you probably need an afternoon and a disclosure line.
Related Coverage
- Colorado’s AI Law and Small Business Compliance — the closest American analogue to Europe’s risk-based approach.
- SaaS Tools AI Risk Audit — the inventory exercise that makes an AI disclosure policy possible in the first place.
- AI Agent Showdown — what agents actually do, and why autonomous ones raise the regulatory stakes.
This article is general information, not legal advice. Regulatory timelines described here reflect the position as of August 2, 2026 and have already been amended once. If your business may fall into the high-risk tier, consult qualified counsel.
Faceted Media Magazine covers business, AI, and entrepreneurship for the people building what’s next.