The EU AI Act Did Not Get Delayed: What UK Businesses Owe From 2 August 2026

Eight days ago, on 2 August 2026, the EU AI Act's transparency obligations became enforceable. The European Commission confirmed on 30 July that enforcement begins from that date.

A significant number of UK businesses believe otherwise, and the reason they believe it is understandable.

On 27 July 2026, Regulation (EU) 2026/1744 — the Digital Omnibus on AI — entered into force. It was widely reported as delaying the AI Act. It did delay part of it: the high-risk obligations in Chapter III moved to 2 December 2027 for standalone Annex III systems and 2 August 2028 for AI embedded in regulated Annex I products.

It did not delay Article 50. The transparency obligations applied on schedule on 2 August 2026, with one narrow carve-out covered below.

So there are now two populations of UK business. Those that were preparing for a heavy high-risk compliance workload this summer have gained sixteen months of runway. Those that read "AI Act delayed" in a headline and stood down their transparency work are, as of last week, exposed.

This guide covers what actually applies now, the deadline four months out that most teams have not scoped, whether any of it reaches you as a UK business, and what each obligation means in engineering terms.

This is an engineering guide, not legal advice. Confirm all positions with qualified counsel before they drive build or commercial decisions.

The corrected timeline

The Omnibus was signed at Strasbourg on 8 July 2026, published in the Official Journal on 24 July and entered into force on 27 July — five days before the transparency obligations landed. That compressed sequence is a large part of why the messaging went wrong.

The single carve-out. Article 50(2), covering the marking of AI-generated or manipulated content in a machine-readable format, was postponed to 2 December 2026. That is a shorter deferral than the six months originally proposed. Every other transparency obligation — including those falling on deployers rather than providers — applied from 2 August.

Does this reach you as a UK business?

The AI Act is extraterritorial in the same way the European Accessibility Act is. Establishment in the UK does not remove you from scope.

You are likely in scope if:

• Your AI system is placed on the market or put into service in the EU

• You are a deployer of an AI system located in the EU

• The output produced by your AI system is used in the EU

That third limb catches more UK businesses than the first two combined. A UK company running an AI feature whose output reaches EU users is potentially in scope even with no EU entity, no EU infrastructure, and no EU staff.

Practical scoping questions to answer this week:

1. Do we operate any AI system, including third-party models embedded in our product?

2. Can EU residents interact with it, or receive output from it?

3. Does it generate or manipulate text, images, audio or video?

4. Does it interact directly with humans?

5. Does it perform emotion recognition or biometric categorisation?

If the answer to (2) is yes and any of (3) to (5) is yes, treat yourself as in scope pending legal confirmation.

A caution on the "we just use an API" position. Building on a third-party model does not automatically make you a deployer rather than a provider, and the distinction determines which obligations attach. If you have materially modified a system, or you place it on the market under your own name, your position may differ from what you assume. This is worth an hour of counsel's time.

Article 50: what applies now

Four categories of transparency obligation, live since 2 August.

Disclosure of AI interaction. Where a system interacts directly with people, they must be informed they are dealing with AI unless it is obvious from the context to a reasonably observant person.

Engineering: a disclosure surface at the entry point of any conversational feature. Not buried in terms of service. Persistent enough to survive a user landing mid-flow — deep links, resumed sessions, embedded widgets. The common failure is disclosing on first load and never again.

Disclosure of emotion recognition and biometric categorisation. Where such systems operate, affected people must be informed.

Engineering: if your product does sentiment analysis on user input, infers emotional state, or categorises users on biometric characteristics, that requires notification. Teams frequently do not realise a feature falls into this category until someone asks.

Deepfake disclosure. Where content constituting a deepfake is generated or manipulated, that must be disclosed.

Engineering: provenance tracking through your content pipeline. If AI-generated media can enter your system from any route — user upload, internal generation, third-party feed — you need to know which pieces are synthetic and surface that at display time.

Disclosure for AI-generated text published on matters of public interest. Where text is generated or manipulated by AI and published to inform the public on matters of public interest, disclosure is required, subject to conditions.

Engineering: an editorial metadata field carried from generation through to publication and rendered in the template. Publishers using AI assistance in production need this in the content model, not as a manual step.

The unifying requirement: disclosure must reach the person at the point they encounter the AI or its output. Every one of these is a data-lineage problem before it is a user-interface problem. If your system cannot tell you which content was AI-generated, it cannot disclose it.

2 December 2026: the watermarking deadline

Four months away, and the most substantial engineering item on the list.

Article 50(2) requires providers of AI systems generating synthetic audio, image, video or text content to mark outputs in a machine-readable format, detectable as artificially generated or manipulated. This obligation was deferred to 2 December 2026 — while the rest of Article 50 applied on 2 August.

Why four months is not generous. Machine-readable marking is not a label in your UI. It means embedding provenance metadata into the artefact itself, in a way that survives normal handling and can be detected downstream. Realistically this means C2PA content credentials or an equivalent standard, applied at generation, preserved through your processing pipeline, and not stripped by your CDN, image optimiser or transcoder.

That last clause is where most implementations will fail. Image pipelines routinely strip metadata during resizing and format conversion. Video transcoders discard it. A watermark applied at generation and destroyed at delivery satisfies nothing.

What to do now if you ship any generative feature into the EU:

1. Inventory every generation point — first-party models, third-party APIs, embedded features

2. Determine what marking your upstream providers already apply

3. Audit your media pipeline end to end for metadata preservation

4. Implement marking at generation, verify at delivery

5. Test that the mark survives the actual path a user's content takes

Steps 3 and 5 are the work. Steps 1 and 2 are a week.

If your product generates content at scale, this is a full quarter of engineering and it starts now. This is the kind of infrastructure our AI and machine learning practice spends most of its time on — the governance and provenance layer around models rather than the models themselves, because that layer is what determines whether a deployment is defensible.

The new prohibitions

The Omnibus added to Article 5's prohibited practices: AI systems used to create non-consensual intimate imagery and child sexual abuse material.

Prohibitions are the most serious tier of the Act. Assess whether any capability in your product could be used this way, and whether your safeguards are adequate and documented. For general-purpose image or video generation this is not a theoretical question, and "we did not intend it" is a weaker position than "here are the controls we implemented and tested."

High-risk: use the runway

If your systems fall under Annex III — employment, education, critical infrastructure, law enforcement, credit scoring and similar — you have until 2 December 2027. Annex I embedded systems have until 2 August 2028.

The deferral happened because implementation was visibly off track: national competent authorities were not designated and the harmonised standards providers need to demonstrate conformity were not ready.

The underlying obligations have not changed. Risk management systems, data governance, technical documentation, logging, human oversight, accuracy and robustness requirements — all still coming, on a later date. Sixteen months is meaningful runway for organisations that start now and no help at all to those that treat it as permission to defer again.

The one genuinely useful thing to do with the extra time: build the evidence layer. Model versioning, decision logging, data lineage, evaluation records. It is the foundation every high-risk obligation rests on, it takes longest, and it is useful immediately regardless of AI Act timing — it is also what the UK's own automated decision-making regime now requires, which we cover in our UK data protection guide.

Where the UK sits

No comprehensive UK AI statute. The UK has pursued a sector-regulator approach rather than horizontal legislation, and an AI regulation bill has been before Parliament as a private member's bill without becoming law.

That does not mean UK businesses face no AI rules. Three things already bite:

The DUAA automated decision-making reform. Articles 22A to 22D replaced Article 22 of the UK GDPR from 5 February 2026, flipping the default on solely automated significant decisions from prohibition to permission-with-safeguards. Those safeguards — notification, challenge, meaningful human review — are engineering work, and special category data remains more protected.

Existing sector regulation. The FCA's approach to AI in financial services, the ICO on data protection, the MHRA on AI as a medical device. Sector rules apply whether or not a horizontal act exists.

The EU AI Act itself, via the extraterritorial route described above.

The practical upshot: a UK business with EU-facing AI is likely governed more by Brussels than by Westminster, and building to the stricter standard resolves both.

What to build

Five properties. All are useful independent of regulation.

The pattern is the same one running through UK financial services, health tech and consumer regulation: regulators increasingly require you to demonstrate what happened, not merely to have intended well. Systems built for evidence satisfy multiple regimes; systems that produce good outcomes but cannot show their work satisfy none of them.

Cost, timeline and team shape

The row to act on this month is the first. A scope assessment is cheap, fast, and determines whether anything else on the list applies to you. A meaningful number of UK businesses will find they are out of scope entirely — and finding that out costs a fraction of assuming either way.

Engineers who have actually shipped governed AI systems — versioning, evaluation harnesses, provenance, audit trails — remain the scarcest and most expensive profile in the UK market, commanding £700 to £1,000 per day at the upper end. Rate detail is in our UK developer day rate index. Regionally, Manchester has the largest AI headcount outside London and the south east, with an applied rather than research orientation that suits exactly this kind of work.

Six mistakes

1. Reading "AI Act delayed" and standing down. The high-risk rules moved. Article 50 did not. This is the live exposure right now.

2. Assuming Brexit puts you out of scope. Output used in the EU brings you in, with no EU entity required.

3. Treating machine-readable marking as a UI label. It is provenance metadata that must survive your entire media pipeline, and most pipelines strip it.

4. Assuming "we just call an API" makes you a deployer. The provider/deployer distinction determines your obligations and is not always what teams assume.

5. Treating sixteen months of high-risk runway as sixteen months of nothing to do. The evidence layer takes most of it and is useful immediately.

6. Disclosing AI interaction only on first load. Deep links, resumed sessions and embedded widgets all bypass it.

Frequently asked questions

Was the EU AI Act delayed in 2026? Partially. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and deferred the high-risk obligations in Chapter III to 2 December 2027 for standalone Annex III systems and 2 August 2028 for Annex I embedded systems. The Article 50 transparency obligations were not deferred and applied from 2 August 2026, with the European Commission confirming enforcement begins on that date.

What applies from 2 August 2026? Article 50 transparency obligations, including disclosure that a user is interacting with an AI system, disclosure of emotion recognition and biometric categorisation, deepfake disclosure, and disclosure for AI-generated text published on matters of public interest. Deployer transparency obligations also apply from this date.

What is the 2 December 2026 deadline? Article 50(2), requiring providers of AI systems generating synthetic audio, image, video or text to mark outputs in a machine-readable format detectable as artificially generated or manipulated. This was the single element of Article 50 deferred by the Omnibus.

Does the EU AI Act apply to UK businesses? It can. The Act applies where an AI system is placed on the market or put into service in the EU, where a deployer is located in the EU, or where the output of an AI system is used in the EU. That third route brings UK businesses into scope without any EU entity or infrastructure.

When do the high-risk obligations apply? 2 December 2027 for standalone high-risk systems listed in Annex III, covering areas such as employment, education, critical infrastructure, law enforcement and credit scoring. 2 August 2028 for AI embedded in products already subject to EU product safety legislation under Annex I.

What new prohibitions did the Omnibus add? A prohibition on AI systems used to create non-consensual intimate imagery and child sexual abuse material was added to Article 5.

Does the UK have its own AI Act? No comprehensive statute. The UK has pursued a sector-regulator approach, and an AI regulation bill has been before Parliament as a private member's bill without becoming law. UK businesses remain subject to sector regulation, to the UK GDPR's automated decision-making regime as reformed by the Data (Use and Access) Act, and potentially to the EU AI Act extraterritorially.

How much does AI Act compliance cost? A scope assessment and system inventory typically runs £5k to £20k over one to three weeks and should be the first step. Article 50 disclosure implementation runs £20k to £70k. A content marking and provenance pipeline runs £50k to £180k. Full high-risk conformity programmes run £300k to £1m and beyond.

What should I do first? A scope assessment. Determine which of your systems are in scope, whether you are a provider or deployer for each, and whether EU users receive output. It is inexpensive, takes a week or two, and determines whether anything else applies to you at all.

The short version

The headline said the AI Act was delayed. The high-risk rules were. Article 50 was not, and it has been enforceable since 2 August.

Three things this month.

Run a scope assessment. One to three weeks, and it may tell you none of this applies. That is worth knowing either way.

Check your AI disclosure surfaces. Every entry point, including deep links and embedded widgets — not just first page load.

Start the provenance work if you generate content. Machine-readable marking is due 2 December, that is four months, and the hard part is metadata surviving your media pipeline rather than applying it at generation.

And if you gained sixteen months on high-risk, spend them on the evidence layer. Model versioning, decision logging, data lineage. It is the foundation of every obligation that arrives in 2027, it takes the longest to build, and it is what makes an AI system defensible regardless of which regulator asks.

About Akoode Technologies

Akoode Technologies is an AI and software development company headquartered in Gurugram, India, with a US office in Oklahoma, working with clients across the UK, USA and India. We build AI and machine learning systems, custom software, web platforms, mobile applications and eCommerce platforms for startups, SMEs and enterprises across 15+ industries, with 180+ projects delivered globally and clients across the UK, including London and Manchester.

Verified ratings: 4.9 out of 5 on Google across 110 client reviews, and 5.0 out of 5 on GoodFirms.

If you want a scope assessment against the obligations now live, book a call. It is a short piece of work and it is the one that tells you whether the rest matters.

This article is an engineering guide, not legal advice. Regulatory positions reflect published legal analysis as of 10 August 2026, days after the Article 50 obligations became applicable. The Digital Omnibus on AI is recent and interpretation continues to develop. Confirm scope, provider or deployer status, and all obligations with qualified counsel before they drive build or commercial decisions. Cost bands are indicative planning figures, not quotations.