Neither a moratorium nor full implementation: the actual timetable for the AI Regulation
Over the summer, there has been talk that Europe had postponed its Artificial Intelligence Regulation. This is not accurate, and the confusion could prove costly. What has been postponed is a specific set of obligations; the rest of the regulation has been in force since 2 August.
It is worth clarifying the dates, because the relevant question is not ‘Is the Regulation in force?’, but ‘Which article applies to me, and from when?’.
Where we’ve come from
Regulation (EU) 2024/1689 entered into force on 1 August 2024, with phased implementation.
From 2 February 2025, the prohibitions on certain practices and the obligation regarding AI literacy have been enforceable. From 2 August 2025, the obligations relating to general-purpose models apply.
2 August 2026 was set as the date for general application. Three weeks prior to this, Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, amended the timetable. It was adopted by the European Parliament on 16 June 2026 and by the Council on 29 June, and entered into force on 27 July.
What has been postponed
Only the obligations relating to high-risk systems, which are the most stringent: risk management system, data governance, technical documentation, event logging and human oversight.
- High-risk systems listed in Annex III, which are used in areas such as employment, education, biometrics, banking, healthcare, critical infrastructure or access to essential services: these have been postponed to 2 December 2027.
- High-risk systems incorporated into products subject to safety legislation, such as machinery or medical devices: until 2 August 2028.
The reason for the postponement is practical: the harmonised technical standards that were to enable compliance to be demonstrated were not ready. The requirements have not been relaxed; only the date on which they become enforceable has been moved.
What becomes mandatory from 2 August 2026
The most relevant aspects for most companies – which do not manufacture high-risk systems but do use AI in their day-to-day operations – are the transparency obligations:
- To notify users when they are interacting with an AI. If your website has a chatbot, the user must be made aware that they are speaking to an automated system and not to a person.
- Identify content generated or manipulated by AI. This includes synthetic images, audio and video, with specific rules applying to so-called ‘deepfakes’ and to texts on matters of public interest.
- Inform individuals exposed to emotion recognition or biometric categorisation systems.
Market surveillance rules also apply. In Spain, the competent authority is the Spanish Agency for the Supervision of Artificial Intelligence.
And an obligation that many companies still fail to meet
AI literacy has been a requirement since February 2025. Anyone who develops or uses AI systems must ensure that their staff have a sufficient level of training to understand what the tool does, what its limitations are and what risks it entails. This is not a recommendation: it is an obligation that has been in force for over a year.
What to do now
- Carry out an inventory of the AI systems used within the organisation, including those outsourced to third parties.
- Determine the role played in relation to each one: supplier or party responsible for deployment, as the obligations differ.
- Review the risk classification. Postponement does not invalidate the classification: what will be high risk in December 2027 is already conceptually so today, and any contracts signed now should take this into account.
- Comply with the transparency requirements now and provide evidence of staff training.
And bear in mind that the AI Regulation does not replace the General Data Protection Regulation: when the system processes personal data, both apply cumulatively.
