← Blog
Regulation 6 min read

August 2 came and went. What the EU AI Act still asks of agent deployments.

The Digital Omnibus deferred high-risk obligations to December 2027. Transparency obligations took effect on schedule, and record-keeping is the work that did not get easier.

Jul 27
Omnibus entered into force
Dec 2, 2027
Annex III high-risk obligations now apply
Aug 2, 2026
Article 50 transparency applied as scheduled

For a year, August 2, 2026 organized every enterprise AI compliance plan in Europe. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on July 24 and entered into force on July 27, six days before that date. Provisional agreement was reached on May 7, Parliament endorsed the text on June 16, and the Council gave final approval on June 29.

What moved and what did not

ObligationOriginal dateNow
High-risk, standalone Annex III systemsAugust 2, 2026December 2, 2027
High-risk, AI embedded in Annex I regulated productsAugust 2, 2027August 2, 2028
Article 50 transparency (deployers, disclosure)August 2, 2026Unchanged
Article 50(2) marking for systems already on the marketAugust 2, 2026December 2, 2026
Article 5 prohibited practices, new nudifier and CSAM prohibitionsIn force since February 2025Unchanged; new prohibitions added
GPAI provider obligationsIn force since August 2025Unchanged

Reading only the delay headline is the mistake most teams are making. August 2 remained a live compliance date for transparency. Penalty tiers are unchanged: prohibited practices carry fines up to 35 million euros or 7 percent of turnover; transparency and high-risk breaches sit in the 15 million euro or 3 percent tier.

Why it matters for agents

The obligations that anchor high-risk compliance, Article 12 record-keeping and Article 14 human oversight, were deferred, not removed. Both require a record that a decision happened, by whom, and evidence that the control operated afterward. For an autonomous agent the decisions that matter most are the ones nobody typed: which external services it reached, which it was stopped from reaching, and who approved the exceptions. Sixteen months is time to build that record from real operation rather than reconstruct it the quarter before the deadline.

What to do before December 2027

  1. 01Confirm your Article 50 disclosures are live now; that obligation did not move.
  2. 02Classify which agent deployments plausibly fall under Annex III (employment, credit, essential services, and the rest) and start their record-keeping this year.
  3. 03Keep per-agent destination inventories, approval records and decision logs in a system of record with retention, not in a vendor console alone.
  4. 04Treat the deferral as time to run the controls, not to postpone building them. The regulators said as much: implementation efforts are expected to be underway.

See what your agents reached for this week

One policy in Learn Only shows every destination, with the first-seen ones held for review.