Since the Council's final adoption of the digital omnibus on 29 June, I keep hearing the same sentence in different rooms: "the AI Act has been delayed, we can stand the project down." The first half is a quarter true. The second half is how companies walk into the enforcement that was never delayed.
What moved
The omnibus postpones the high-risk regime: obligations for Annex III systems (employment, credit, education, essential services and the other listed use cases) now apply from 2 December 2027, and for Annex I product-embedded systems from 2 August 2028. The dates are fixed, the proposal to tie them to the readiness of harmonised standards was dropped. Publication in the Official Journal was expected this month; verify the final text before relying on the precise dates.
That is a genuine easing, and for providers it is significant. It is also the only thing that moved.
What goes live on 2 August 2026
Article 50 transparency. If people interact with your AI system, they must be able to tell. Chatbots and voice agents must be identifiable as such; synthetic audio, image and video, deepfakes, must be labelled; AI-generated text published to inform the public on matters of public interest carries marking duties. This lands on deployers, not just providers: the customer-service bot on your website is your problem, not your vendor's.
GPAI enforcement. The obligations for general-purpose AI model providers have applied since August 2025; what starts now is the Commission's power to enforce them, with fines up to €15 million or 3% of global annual turnover. If your group fine-tunes or places models on the EU market, the grace period of polite letters is ending.
The Hungarian layer. Hungary's AI enforcement statute (Act LXXV of 2025) is in force. The designated market-surveillance authority under the national economy ministry has begun organising itself, and the domestic fine ceiling, roughly HUF 13.3 billion, is written into law. Notably, the Hungarian statute requires a domestic regulatory sandbox on the original August 2026 timeline, unaffected by the EU-level postponement. Hungarian-market companies are therefore dealing with a national regulator whose calendar did not move.
Governance and literacy duties that were never tied to the high-risk calendar, including the AI literacy obligation, in force since February 2025, continue to apply. They are cheap to meet and embarrassing to be caught without.
The liability track. Separate from the AI Act but converging on the same systems: the revised Product Liability Directive treats software and AI as products, with member-state transposition due by 9 December 2026, Hungary has already legislated through its Civil Code amendment. The proposed AI Liability Directive was withdrawn, which means claimants will use the product-liability and general tort routes. Under the omnibus package, further prohibitions, including non-consensual intimate content, bite from December; check the final OJ text for the exact scope.
The quarter-truth, priced
So: "delayed" is true for the conformity-assessment paperwork of listed high-risk systems. It is false for transparency, false for GPAI, false for the Hungarian regime, false for liability, and irrelevant for the GDPR, which has governed consequential automated decisions about people the entire time. A recruitment-screening tool did not become safe to ignore because Annex III moved to 2027, ask any lawyer following the US Workday litigation, where exactly such a tool is being tested in court right now.
What I would do before August
Four checks, none of which requires a program:
- Surface check: list every point where a customer, candidate or employee interacts with AI or AI-generated content under your brand. Confirm each one discloses or labels as Article 50 requires, wording, placement, language versions.
- Model check: establish whether anything your group does amounts to providing or materially modifying a general-purpose model. If yes, the GPAI file, technical documentation, copyright policy, training-data summary, needs to exist now, not when the Commission writes.
- Hungary check: if you sell into or operate in Hungary, assign ownership for the national regime alongside the EU one. The authority, the fine cap and the sandbox timeline are domestic facts.
- Momentum check: do not dissolve the high-risk workstream, re-scope it. Inventory and classification work done now is reusable in 2027 and answers GDPR questions today. Standing the team down and rebuilding it in eighteen months is the most expensive available option.
Status notes, 11 July 2026: OJ publication of the omnibus was pending at the time of writing; the December prohibition timing and final wording should be confirmed against the published text. Hungarian institutional details reflect public reporting on the Act LXXV of 2025 regime. Commentary, not advice, timelines here are general, and your systems are specific.