For two years, August 2, 2026 was the date on the compliance roadmap: the day the high-risk rules would apply. Teams scoped which of their AI systems were high-risk and planned logging and human oversight backward from it. Then, days before the date, the European Union published an amending regulation, and the plan most teams had built no longer matched the law.
The mistake now is to read the change as a reprieve. Transparency duties that apply to ordinary customer-facing agents did start on August 2, enforcement for the rules already in force switched on, and the high-risk capabilities that moved take longer to build than the delay gives. What follows is the order in which an agent deployer should make its decisions.
What moved on July 27, and what did not
The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on July 27, 2026, three days after publication in the Official Journal [6]. The Commission's AI Act Service Desk now shows Article 113, which sets the application dates, as amended [2]. The Act still applies generally from August 2, 2026. Sections 1 to 3 of Chapter III, which hold the classification of high-risk systems, their requirements and the obligations of providers and deployers, now apply from December 2, 2027 for systems high-risk under Article 6(2) and Annex III, and from August 2, 2028 for systems high-risk under Article 6(1) and Annex I [2].
The Commission's implementation timeline describes August 2, 2026 as the date when the majority of the Act's rules come into force and enforcement starts: the Article 50 transparency rules apply, innovation support measures apply, and enforcement begins at national and EU level for general-purpose AI models, prohibited practices, transparency and AI literacy [1]. The Commission ties the new high-risk timeline to the availability of standards and other support tools [11].
Prohibitions and AI literacy applied from February 2025 and general-purpose AI rules from August 2025. The Omnibus entered into force on July 27, 2026; August 2, 2026 started transparency duties and enforcement; high-risk obligations now follow in December 2027 and August 2028.
| Obligation | Applies from | What changed in 2026 | Relevance to agent deployers |
|---|---|---|---|
| Prohibited practices (Article 5) | February 2, 2025; enforcement from August 2, 2026 | Two new prohibitions added, applying from December 2, 2026 [1][2] | Check that no agent performs a practice Article 5 prohibits, and that none can generate the newly prohibited content |
| AI literacy (Article 4) | February 2, 2025 | Reworded: providers and deployers take measures to support AI literacy, without having to guarantee any individual's level [4] | Train the people who operate and supervise agents, and keep a record of what you did |
| General-purpose AI model obligations | August 2, 2025; Commission enforcement from August 2, 2026 [1] | No change to the dates | Mostly falls on model providers; deployers inherit their documentation |
| Transparency (Article 50) | August 2, 2026 | Article 50(2) marking: systems on the market before August 2, 2026 have until December 2, 2026 [1] | Agents that talk directly to people must say they are AI unless it is obvious [3] |
| High-risk systems, Annex III uses | December 2, 2027 [2] | 16 months later than first planned, the general date of August 2, 2026 [11] | Agents used in areas such as employment or education, with record-keeping and human oversight duties [12][13] |
| High-risk AI in regulated products, Annex I | August 2, 2028 [2] | 12 months later than first planned [11] | Agents embedded in products covered by EU product-safety legislation |
| Penalties for operator and transparency duties (Article 99(4)) | Set by member states | Fines up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher [5] | Article 50 breaches sit in this band, alongside deployer obligations under Article 26 once they apply |
Decision 1: which of your agents talk to people?
This is the obligation most deployers meet first, and it applies today. Under Article 50(1), AI systems intended to interact directly with natural persons must be designed so that the people concerned are informed they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person given the context [3]. Article 50(5) adds that the information must be clear and distinguishable and given at the latest at the first interaction [3].
List every agent that faces customers, applicants or the public, and check its first message. A chat widget labelled only with a first name and a photo probably does not meet the bar. A coding agent used only by engineers who know they are using AI looks like the obvious case the article exempts, but confirm that with counsel rather than assuming it.
Decision 2: are you the provider, the deployer, or both?
Article 50(1) places the design duty on providers, and other duties fall on deployers. Which one you are for a given agent depends on how it was built and placed on the market, and a company that builds its own agent on a third-party model may be both. Ask counsel now, agent by agent, and record the answer. The stakes are set: Article 99(4) puts breaches of the Article 50 transparency obligations in the band of fines of up to EUR 15 million or 3% of worldwide annual turnover [5].
Decision 3: does any agent generate content, and where does it go?
Providers of systems that generate synthetic audio, image, video or text must mark outputs in a machine-readable format so they are detectable as artificially generated, with exceptions for assistive editing [3]. Systems on the market before August 2, 2026 have until December 2, 2026 for that marking [1]. Deployers of a system that generates text published to inform the public on matters of public interest must disclose that it was generated, unless the text has gone through human review or editorial control and someone holds editorial responsibility [3]. An agent drafting customer emails is in a different position from one publishing news-style updates.
The same date carries two new prohibitions added by the Omnibus, covering AI systems that generate non-consensual intimate imagery and child sexual abuse material, which apply from December 2, 2026 [1][2]. Confirm that no system you run can be used to generate that content.
Decision 4: could an agent be high-risk in December 2027?
Annex III covers uses such as employment and education, so an agent that screens job applicants or ranks candidates is likely in scope from December 2, 2027 [6]. That is about 15 months away, which is not long for what a high-risk system needs. Article 12 requires high-risk systems to technically allow the automatic recording of events over their lifetime, and Article 14 requires that people can oversee them in use, including the ability to override the output or interrupt the system through a stop button [12][13].
Both are engineering work, not paperwork, and both take time to produce evidence: a log that starts the month before the deadline shows very little. Start now: give a likely high-risk agent a narrow tool list, put a person in front of its consequential outputs, and log each recommendation with the inputs that produced it, so that by 2027 you have a year of records rather than a plan.
Decision 5: can you show what you did on AI literacy?
Article 4 has applied since February 2025, and the Omnibus reworded it: providers and deployers take measures to support AI literacy, without having to guarantee any individual's level [4]. Enforcement of AI literacy began on August 2 [1]. The practical answer is a record of the training given to the people who operate and supervise agents.
Decision 6: what to take from NIST while its guidance is pending
In the US the work is voluntary and earlier in its life. In January 2026, NIST's Center for AI Standards and Innovation (CAISI) published a request for information on security considerations for AI agent systems, open until March 9 [8]. It defined agent systems as at least one generative AI model plus scaffolding software, possibly with sub-agents and running with minimal human supervision. It named indirect prompt injection, data poisoning, backdoored models, and uncompromised models that pursue misaligned objectives or engage in specification gaming, and asked about least privilege and zero trust, approvals for consequential actions, continuous monitoring, constraining the deployment environment, and ways to roll back unwanted actions [8].
On February 5, NIST's National Cybersecurity Center of Excellence released a concept paper on software and AI agent identity and authorization, covering identifying agents, authorization, auditing and non-repudiation, and controls against prompt injection; comments closed April 2 [9]. On February 17, CAISI announced the AI Agent Standards Initiative, with three pillars: industry-led agent standards, community-led open-source protocol work, and research into agent security and identity [7]. On May 18, CAISI summarized the responses to the January request: respondents broadly agreed that agents introduce novel security threats that slow adoption, and that existing cybersecurity principles still apply but need adjusting [10].
A request for information in January, an agent identity concept paper and a standards initiative in February, and a summary of responses in May. NIST has said research, guidelines and further deliverables will follow.
As of late August, NIST had not published agent security guidelines; its announcement said research, guidelines and further deliverables would follow in the months ahead [7]. Until then, read the January request as the clearest statement of what NIST thinks good agent security covers. It points at the same capabilities the AI Act asks for, so one build serves both:
- Know which agents you run and which of them talk to people. Article 50 applies to the second group now, and NIST's identity work starts with identifying agents as distinct from human users [3][9].
- Authorize narrowly. NIST asks about least privilege and constraining the deployment environment, and high-risk oversight duties are easier to meet when an agent's authority is small [8].
- Put a person in front of consequential actions. Approvals appear in NIST's request, and human oversight is a core high-risk requirement from 2027 [8][13].
- Log so that actions can be attributed. Auditing and non-repudiation are an NCCoE focus area, and automatic recording of events is part of the high-risk regime [9][12].
- Plan for undo. NIST asks about rollbacks of unwanted actions, which is also the cheapest way to limit the damage of a mistake [8].
Three dates to put in the plan
Already due: every person-facing agent discloses that it is AI at the first interaction, provider and deployer roles are recorded agent by agent, and the AI literacy measures for the people who run agents are written down. By December 2, 2026: synthetic-content marking is in place for systems already on the market, and nothing you run can generate the newly prohibited content. By December 2, 2027: every likely Annex III agent has a year of logs and a tested way for a person to override or stop it. The first two are checklists. The third is a build, and it starts this quarter.
