A partial postponement that many read as a full one
On 27 July 2026, Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, entered into force. Its most publicised effect: the compliance deadline for AI systems listed as high-risk in Annex III of the AI Act (recruitment, credit scoring, biometric identification, access to education, border control, administration of justice) moves from 2 August 2026 to 2 December 2027. Sixteen additional months.
In many organisations, this information has passed through GRC and legal teams in simplified form: "the AI Act is for 2027." That reading is inaccurate, and it creates a real exposure.
What the Omnibus does not postpone
Article 50 of the AI Act is not amended by the Omnibus. Its transparency obligations have applied since 2 August 2026, with no grace period linked to the postponement of Annex III.
Three situations are covered.
The first: any AI system that interacts directly with natural persons must inform them that they are dealing with an AI system, unless this is obvious from the context. A customer service chatbot, a virtual onboarding assistant, a product configurator driven by a language model: each of these systems falls under Article 50(1).
The second: providers of generative AI systems that produce audio, image, video or text content must mark their outputs in a machine-readable format, so that they can be identified as artificially generated or manipulated. For existing systems deployed before 2 August 2026, a short grace period runs until 2 December 2026. For any system placed on the market after 2 August 2026, there is no grace period: the obligation applies immediately.
The third: deployers of systems that generate or manipulate image, audio or video by creating realistic representations of real persons, places or events (deepfakes) must disclose that the content is artificially generated. An editorial exemption exists: if the content undergoes prior human review before publication and a natural person holds editorial responsibility for it, disclosure is not required.
A concrete example: the customer service chatbot
Your organisation deploys a conversational assistant on its customer portal in September 2026, powered by a general-purpose language model. Annex III does not apply: this system falls into none of the high-risk categories concerned. You are tempted to conclude that the AI Act does not concern this project for now.
That would be a mistake. The assistant interacts directly with natural persons, who do not necessarily know they are talking to an AI. Article 50(1) has applied since the first day of deployment. The absence of an explicit AI disclosure, or of an equivalent technical mechanism, constitutes an infringement from the moment of deployment.
The penalties provided for non-compliance with Article 50 can reach EUR 15 million or 3% of total worldwide annual turnover, whichever is higher (Article 99(4) of the AI Act). This is not a symbolic sanctions regime.
What your GRC programme must check now
The first step is an inventory. Your organisation probably uses systems that fall under Article 50 without anyone having formally identified them: marketing content generation tools, assistants built into productivity software, online lead qualification bots. Annex III is not the only lens through which to read the AI Act.
The second step is a review of user interfaces. Every point of contact where an AI system addresses a natural person must carry a clear AI disclosure, or make its AI nature evident from the context. "Obvious from the context" is a restrictive notion: a chatbot whose icon resembles a human and whose name is a first name does not meet this criterion.
The third step concerns generative systems. If your organisation uses tools to generate images, synthetic voices or videos for its communications, machine-readable marking of outputs becomes mandatory. For systems deployed before 2 August 2026, the deadline runs until 2 December 2026: fewer than three months remain.
These checks are separate from the compliance work for Annex III. They potentially concern a much broader population of organisations, including those with no high-risk AI in their current scope.
Summary timeline as at 29 September 2026
Since 2 August 2026, the transparency obligations of Article 50 have applied to every newly placed system. The prohibited practices under Article 5 (manipulation of persons, social scoring, certain uses of real-time biometric identification) have applied since 2 February 2026.
On 2 December 2026, existing generative systems must meet the output marking obligation. The new rules on prohibited practices for emotion recognition systems and deepfakes also enter into force on that date.
2 December 2027 is the deadline for Annex III high-risk systems, following the postponement made by the Omnibus (Regulation (EU) 2026/1744, Official Journal of 15 July 2026). It is the only deadline that the Omnibus has changed.
2 August 2028 is the deadline for Annex I high-risk systems (systems embedded in products subject to specific harmonisation legislation: medical devices, machinery, pressure equipment).
The issue for GRC teams
The main risk is not the fine itself. It is the blind spot: organisations that have structured their AI Act programme around Annex III and the 2027 postponement have often not mapped their systems against Article 50. These are two different scopes, two different timelines and two different types of obligation.
The analysis of structural gaps in AI Act documentary governance already addressed the question of systems that fall under the regulation without being identified as such. Article 50 is the most immediate illustration: it does not require you to classify a high-risk system, nor to compile a technical file of 60 pages. It requires you to inform users. This is a simple procedural obligation, easy to verify, and its absence is visible.
A buyer, a regulator or a journalist who tests your chatbot and sees no AI disclosure has in hand a finding of non-compliance. The complexity of the rest of the regulation does not protect you against that check.