The EU AI Act Deadline You Were Bracing For Just Moved. What Actually Bites on 2 August

I had this conversation three times last week, so it's worth writing down once. A client who sells into Europe had “2 August — AI Act” circled in red, a vague dread attached to it, and no idea what was actually meant to happen. That's the worst combination: a hard date, a big fine attached, and no clarity on whether any of it applies to you. So let's take the dread apart, because the picture changed in May and most people haven't caught up.

Two things were always bundled into that August date, and they've now come unbundled. The first is enforcement of the rules for general-purpose AI models, the big foundation models from the likes of OpenAI, Anthropic and Google. From 2 August 2026, the European Commission can actually enforce those obligations and levy fines. That's on schedule and it's real (see the AI Act implementation tracker for the live timeline). The second is the high-risk category, AI used in things like recruitment, credit scoring, or access to essential services. That's the bucket most ordinary businesses feared falling into. Under the Digital Omnibus, a package agreed in principle on 7 May 2026, the high-risk deadline for those Annex III systems has been deferred from August 2026 to 2 December 2027.

Why the split matters to you specifically

The point that gets lost in the headlines is this: the August enforcement is aimed at the people who build the big models, not the people who use them. If you're a small business running ChatGPT, Claude or Gemini to draft emails, summarise documents, or answer customer questions, the GPAI obligations land on the model provider, which is their compliance burden, not yours. You are a deployer, and the heavy deployer duties live in the high-risk category that just slipped to the end of 2027.

That doesn't mean the Act ignores you. It means the part that touches you is the lighter, sensible part: transparency. If your customers are talking to an AI, they should know it's an AI. If you publish AI-generated content or images, there are labelling expectations coming. None of that is a crisis. It's the kind of thing a reasonable business would want to do anyway, and it's a world away from the conformity assessments and documentation regimes that the word “compliance” conjures.

The ten-minute self-check

I take clients through four questions. You can do this over a coffee without a lawyer in the room, though if you land on the wrong side of any of them, that's exactly when you get a lawyer in the room.

1. Do you sell into, or operate in, the EU or EEA? If you're a purely UK business with no EU customers or users, the EU Act isn't your primary worry, though the UK's own approach is worth watching, and many UK firms adopt the EU standard anyway because their tools are built to it.
2. Are you using AI to make or materially influence a decision about a person? Hiring, firing, credit, insurance, access to a service. If yes, you're in or near the high-risk bucket, the one that now has until December 2027, which is breathing room, not a free pass.
3. Does a customer ever interact with your AI without knowing it's AI? A chatbot that reads as human, an AI voice on the phone. If yes, transparency is your near-term job, and it's a small one: say so.
4. Are you building or fine-tuning your own foundation model? If you have to ask, the answer is no, and the August GPAI obligations aren't pointed at you.

Most small businesses I work with answer “no, no, maybe, no.” That maybe on transparency is the only live action, and it's an afternoon, not a project.

One genuine relief, and one thing not to celebrate too hard

The relief is that the Act explicitly goes easier on smaller firms. Small and medium businesses get simplified technical documentation requirements, and the penalty structure is proportionate. Where a fine is capped at a percentage of turnover, a small firm pays the lower of the percentage or the headline figure, not the eye-watering maximum you see quoted. The Act was not written to bankrupt a twenty-person company over a chatbot. That's worth knowing before the dread sets in.

What I wouldn't do is treat the December 2027 deferral as permission to stop thinking. Deadlines that move once can firm up again, and the high-risk obligations are real work if they apply to you: documentation, human oversight, record-keeping. Sixteen extra months is time to do that properly and cheaply, not time to forget about it until November 2027 and pay a premium to a consultant in a panic. If you're using AI anywhere near a decision about a person, the smart move is to spend a quiet afternoon this autumn writing down what the system does, what data it uses, and where a human checks it. That document is most of the work, and you'll be glad it exists.

What I'd actually do this week

Run the four questions. If you come out “user, not maker, no decisions about people,” then your only near-term job is honesty: make sure anyone talking to your AI knows it's an AI, and label AI-generated content. That's it. Put the December 2027 date in the calendar with a note, and get back to running the business.

The Act is real, the August enforcement is real, and the fines are real. But the version of it that was keeping small business owners up at night was mostly never aimed at them, and the part that might have been just bought everyone sixteen months. Knowing which side of that line you're on is the difference between a calm afternoon and a needless scramble.

Frequently asked questions