EU AI Act: what actually kicks in on 2 August 2026

Brussels just postponed the most feared part of the AI Regulation, and half of Spain breathed a sigh of relief. Wrong move: what takes effect on 2 August affects you too, fines included. Here's what's actually being delayed, what isn't, and what your business should have ready in three weeks.

What's actually being postponed

The Digital Omnibus package got final approval from the EU Council on 29 June, after clearing Parliament on the 16th. Its main effect: obligations for high-risk AI systems under Annex III (employment, education, essential services, critical infrastructure) no longer apply from 2 August 2026, but are pushed back to late 2027 or 2028 depending on the case.

If your business uses AI to screen CVs or assess creditworthiness, you've just gained a year and a half of breathing room. But only for that.

What DOES arrive on 2 August

• The penalty regime goes live. Member states must have their authorities designated and the fines system operational. In Spain, that authority already has a name: AESIA, with powers to inspect and sanction.
• Mandatory transparency (Article 50). Content generated or altered with AI must be labelled as such, and any chatbot must disclose that it isn't a person. This reaches your website, your marketing and your customer service.
• The rules for general-purpose models have already been in force for a year, and on 10 June the Commission published its Code of Practice on marking and labelling: the practical guide regulators will use as their reference.

And Spain adds its own layer

Meanwhile, the draft Organic Law for the good use and governance of AI has been moving through Congress since 12 June. It splits oversight between AESIA, the AEPD and the CGPJ depending on the type of system, sets up regulatory sandboxes, and creates a reporting channel with whistleblower protection. Translation: anyone operating AI in Spain will do so under two regulatory layers that land almost simultaneously, the European one and the national one.

The useful part: AESIA has already published the technical guidelines drawn from its high-risk sandbox (12 systems selected out of 44 applications). They're free, and they set the criteria the Spanish regulator will use to look at your AI.

The uncomfortable number

76% of Spanish SMBs already use AI every week. Only 8% have an implementation with documented governance. (Wolters Kluwer and BBVA Research, June 2026)

Nine out of ten SMBs using AI today couldn't produce an inventory if AESIA knocked on the door on 3 August. It's the well-known shadow AI problem: tools the team uses on its own, with no control over what data goes out or what comes in. And adoption keeps climbing: according to Deloitte, 61% of Spanish companies have already rolled out AI (7 points above the European average), but with a huge gap between large companies (80%) and those under 50 employees (35%).

Your three-week checklist

The sensible way to get to August

None of this requires shutting the business down or hiring a legal department. It requires order: knowing what AI you use, documenting it, and making sure every new system arrives with compliance already built in. That's exactly how we approach every project through our turnkey AI implementation service: governance, labelling and logging are included from the design stage, not bolted on afterwards.

If you want to know where your business stands before 2 August, get in touch and we'll walk through it with a quick, no-obligation assessment.