Has the AI Act been postponed? What really changes in August 2026

In recent weeks, the idea that the European AI Act has been postponed has been circulating. That is only half the story, and the missing half is precisely what will cost a complacent business the most: what has moved is the high-risk chapter, which barely affects a small business; what has not moved is transparency, which affects it directly.

The confusion does not come from the rules themselves: it comes from two separate pieces of legislation with two separate timetables, and a third European text adopted this year that changed some dates but not others.

Two laws, not one

Regulation (EU) 2024/1689, the European AI Act, is the legislation that really matters: it applies directly in all Member States, has been in force since August 2024 and is the source of the substantive obligations. Spain does not need to pass anything for it to be binding.

The Draft Organic Law on the proper use and governance of artificial intelligence is something else. The Council of Ministers approved it on 26 May 2026 and it was published in the Official Gazette of the Spanish Parliament on 12 June, under reference BOCG-15-A-97-1. It is currently before the Committee on Economy, Trade and Digital Transformation, at the amendment stage, with the deadline for submissions extended to 2 September 2026. It remains in the legislative process, and its wording may still change.

What the Spanish law adds is not new obligations for businesses, but the machinery: who monitors compliance in Spain (the Spanish Agency for the Supervision of Artificial Intelligence, based in A Coruña; the Spanish Data Protection Agency; the General Council of the Judiciary and the Bank of Spain, depending on the case), the penalty regime and governance of controlled testing environments, or sandboxes.

In terms of whether anything has been postponed: what can leave a business outside the law does not depend on the Spanish timetable but on the European one, whose most common provisions have already reached their deadline.

The timetable that really matters

Here is the fact several headlines are misreading. The package known as the Digital Omnibus is no longer a proposal: the co-legislators reached agreement on 7 May 2026, the European Parliament approved it on 16 June and it was adopted as Regulation (EU) 2026/1744, in force since July 2026. That regulation postponed part of the AI Act. Part of it, not all of it.

The remaining timetable, in order:

• Since February 2025, the prohibited practices in Article 5 have applied: subliminal manipulation, social scoring, biometric categorisation based on sensitive characteristics.
• Since August 2025, the rules for general-purpose models have applied — the models behind widely used assistants.
• Since 2 August 2026, on their original date, the transparency obligations of Article 50 have applied: Article 50 transparency was not postponed. This includes telling people they are interacting with AI, identifying AI-generated content and providing notice when emotion recognition or biometric categorisation is used.
• On 2 December 2026, the transitional period for marking AI-generated content, the most operational part of Article 50, ends: for systems already on the market before 2 August 2026, that specific obligation was delayed until this date. It is a transition for what was already running, not a general postponement. A new prohibition comes into force on the same day: using AI to generate non-consensual intimate or sexual content and child sexual abuse material.
• On 2 December 2027, the high-risk obligations in Annex III arrive (systems used in employment, credit, biometrics, education or justice), deferred from their original date of 2 August 2026. This is the breathing space the headlines are talking about.
• On 2 August 2028, it is the turn of AI systems embedded in products already regulated by other legislation (Annex I).

The rule of thumb: for most businesses, the real risk is not in high-risk AI, which has a long deadline and affects uses uncommon in a small business. It is in transparency, applicable since August 2026, where a misunderstood headline is causing the most complacency.

What a small business needs to review

In practical terms, without drama: much of what should already have been checked can be reviewed in a morning. The underlying question is simple. Is there any point where a person could believe they are dealing with someone when they are dealing with a system, or that a person wrote a text when a model wrote it? Four checks follow:

• The website chatbot and the WhatsApp bot. Does it say it is an automated system before the first answer, or in a notice nobody opens? A dental clinic managing appointments through a WhatsApp assistant must make this clear in the first message, not in the small print.
• Published content. If product descriptions, property listings or newsletter emails come from a model, it must be possible to identify them as generated content. An estate agency writing two hundred listings a month with an assistant has a procedure to write, not a technical problem.
• Emotion recognition and biometrics. Less common, but present in call-analysis and recruitment tools. If something classifies a person’s moods or traits, there are specific information duties, and it is worth knowing now.
• Who in the company knows all this. This is the most frequently forgotten check: usually only one person knows which tools have been purchased, and that person is almost never the one writing the bot’s messages or posting on social media.

The four checks lead to a preliminary exercise that costs nothing: list where AI is used in the company, who uses it and for what. The legislation does not request that inventory by that name, but without it there is no way to answer any of the questions above.

AI literacy: less obligation, the same need

There is a nuance here that is being misrepresented. Article 4 of the AI Act asked providers and deployers to ensure a sufficient level of AI literacy among their staff. The Digital Omnibus deliberately softened that duty: the Commission’s proposal turned it into a commitment by the Commission and Member States to promote literacy initiatives, and the final agreement leaves providers and deployers with the role of supporting improvements in their staff’s AI literacy.

So no: the law does not currently require staff training, and anyone presenting it as an impending fine is selling urgency. The work, however, remains, for a practical reason.

Transparency obligations are met or breached by people. Whoever writes the bot’s first message decides whether the notice is read or hidden. Whoever prepares the newsletter decides whether generated content is identified. A team that cannot tell when it is talking to a model cannot meet a transparency obligation about models, however well written the procedure on the desk may be.

Literacy stopped being a legal checkbox and remained the prerequisite for everything else. It is addressed by explaining, not by buying.

What this means in practice

For the vast majority of businesses using AI in customer support, content generation or process automation, the work associated with August 2026 did not disappear: it became due. The actual postponement, for high-risk AI, affects a much more specific kind of system, far less common in a Spanish small business.

The answer to the title’s question, then, is yes and no, and the distinction matters: the chapter almost no business of this size needs to apply was postponed; the one almost everyone needs to apply was not. Anyone who read “the AI Act has been postponed” and filed the matter under 2027 has outstanding work they thought they did not have, work that should already be done. It is not a big task, and it looks more like putting things in order than completing a formality: know which AI is used in-house, disclose it where necessary and make sure the team knows why.

This article is for information only and does not constitute legal advice. For specific compliance decisions, consult a specialist adviser.