Postponed is not cancelled: what applies after 2 August

This summer the EU postponed the high-risk requirements in the AI Act to December 2027. Many read that as the whole regulation being paused. It was not.

What was postponed

The amending regulation, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 as Regulation (EU) 2026/1744 and entered into force on 27 July. It moved three things. High-risk duties for standalone systems under Annex III now apply from 2 December 2027. High-risk AI embedded in regulated products under Annex I from 2 August 2028. The requirement for national regulatory sandboxes from 2 August 2027.

What was not

The transparency duties did not move. They have applied since 2 August 2026, and they reach far more organisations than the high-risk rules do:

• An AI system that talks to people must make clear that it is AI.
• Synthetic audio, image, video and text must carry machine-readable marking.
• Anyone publishing a deepfake must disclose that the content is manipulated.

The marking in the second point is the provider's duty, not yours as the organisation using the tool. Your own duty covers deepfakes and certain text published to inform the public. The distinction decides who has to do what, and it is often confused.

The penalties are not new either. They have been applicable since August 2025. What changed this summer was not that fines became possible, but that the labelling duties became something you can be fined for. The AI literacy requirement, in turn, has applied since February 2025.

The next date is 2 December

By then, providers of generative systems already on the market must meet the machine-readable marking requirement. Two new prohibitions take effect on the same date.

"We meet organisations that believe they have been given sixteen more months," says Andreas Olsson, founder of Ampliro. "They have, for the high-risk duties. They have not, for the labelling. And they never had it for the penalties. The danger with a postponement is that it sounds like a message that nothing applies."

Supervision in Sweden is still being built

In June 2026 the Swedish government divided responsibility across five authorities by government decision III:50. The Swedish Post and Telecom Authority took the larger share and serves as the single point of contact, the Swedish Authority for Privacy Protection took biometrics, law enforcement, migration and the administration of justice, and the Financial Supervisory Authority took creditworthiness and insurance. The split follows the points in Annex III rather than the sector an organisation belongs to, which makes it hard to guess.

The assignment carries no statutory basis and expires on 31 December 2026. Penalties also require Swedish legislation that does not yet exist. That is a reason to follow the process, not to wait it out.

What Ampliro does about it

Ampliro works on this in three of its eight engagements. The AI Readiness Assessment maps where AI creates value and risk-classifies the use cases, in weeks and at a fixed price. AI governance builds the governance the organisation then runs itself. AI competence covers the AI literacy requirement. For public bodies, engagements are normally scoped so they can be procured directly.

The material is open. Ampliro's guide to the AI Act, ten sector pages and a glossary are published on ampliro.com without registration.

"Postponed duties are still duties," says Andreas Olsson. "The difference is that you now have time to do them properly."