The AI Act deadline that moved

Yesterday was the EU AI Act's general application date, and a good deal of what people spent the weekend bracing for did not actually arrive [1]. The high-risk regime, the part with the conformity assessments and the technical files, was deferred months ago. What started on 2 August is narrower, lands sooner, and is easier to fail.

What actually took effect

Two things. The Article 50 transparency duties are live, which is the requirement to disclose when a person is dealing with an AI system and to mark synthetic content. And the AI Office's supervisory and fining powers over general-purpose model providers switched on [1].

Note the shape of that. The obligation that bites first is not a documentation regime you can schedule into next quarter. It is a product behaviour, visible in your interface, that either discloses or does not.

What moved, and how far

The deferral is settled law, not a proposal. Parliament endorsed the simplification package on 16 June 2026 and the Council gave its final approval on 29 June [2]. Standalone high-risk systems under Annex III now apply from 2 December 2027. High-risk systems embedded in regulated products under Annex I go to 2 August 2028 [2].

Meanwhile most of the Article 5 prohibitions have been in force since February 2025, with a further tranche due 2 December 2026 [3]. So the timeline now runs in the opposite order to how it is usually described: bans first, transparency second, the heavy compliance machinery last.

The penalties are unchanged. Prohibited practices carry up to 35 million euro or 7% of worldwide annual turnover, whichever is higher. High-risk breaches carry up to 15 million euro or 3%. For SMEs and start-ups the lower of the two figures applies rather than the higher, which is the detail most summaries get backwards [4].

Why this lands on agentic commerce

An agent that shops on a customer's behalf is a conversational interface making a purchase. Article 50 is the one part of this Act written directly at that surface. If your checkout flow involves an agent talking to a customer, or a merchant-side assistant talking to an agent, the disclosure question is live now and the high-risk question is a 2027 problem.

Territory matters more than incorporation. The Act reaches products placed on the EU market, put into service in the EU, or whose outputs are used in the EU [5]. A North American team shipping an agent that European customers can reach is inside it.

Read from the rails

Every payments compliance deadline I have worked through produced the same two failure modes, and they are opposites. One team reads the headline, sees a date, and builds the whole programme against the biggest number in the summary. Another team reads that the date slipped and stops. Both are wrong in the same way: they treated a regulation as a single event rather than a sequence.

The useful move this week is small and unglamorous. Write down every place your product speaks to a human or emits generated content, and mark which ones disclose. That list is short, you can build it in an afternoon, and it is the only part of this Act that is enforceable against you right now.

The high-risk work is real and it is coming, and December 2027 is closer than it sounds once conformity assessment is in the path. But a team that spends August on Annex III documentation while its chatbot introduces itself as a person has optimised for the deadline that moved and missed the one that did not.

The deferral was won by lobbying, which means it is the kind of thing that can be revisited. Build to the obligation, not to the calendar.

The compliance regime everyone prepared for slipped by sixteen months. The one that started yesterday is a line of copy in your interface.