Europe's AI Act entered a critical new phase on August 2, with transparency requirements now in force for chatbots and AI systems that interact with people. However, the law's most demanding obligations for high-risk AI applications were postponed until December 2027, creating a compliance patchwork that experts say could weaken protections for vulnerable populations.

What Just Became Mandatory for AI Companies?

The transparency layer that took effect this week requires AI providers to disclose when users are interacting with artificial intelligence unless the context makes it obvious. This applies to chatbots, image generators, and other systems that create or manipulate synthetic content. Companies must also ensure that AI-generated images, audio, video, and text are identifiable through machine-readable marking where required by the law.

Systems designed to recognize emotions or categorize people using biometric data must now inform individuals that such processing is occurring. Violations carry steep penalties: administrative fines up to 15 million euros (approximately $17.3 million) or 3 percent of global annual turnover, whichever is higher.

For most companies, the immediate impact is operational rather than transformational. The rules do not require businesses to abandon AI systems or seek prior approval before deployment. Instead, they add a compliance layer that requires identifying where AI is embedded across products, customer interactions, and internal processes, including third-party tools.

Why Did Europe Delay the Strongest Protections?

The EU's most far-reaching requirements for "high-risk" AI systems were supposed to take effect on August 2 alongside the transparency rules. These obligations would have applied to AI used in biometrics, employment decisions, education, essential services, and migration and border management. But in May, EU lawmakers postponed these requirements until December 2, 2027.

The European Commission framed the delay as an implementation adjustment rather than a retreat from regulation. Executive Vice President Henna Virkkunen stated that the aim was to "make it easier to innovate without lowering the bar on safety," arguing that companies and regulators needed clearer guidance, technical standards, and support tools before the most demanding obligations took effect.

Henna Virkkunen

The commission also linked the change to its broader competitiveness agenda, citing former European Central Bank President Mario Draghi's 2024 report on European competitiveness, which argued that EU regulatory burden was holding back economic growth. European Parliament negotiators backed the compromise, citing concerns that technical standards underpinning compliance for high-risk AI systems were not ready in time.

How to Prepare for the AI Act's High-Risk Requirements

Although the strictest obligations are delayed, companies should begin preparing now for the December 2027 deadline. Here are the key areas that will require compliance:

• Risk Management Systems: Organizations will need to implement documented processes for identifying, assessing, and mitigating risks posed by high-risk AI systems before and after deployment.
• Data Governance and Traceability: Companies must establish clear records of training data, testing procedures, and system performance to demonstrate that AI systems operate as intended and do not discriminate.
• Human Oversight Mechanisms: High-risk AI systems will require meaningful human review and the ability for humans to intervene or override automated decisions, particularly in areas affecting fundamental rights.
• Documentation and Transparency: Providers must maintain detailed technical documentation and ensure that deployers understand how systems work and what risks they pose.

These safeguards will apply to AI systems used in migration, asylum, and border management; employment and education decisions; and essential services like healthcare and utilities.

Who Is Most Affected by the 16-Month Delay?

Digital rights advocates argue that the postponement leaves some of the most vulnerable populations without the AI Act's strongest protections for an additional 16 months. The law already classifies AI systems used in migration, asylum, and border management as "high risk," reflecting the EU's recognition that these technologies can profoundly affect people in particularly vulnerable situations.

Under the full AI Act regime, these systems would face additional safeguards including risk management, documentation, data governance, traceability, and human oversight requirements. But those obligations will not apply until the delayed deadline. Existing safeguards, including the General Data Protection Regulation (GDPR) and national law, remain in place, but critics say they do not address every risk posed by opaque or potentially discriminatory AI systems.

"The AI Act already undermines the EU Charter's non-discrimination clauses. Delaying what are already limited migration safeguards will increase surveillance and discrimination, and even result in asylum claims being unlawfully rejected based on personal characteristics or racialised suspicion," stated Stefi Richani, advocacy lead at the Equinox Initiative for Racial Justice.

Stefi Richani, Advocacy Lead, Equinox Initiative for Racial Justice

Richani argues that the deeper problem predates the delay itself. She contends that no amount of safeguarding or guidelines can circumvent structural biases against migrants, and that predictive and automated systems in this context should be banned rather than regulated, with investment directed instead toward safe routes and social protection.

Will Europe's AI Rules Become a Global Standard Like GDPR?

The EU's transparency requirements may follow the same path as GDPR, which became a global privacy benchmark. Companies that build AI systems to meet the EU's disclosure and labeling rules tend to roll out the same standards worldwide rather than maintain separate compliant and noncompliant versions. This "Brussels effect" could make Europe's AI transparency standards the de facto global baseline.

However, on the highest-stakes uses, the EU's influence runs in the opposite direction. The bloc funds migration and border-surveillance technology deployed in third countries outside its own borders, used at transit points along migration routes into Europe. Those deployments sit outside the AI Act's reach entirely, regardless of what its high-risk rules eventually require within the EU. The law's disclosure requirements may end up applied globally, but its strongest protections stop at the EU's own border.

What's the Timeline for Full Implementation?

The EU's AI Act rollout follows a phased approach that reflects the complexity of regulating a fast-moving technology sector. Prohibited AI practices and rules on AI literacy began applying in February 2025. Obligations for general-purpose AI models followed in August 2025. Transparency requirements took effect on August 2, 2026. The delayed high-risk obligations are expected to apply from December 2, 2027.

This staggered implementation has sparked debate about whether the approach is appropriately cautious or whether delays risk weakening protections. Digital rights groups have challenged the EU's explanation for the postponement, arguing that reopening a recently adopted law risks weakening protections and rewards industry lobbying. They warn that the delay could establish a precedent for further postponements in Europe's broader digital rulebook.

Like GDPR before it, the AI Act is intended not to replace the EU's existing digital rulebook but to complement it. While GDPR governs how organizations collect and use personal data, the AI Act regulates how AI systems are developed and deployed. The question now is whether the AI Act will prove just as influential for AI governance globally as GDPR has been for privacy.