The EU delayed the AI Act. Your chatbot's deadline didn't.

The most expensive sentence in European tech right now is "the AI Act got delayed." It is half true, and the half that is false is the half that applies to you. Brussels did push the heavy high-risk obligations out to the end of 2027. The t

The most expensive sentence in European tech right now is "the AI Act got delayed." It is half true, and the half that is false is the half that applies to you. Brussels did push the heavy high-risk obligations out to the end of 2027. The transparency rules were not touched. If your business runs a chatbot, an AI phone agent, or publishes AI-generated content, you have obligations that land on August 2, 2026, roughly three weeks from now, and the widely repeated "it got delayed" story is why most businesses will miss them.

Here is what actually moved, what did not, and the short list of things to fix before the deadline.

What actually got delayed, and what did not

In May 2026 EU lawmakers reached political agreement on revising the AI Act. The headline was a delay, and the delay is real: obligations for high-risk systems, the recruitment scoring and credit decisioning category, moved from August 2026 to December 2027. That is a genuine eighteen month reprieve for the businesses it covers, and it is what everyone reported.

What did not move: the transparency obligations. Those still apply from August 2, 2026.

The reprieve applies to the category most small businesses were never in. The rules that survived are the ones aimed squarely at the things small businesses actually deploy: chatbots and generated content. The delay coverage buried that, and the gap between what people heard and what applies to them is the whole risk. Latham's breakdown of the revisions and the official implementation timeline both make the split clear.

The two duties that land on August 2

Strip out the legal language and there are two obligations most operators need to care about.

Tell people they are talking to a machine. If a user interacts with an AI system, they have to know. That covers the website chatbot, the support widget, and the AI voice agent answering your phone. The disclosure has to be clear and it has to happen at the point of interaction, not buried in a privacy policy nobody opens.

Label AI-generated content so a machine can read the label. Generated or manipulated content, including synthetic images, audio, and video, has to carry a machine-readable marker. Not a vibe. Not a line in your about page. A mark that a parser can detect.

Both are deployer obligations. That word matters. You do not get to point at the vendor who built the model. If you deployed it to your users, it is yours.

Who this actually hits

We have written before about how quickly a messaging bot becomes a compliance problem in the WhatsApp AI chatbot rules, and the same pattern repeats here. The businesses that get caught are almost never the ones doing something sinister. They are the ones who deployed something useful, forgot it was AI, and never revisited it.

The SME relief nobody reported

Buried under the delay headlines is the part that actually helps you. The Act's simplified compliance framework for smaller companies was extended to businesses with up to 750 employees and 150 million euro in annual revenue. That is a large expansion, and it brings simplified guidance, standardised documentation templates, reduced fines, and regulatory sandbox access.

Read that carefully, because it is relief on process, not exemption from duties. You still have to disclose. You just have less paperwork proving how you disclose. For a ten person business, this is the difference between a morning of work and a consulting engagement.

What to do in the next three weeks

The work here is genuinely small, which is what makes skipping it silly.

1. Inventory what you deploy. Every chatbot, voice agent, and generated-content pipeline. Most businesses find one or two they had forgotten.
2. Add the disclosure at first contact. One line, before the conversation starts. "You are chatting with an AI assistant." Your AI receptionist should say it out loud on pickup. We build these to disclose by default, a point we covered in the build versus rent breakdown.
3. Label your generated media machine-readably. Not just a caption. The marker has to survive a parser.
4. Write down what you deployed and why. The SME templates exist precisely so this is not a project.
5. Fix the forgotten widget. The chatbot a freelancer installed in 2024 and nobody has looked at since is the one that will be non-compliant.

For the wider picture of what the Act means for a small operator beyond this deadline, our EU AI Act guide for small business is the fuller map. This piece is the urgent slice of it.

"We're small" was never the defence

The transparency duties attach to what you deployed, not to your headcount. A two person studio running a chatbot has the same disclosure obligation as a bank running one. The relief is in the paperwork, not the principle.

— the thing to internalise before August

The reason to do this is not fear of a 35 million euro fine, which is not landing on a ten person agency. It is that the fix costs a morning and the alternative is carrying an open, documented, dated liability into every future client conversation and due diligence process. Nobody sensible trades a morning for that.

The delay was real. It just was not yours.