The AI Act got delayed. The part that applies to you did not

Brussels moved two deadlines in the AI Act. Neither of them was yours.

That is the short answer for everyone who saw a "deadlines postponed" headline and relaxed. The delay is real. It covers a narrow set of systems most companies do not run. The rules covering the systems you do run started applying on 2 August 2026.

What moved

Two blocks of the high-risk regime shifted.

Software that screens CVs, scores creditworthiness, grades exams or allocates public benefits moved to 2 December 2027. AI built into regulated products, like a medical device or a lift controller, moved to 2 August 2028.

If you sell a hiring tool with a ranking model, you got 16 extra months. If you sell software, insurance, shoes or services, you got nothing, because you were never in that group.

That is the whole delay.

Two questions decide almost everything

The rule that did not move is Article 50. It is about telling people when something is AI. You can work out most of your exposure with two questions.

First: does it talk to a person? If yes, that person must know it is a machine.

Second: do you publish what it writes, about the wider world? If yes, you say it was AI-generated, unless a named human reviewed it and stands behind it.

Everything below is those two questions applied to real systems.

Your support agent that answers emails

This one is caught, and it is the case people miss because they only think about chat widgets.

The Commission's guidance is explicit that AI agents acting on your behalf count. It also says it makes no difference whether the agent talks to the person who instructed it or to a third party it meets along the way. So: a customer emails support, your agent reads it, decides, and replies. That is a machine talking to a person.

So the reply needs to say so. One line is enough. What fails is the reply signed "Sarah from the support team" when there is no Sarah.

The narrow exception is the one-shot autoresponder. "Thanks, we got your ticket, reference 4471" is not a two-way exchange; it is a receipt. Nobody thinks a human wrote it. The moment your system starts actually handling the conversation, it is in scope.

Your automated sales outreach

Here the answer splits, and the split is useful.

A one-way blast is a weaker case. You generate 500 emails, they go out, nothing comes back into the system. There is no two-way exchange with a person, and a 1:1 email is not published content, so the publishing rule does not touch it either.

An AI SDR that handles the replies is a different thing. Once your system reads the answer and writes back, you have a machine in conversation with a person, and that person should know. If your outreach is good enough that prospects reply thinking they are talking to a human, you have built exactly the system this rule was written for.

Be honest about the real risk on cold outreach, though. The AI Act is not what will hurt you there. GDPR and the ePrivacy rules on unsolicited email have been enforced for years and carry bigger fines. The AI disclosure is the smaller of your two problems.

Your fully AI-generated newsletter

Depends entirely on what it is about.

A newsletter about your product, your features, your case studies and your webinar is not a matter of public interest. No disclosure duty. Send it.

A newsletter that comments on new legislation, market conditions, public health, the environment, consumer safety or anything else genuinely up for public debate is a different category. That is exactly what the public interest rule covers, and the Commission's list is broader than most people expect.

Now the important part. There is an exemption when a human reviews the text and a named person or company takes editorial responsibility for it. That exemption is how most business writing escapes this rule. But "fully AI-generated" means nobody reviewed it, which means you have closed your own escape hatch.

You have two fixes, and both are cheap. Have someone actually read it before it goes, or add a line saying it was AI-generated. Pick one.

Two more you probably have

If you generate images, audio, or video, the file has to carry machine-readable marking. When you use a commercial tool, that duty sits with the vendor. Your risk is destroying their marking by re-encoding files in your own pipeline. When you build the system yourself, in-house, for your own use, you count as both the maker and the user, so the duty is yours.

If you use a synthetic voice or a generated face of a real person in anything public, you disclose it. Obviously, artistic, satirical, or fictional work is exempt.

And one that is not a labeling problem at all: inferring employees' emotions at work has been banned outright since 2 February 2025, outside narrow medical and safety uses. If a tool scores your support agents on enthusiasm, disclosure does not save it. Switch it off.

Fines for Article 50 run to 15 million euros or 3% of worldwide turnover, whichever is higher.

The one grace period

Content-generating systems already on the market before 2 August 2026 have until 2 December 2026 to add machine-readable marking.

That is the only concession, and people are stretching it. It covers marking only. It covers systems already shipped, not the one you launch in September. Telling people they are talking to a machine was due on 2 August and stayed due on 2 August.

The inventory nobody is requiring you to build

Straight answer: no article in the AI Act says you must keep a list of your AI systems. There is an EU database, but it is for providers of high-risk systems and public authorities, which is almost certainly not you. Anyone telling you the Act requires an AI register is selling, not citing.

Build one anyway, and here is why that is not a contradiction.

You cannot answer either of the two questions above for systems nobody has written down. Your outreach tool was bought by sales, your newsletter tool by marketing, your support agent by ops. Nobody has the whole picture, and the rules apply per system.

Training your people is already a live obligation. AI literacy has been required since 2 February 2025, and you cannot train staff on tools you have not listed.

The high-risk regime is scheduled, not canceled. On 2 December 2027, you will need to classify what you run. The list is the input to that.

And the one that actually costs money today: when a big customer or a supervisory authority asks what AI you use, they ask for the overview first. Those questions are already in security questionnaires. With the list, it is a 20-minute conversation. Without it, it is a three-month one, usually in the middle of a deal.

I built a compliance record system for factory certificates once, at a company selling procurement software to L'Oreal and Swiss Re. The lesson stuck: nobody was ever impressed that the certificate existed. What mattered was producing it in 30 seconds when someone asked. Compliance evidence is a by-product of running things properly and writing down what you did. That is why, of three ideas I validated at Antler, this is the one I kept.

Do this before Friday

List every AI system that touches a customer, an employee, or something you publish. For each one, answer four things: what it does, whether you built it or bought it, whether a human sees the output before it ships, and which of the two questions above it triggers.

It takes under an hour. You will find a system nobody told you about. Everyone does.

Then fix the disclosure line on whatever talks to people. That is the highest value hour of compliance work available to you right now.

A spreadsheet is fine for this, and it is what I used. It is also the wrong home for it long term, because it goes stale the week after you build it and nobody updates it before the deal is already stuck. So I am building this inventory into the scorecard dashboard, where it can stay current and produce the evidence on demand, not just the day you need it.

That should be live within a few weeks. Start with the sheet now, and I will show you the numbers as it builds.