AI Regulation in 2026: What Actually Changed

There has been a lot of noise this year about AI rules being delayed. Some of it is true. Most of the conclusions drawn from it are not.

Here is the clear version.

A note first: we build software, not legal advice. This is a practical explanation, not a substitute for talking to a lawyer who knows your sector.

What was postponed

In May 2026 the EU agreed to delay the AI Act's obligations for high-risk AI systems.

Standalone high-risk systems moved to 2 December 2027. High-risk systems built into physical products moved to 2 August 2028.

That is a genuine reprieve, and it was granted for a sensible reason — the standards and certification bodies needed to comply simply were not going to exist in time.

What was not postponed

Everything else.

• Prohibited practices — in force since February 2025
• General-purpose AI model obligations and penalties — since August 2025
• The remainder of the Act — applicable from 2 August 2026
• Transparency and machine-readable marking of AI-generated content — 2 December 2026

That last date is roughly fifteen weeks away.

Why most companies misread this

Here is the pattern I have seen repeatedly.

A company hears "high-risk AI obligations delayed to 2027". The roadmap item moves. Everyone relaxes.

Nobody asks whether the product was ever high-risk.

Usually it was not. "High-risk" is a specific list, not a general description of importance:

• Hiring, promotion, worker management
• Credit scoring and insurance decisions
• Biometric identification
• Critical infrastructure
• Education, law enforcement, immigration, justice
• Safety components in regulated physical products

The common thread is consequential decisions about individual people, or failures that cause physical harm.

Now think about what most companies actually build with AI. Customer support assistants. Document summarisers. Coding tools. Marketing content. Product recommendations. Search.

None of that is high-risk.

So the delay never applied to them — and their real obligations, disclosure and content marking, were already running.

The useful pattern

There is something worth noticing in which obligations were delayed.

Everything postponed — risk management systems, technical documentation, conformity assessment, monitoring — requires external infrastructure. Standards to be assessed against. Certification bodies with capacity.

Everything retained — disclosure, content marking, prohibitions, record-keeping — is something a company can do entirely on its own.

Regulators postponed what they could not support. Not what they thought was unimportant.

That is a much better way to predict the next round of amendments than tracking individual dates, which move.

The technical trap

The content marking requirement contains one word that turns it into an engineering project: machine-readable.

A visible note on your page saying "AI-generated" does not satisfy it. The information has to be embedded in the file itself and travel with it.

And here is the failure I would expect to find in most organisations right now, entirely by accident:

Your own systems remove it.

Image resizing. Format conversion. CDN optimisation. Thumbnail generation. Every one of those steps strips embedded metadata by default — not deliberately, but because making files smaller is precisely what those tools are built to do.

So the marking gets applied correctly when the content is created and removed by your own infrastructure before anyone sees it.

Nobody made a bad decision anywhere. It is a side effect of an image pipeline nobody thought of as compliance-related.

Check it in five minutes: look at a generated file at the source, then at the same file as your website actually delivers it.

The other common mistake

There is a distinction that determines how much applies to you, and most companies assume the lighter one.

A deployer uses an AI system in their business. A provider develops one, or has one developed, and sells it under their own name.

If you build a product using someone else's AI model and sell that product, you are a provider. Even though you did not create the model.

Companies often assume the AI vendor carries the risk. The vendor has obligations about their model. You have obligations about the product you built with it.

This can also change without anyone noticing. Customise a model, ship it as a feature, and a company that considered itself an AI customer has become an AI supplier.

What to actually do

Four things, all of which are useful regardless of regulation.

Know what you run. A list of every AI model in production, its provider, exact version, purpose and owner. Most companies genuinely cannot produce this — which makes every other question unanswerable.

Log what they do. Inputs, outputs, model version, and enough context to reconstruct a decision months later. Try answering "which model produced this output in March" for a real case. Most cannot.

Mark what they generate, and verify the marking survives publication rather than just checking you applied it.

Keep your evaluation results rather than reviewing and discarding them. Same work, but it becomes evidence.

Read that list as an operations list rather than a compliance list. It is what you want for troubleshooting, cost control, and answering customer security questionnaires. Compliance arrives as a by-product.

What it costs

For a company shipping ordinary AI features and not running high-risk systems: realistically a few weeks of engineering spread across a year, most of it work with independent value.

If you genuinely do operate high-risk systems, it is a different scale — nine to eighteen months of structured work — and the extension to 2027 is less generous than it sounds. Certifying against standards that do not exist yet is not something to begin in the final quarter.

The bottom line

The delay was not a sign that AI regulation is fading. Regulators kept everything that protects people from being deceived and postponed what would have needed certification bodies that do not exist.

The companies that will struggle in 2027 are not the ones that started late. They are the ones that spent the extension writing policy documents instead of fixing systems.

Full version with jurisdictional coverage, costs and a readiness checklist: AI Regulations in 2026: What Product Teams Must Build Now.

Frequently Asked Questions

Were AI regulations delayed?
Only the high-risk parts, to December 2027 and August 2028. Prohibitions, general-purpose AI obligations, penalties and transparency requirements stayed on schedule.

Does this apply outside the EU?
Yes, where a system is offered in the EU or its output is used there. The same extraterritorial approach as GDPR — where you are incorporated is not the test.

We only use AI tools rather than building them. Are we affected?
Likely as a deployer, with lighter obligations — mainly disclosure and staff awareness. That changes if you build a product on those tools and sell it.

Is a written "AI-generated" label enough?
For telling users it is part of the answer, but the requirement is specifically machine-readable — embedded in the file and surviving publication.

What are the penalties?
Tiered fines, with the highest band for prohibited practices reaching up to €35 million or 7% of worldwide annual turnover, whichever is higher. Penalties have applied since August 2025.

Where should we start?
Build a complete inventory of every AI model and tool in production. Almost everything else depends on having it, and almost nobody does.

---

TechCirkle builds AI systems with governance designed in from the start. AI development services · get in touch