The EU AI Act After August 2026: What Actually Applies to Developers (Post-Omnibus Guide)
August 2, 2026 was meant to be the AI Act’s big day—then the Digital Omnibus moved the high-risk rules to 2027 and 2028 and softened AI literacy. What applies now, which “hat” you wear when you use or ship AI, the transparency duties that did start, and where running AI locally helps (and where it doesn’t).
Awareness · 11 min
The EU AI Act After August 2026
August 2, 2026 was meant to be the AI Act’s big day—then the Digital Omnibus moved the high-risk rules to 2027 and 2028 and softened AI literacy. What applies now, which “hat” you wear when you use or ship AI, the transparency duties that did start, and where running AI locally helps (and where it doesn’t).
Definition
The EU AI Act is the European Union’s law on artificial intelligence. It sorts AI by risk and puts duties on “providers” (who build or sell an AI system) and “deployers” (who use one professionally). The Digital Omnibus, in force since July 27, 2026, delayed its strictest rules and rewrote some others.
For two years, “August 2, 2026” was the date every AI compliance slide pointed to. Then, weeks before it arrived, the EU passed the Digital Omnibus and moved the biggest obligations—those for high-risk AI—to December 2027 and August 2028.
That led many developers to conclude the AI Act could wait. It can’t, quite. Several duties did start in August, the AI literacy rule changed shape rather than disappearing, and the duties that apply to you depend on what you build, not just what you use.
Here’s a practical, developer-sized map of what applies now. It’s general information, not legal advice.
The timeline after the Omnibus
Key AI Act dates, as amended by the Digital Omnibus (Regulation (EU) 2026/1744).
| Date | What applies |
|---|---|
| Feb 2, 2025 | Banned AI practices; original AI literacy duty |
| Aug 2, 2025 | Obligations for general-purpose AI model providers |
| Jul 27, 2026 | Digital Omnibus in force; AI literacy duty rewritten (see below) |
| Aug 2, 2026 | Article 50 transparency duties begin |
| Dec 2, 2026 | End of the grace period for machine-readable marking on systems already on the market; new bans on “nudifier” and child-abuse image generators |
| Dec 2, 2027 | High-risk systems in Annex III (hiring, credit, education, essential services, biometrics…) |
| Aug 2, 2028 | High-risk AI built into regulated products (Annex I) |
note
Deferred, not cancelled
The high-risk rules were moved because standards and national authorities weren’t ready—not because the EU dropped them. If you build anything in the Annex III areas, December 2027 is closer than it looks.
Which hat are you wearing?
Most confusion disappears once you separate using AI from shipping AI. The same developer can be both in one afternoon.
Common developer situations and the duties they trigger.
| What you’re doing | Your role | What applies |
|---|---|---|
| Using an AI assistant to write your code | Deployer | AI literacy (an obligation of effort); not high-risk |
| Adding a chatbot or AI assistant to your product | Provider | Tell users they’re talking to AI, unless it’s obvious |
| Your product generates images, audio, video or text | Provider | Mark outputs as AI-generated in a machine-readable way, where technically feasible |
| Publishing realistic AI images or video (deepfakes) | Deployer | Disclose that it’s AI-generated (exceptions for clearly artistic or satirical work) |
| Your product screens job applicants, scores credit, or grades students | Provider of a high-risk system | Full high-risk regime from Dec 2, 2027 |
tip
Good news for everyday coding
Using AI to help write ordinary software doesn’t make that software high-risk, and the code an assistant writes doesn’t need an “AI-generated” label. What matters is what your finished product does.
AI literacy: from “ensure” to “support”
The original Article 4 told providers and deployers to ensure, to their best extent, a sufficient level of AI literacy among their staff. The Omnibus rewrote it: you must now take measures to support the development of AI literacy, and you aren’t required to guarantee any particular level. Lawyers describe this as a move from an obligation of result to an obligation of effort.
Effort still means doing something you can point to. For a small team, that can be one page and one meeting:
A minimal AI literacy note for a dev team (plain text)
Which AI tools we use, and for what
- Coding assistant: drafts, refactors, explanations. Humans review all changes.
What we never put into cloud AI tools
- Customer personal data, secrets, production credentials, unreleased security fixes.
Known limits
- Models invent APIs and facts. Tests and review are mandatory.
Who to ask
- <name>, reviewed every 6 months.The transparency duties that did start
- AI interaction disclosure: if users talk to an AI in your product, tell them—unless any reasonably observant person would already know.
- Output marking: if your system generates synthetic images, audio, video or text, mark outputs as AI-generated in a machine-readable way, to the extent technically feasible. Systems already on the market before August 2 have until December 2, 2026.
- Deepfake disclosure: if you publish realistic AI-generated or manipulated media, say so.
- AI-written public-interest text: disclose it, unless a human has reviewed it and someone takes editorial responsibility.
Breaking these duties can cost up to €15 million or 3% of worldwide annual turnover, whichever is higher, with lower ceilings for smaller companies.
Where running AI locally helps—and where it doesn’t
Be precise about what local AI changes.
| Question | Does local AI help? | Why |
|---|---|---|
| Does the AI Act stop applying to us? | No | The Act is about what AI does, not where it runs |
| Is our customers’ personal data sent to an AI vendor? | Yes | Prompts never leave the machine, so there’s no new processor or international transfer under GDPR |
| Can we document exactly where data goes? | Yes | One device, one data flow—easy to describe in a DPIA or security review |
| Are we protected from a vendor changing its terms? | Yes | There’s no third party whose retention or training policy can change |
| Do we still need AI literacy and transparency? | Yes | Those duties follow your use and your product |
warning
GDPR didn’t go anywhere
For most EU developers, the day-to-day risk isn’t the AI Act—it’s personal data in code, logs, stack traces and test fixtures being pasted into cloud assistants. Each paste can be a transfer to a processor you haven’t vetted. That’s where local AI removes the most work.
A developer’s checklist for late 2026
- List the AI tools your team uses and what data goes into each.
- Write your one-page AI literacy note and walk the team through it.
- If your product has a chatbot, add a clear “you’re talking to an AI” notice.
- If your product generates media or text, plan machine-readable marking before December 2, 2026.
- Check whether anything you build touches Annex III areas; if so, start planning for December 2027.
- Move personal data and secrets out of reach of cloud assistants—or use a local one for that work.
How Quietly fits
Quietly is a tool you use—so for the AI Act you’re a deployer, and your duties are the literacy and (if you publish realistic media) disclosure duties above. What Quietly changes is the data side: chat, the coding agent and image generation run on your machine, so prompts, code and customer data aren’t sent to an AI provider.
- Air-Gap Mode (Settings → Privacy) blocks every request that isn’t to your own computer—useful when you must show that code and data stay on the device.
- The Security Feed lists blocked requests, which makes a simple piece of evidence for a security review or DPIA.
- If you publish realistic images made in Quietly’s Image Studio, the deepfake disclosure duty is yours as the deployer—add a clear note where you publish them.
Where Quietly fits
FAQ
Was the EU AI Act delayed?
Partly. The Digital Omnibus, in force since July 27, 2026, moved high-risk obligations to December 2, 2027 (Annex III) and August 2, 2028 (Annex I). Transparency duties under Article 50 still started on August 2, 2026.
Does using an AI coding assistant make my software high-risk?
No. High-risk status depends on what your finished product does—such as hiring, credit scoring or education decisions—not on whether AI helped write the code.
What changed in the AI literacy rule?
Article 4 now requires providers and deployers to take measures to support the development of AI literacy, rather than to ensure a sufficient level of it. It is an obligation of effort, and no particular level must be guaranteed.
Do I have to label AI-generated content?
If your product generates synthetic images, audio, video or text, outputs must be marked as AI-generated in a machine-readable way where technically feasible. If you publish realistic AI-generated media, you must disclose it. Ordinary code written with an assistant doesn’t need a label.
Does running AI locally exempt me from the AI Act?
No. The Act depends on what the AI does, not where it runs. Local AI mainly helps with GDPR and confidentiality, because personal data and code aren’t sent to an AI provider.
Sources
- EU AI Act Update: Digital Omnibus Finalizes 8 Compliance Changes — Orrick
- Yes, August 2 Still Matters: The EU Approved a High-Risk AI Delay, but Most Transparency Obligations Remain — Jones Walker
- Digital Omnibus on AI — artificialintelligenceact.eu
- EU AI Act Omnibus Agreement — Postponed High-Risk Deadlines and Other Key Changes — Gibson Dunn
- EU AI Act 2026 guide for engineering teams — Augment Code
Related guides
Awareness
Local AI for Lawyers: Using AI Without Breaking Client Confidentiality (2026)
In February 2026 a federal judge ruled that a defendant’s chats with a consumer AI weren’t privileged—partly because the provider’s policy let it keep and disclose them. What ABA Opinion 512 asks of lawyers, where a prompt actually travels, and how to use AI on client matters without the data ever leaving your machine.
Awareness
Local AI for Therapists: Writing Session Notes Without Sending Them to the Cloud
AI note tools save clinicians hours, but most send session content to a vendor’s servers. What HIPAA and the APA’s 2025 guidance expect, why psychotherapy notes get extra protection, and a step-by-step way to draft progress notes with a model that never leaves your computer.
Awareness
“Bleeding Llama” Explained: Is Your Local AI Exposed to the Internet? (60-Second Check)
CVE-2026-7482 let anyone on the internet read memory from ~300,000 Ollama servers—prompts, system instructions and API keys included. What happened, why “local” didn’t mean “private”, and a one-minute check you can run on your own machine today.