The AI Act deferral also affects companies that use AI

For some weeks now I have heard the same sentence repeated in meetings: the AI Act has been postponed to 2027, we will come back to it next year. That is not the case, and the misunderstanding comes from a true piece of news read badly.

The regulation has been in force since 1 August 2024, but it does not apply all at once. Many provisions became applicable on 2 August 2026. The Digital Omnibus on artificial intelligence — Regulation (EU) 2026/1744 of 8 July 2026, in force since 27 July 2026 — deferred Chapter III, Sections 1, 2 and 3, for high-risk systems. It did not postpone the prohibitions or the transparency duties as a whole.

For businesses buying AI the distinction still matters: a company deploying a high-risk system may have duties of its own under Article 26 of Regulation (EU) 2024/1689. For Annex III systems, those duties are also deferred to 2 December 2027.

What has been deferred.

The full timeline is in the chronology on the home page.

One clarification about 2 December 2026, because that date tends to be read only as a postponement falling due. From that day two new prohibitions also arrive, which did not exist before: nudification applications, which generate nude images of real people without their consent, and systems that produce child sexual abuse material. The Digital Omnibus did not only push deadlines back: in places it tightened.

There is a practical reason not to read the delay as a pause. Building the inventory of systems, renegotiating supplier contracts and training staff usually takes twelve to eighteen months. A company that starts now works at ordinary cost; a company that starts in the autumn of 2027 works in emergency mode, and emergencies have a different price list.

For deployers: duties already applicable and duties deferred.

Almost no small or medium-sized company develops artificial intelligence systems. The vast majority use them, and that is what the regulation calls a deployer: a party using someone else's system in the course of its own professional activity. It is a lighter role than the provider's. It is not an empty one.

Article 50 of Regulation (EU) 2024/1689 — the AI Act — distributes transparency duties between provider and deployer. They apply from 2 August 2026, subject to the specific transitional rule on marking content from systems already on the market. Article 26 also sets duties for deployers of high-risk AI systems; for Annex III systems they apply from 2 December 2027.

Two obligations are directly yours.

Biometrics and emotion recognition. A company using an emotion recognition system or a biometric categorisation system must inform the people exposed to it, and must do so at the latest at the time of first exposure. This covers biometric access gates, security systems that classify people entering a site, and tools that measure operator attention. The processing of the data remains subject to the GDPR in parallel.

Deepfakes and texts on matters of public interest. Whoever generates or manipulates images, audio or video amounting to a deepfake must disclose it. The same applies to AI-generated text published to inform the public on matters of general interest, unless the content has undergone human review and someone takes editorial responsibility for it.

Two fall on the provider, but land on you all the same.

Disclosure of the interaction. A system intended to interact with people must be designed so that whoever talks to it knows they are talking to a machine. The obligation is the provider's, but the chatbot is on your website and the switchboard answers in your name: if the notice is missing, you are the first to take the reputational damage, and the authority's request for clarification arrives at your address. This is a matter for the contract, not for good faith.

Marking of content. Text, images, audio and video generated or manipulated by artificial intelligence must be marked in a machine-readable format. Here too the obligation belongs to the provider. Adding your brand to a system does not, by itself, transfer every obligation: provider status must be assessed against the conditions in Article 25, discussed next.

A note on AI literacy.

The Digital Omnibus rewrote Article 4 of the AI Act, and it is worth being precise about what changed: the obligation has not been abolished, its intensity has been lowered. Previously a company had to ensure an adequate level of AI literacy among its staff; today it must take measures to support the development of that literacy, proportionate to the risks of the systems used and to the characteristics of the organisation, without having to guarantee a given level for each individual. Those measures need not be a training course: operating instructions, internal policies, exercises and periodic updates all count. The relief, however, concerns the formal requirement, not the consequences: if an incident arises from an employee's improper use of a tool, the absence of instructions and of documented training is the first thing to be raised against the company, and not only under the AI Act.

You can become a provider without noticing.

Article 25 of the AI Act contains the provision that, in a year of conversations, I have seen surprise company leadership most often. A deploying company may take on the role and responsibilities of the provider in the circumstances set out in these three cases:

1. It puts its own brand or name on a high-risk AI system already placed on the market or put into service, subject to the contractual allocation expressly mentioned in the provision.
2. It changes the intended purpose of a system not classified as high-risk that is already on the market or in service, making it high-risk. The example I use most often: computer vision software bought for quality control on the line, redirected to measuring the productivity of the operators. Same software, different purpose, different legal role.
3. It makes substantial modifications to a high-risk system already on the market or in service that remains high-risk.

When one of these cases applies, referring the matter back to the original provider is not enough. The parties must determine who is to demonstrate conformity, assess risks and control the system, taking account of the contractual arrangements that Article 25 expressly preserves where applicable.

An ordinary chatbot bought from a third party and renamed after the company does not become high-risk for that reason alone. A recruitment system already classified as high-risk and sold under the buyer’s own brand, by contrast, requires a careful assessment of Article 25 and the agreement with the original provider.

Who supervises, and what a mistake costs.

The three bands under Article 99 of Regulation (EU) 2024/1689 shown below are confirmed by Article 23(1)–(3) of Italian Legislative Decree no. 179 of 7 October 2026, which enters into force on 23 October.

The higher of the two figures applies. For small and medium-sized enterprises and for start-ups the regulation provides the opposite criterion: the lower figure applies.

One clarification usually missing from alarmist summaries. The EUR 35 million concerns prohibited practices — behavioural manipulation, social scoring, untargeted scraping of facial images — which an ordinary business does not engage in. The band that actually concerns a deployer is the second. It is still a serious figure, but it is a different figure, and confusing the two does not help anyone decide.

Who supervises, in Italy.

Italian Law no. 132 of 23 September 2025 allocated competences among several authorities. Articles 4 and 5 of Legislative Decree no. 179 of 7 October 2026 specify the framework: AgID, the Agency for Digital Italy, is the national notifying authority; ACN, the National Cybersecurity Agency, is a market surveillance authority. The Bank of Italy, Consob and IVASS supervise high-risk systems in their respective financial and insurance fields. The Italian data protection authority exercises market surveillance only within the scope of Article 74(8) of Regulation (EU) 2024/1689.

Two decrees implementing Law 132/2025 have now been published. Legislative Decree no. 160 of 9 September 2026, on policing and civil and criminal liability, has been in force since 30 September. Legislative Decree 179/2026 governs the powers of the national authorities and further uses of artificial intelligence. It was published on 8 October and enters into force on 23 October 2026.

The involvement of the cybersecurity agency has a consequence worth recording straight away: controls on artificial intelligence will intertwine with those on network security, the NIS2 Directive included. Treating the AI Act as an isolated file, or as an appendix to privacy, means preparing for the wrong inspection.

The GDPR and the AI Act are not the same file.

This is the confusion I see most often, and it produces two opposite mistakes: those who think they are covered because they did the GDPR, and those who redo from scratch work they already had.

The two regulations have different subjects and may protect the same person. The GDPR governs personal-data processing and requires a DPIA in the cases specified by Article 35 of Regulation (EU) 2016/679. The AI Act also addresses system risks beyond personal-data processing. For some high-risk uses it requires a FRIA, or fundamental rights impact assessment, under Article 27 when that duty becomes applicable.

The FRIA does not apply to every high-risk system: it is required of bodies governed by public law, of private entities providing public services, and of those deploying the Annex III systems concerning creditworthiness and life and health insurance.

A practical consequence follows: the record of processing activities and the inventory of artificial intelligence systems are two distinct documents, related but not interchangeable. The first starts from the data, the second from the systems. Keeping only one leaves a side uncovered.

A recent case. By decision no. 487 of 3 July 2026 the Italian data protection authority fined Character Technologies Inc., the company operating Character.AI, EUR 158,000: an inadequate privacy notice, an impact assessment carried out late, and late designation of the representative in the Union. The company was also ordered to take corrective measures on age verification and on the confidentiality of minors' profiles.

The figure is worth looking at. One hundred and fifty-eight thousand euro is not a headline fine, and that is precisely the point: for a company that does not engage in prohibited practices, the real risk is not of the order of magnitude of the statutory maxima. It is of the order of magnitude of a compliance project done badly.

On the reforms under discussion. The amendments proposed to the GDPR in the so-called Digital Omnibus on data are still going through the European legislative process and are not law in force: proposed by the Commission in November 2025, they have been in inter-institutional negotiation since the spring of 2026. The artificial intelligence branch reached the end of the road; the data branch did not. They should not be used to justify decisions taken today.

What to do over the next twelve months.

Four steps, in the order in which they should be taken.

Build the inventory. Record every artificial intelligence tool in use, shadow AI included: translators, extensions installed in the CRM, generative assistants switched on by individual departments without going through IT. In my experience the real number is between two and five times what the company expects.

Qualify the role, system by system. For each tool, establish whether the company acts as a deployer or falls into one of the three cases under Article 25 of the AI Act that turn it into a provider.

Classify the risk. Identify which systems fall within the high-risk category of Annex III to the AI Act, and tie them to the 2 December 2027 deadline with a plan that starts today.

Set up governance and contracts. An internal policy on the use of these tools, training plans proportionate to the risk and — the point most often neglected — renegotiation of supplier contracts, to obtain access to technical documentation and cooperation in the event of an inspection. A contract signed before 2024 almost certainly contains none of this.

Six questions to ask around a table.

Before looking for a consultant, the leadership should try to answer these six questions. They measure organisational exposure, not legal exposure.

1. How many artificial intelligence systems are in use in the company today, including those embedded in software bought for something else?
2. For each of them, are we a deployer or a provider?
3. Are the people who interact with our automated systems — customers, candidates, employees — told that they are talking to a machine?
4. Is there a named person responsible for the compliance of these systems?
5. Do our supplier contracts guarantee us access to technical documentation and their assistance in the event of an inspection?
6. Have the people using these tools received instructions for use, clear limits and documented training?