The EU AI Act has been rolled out progressively over two years and, until a few weeks ago, 2 August 2026 was shaping up as the date on which the full obligations for high-risk AI systems would come into force: risk management, data governance, technical documentation, event logging and human oversight. That has changed. The Council of the European Union definitively approved the Digital Omnibus on AI on 29 June 2026, which moves those high-risk obligations to 2 December 2027 for the stand-alone systems of Annex III (including education, employment, banking and healthcare) and to 2 August 2028 for systems embedded in regulated products. The text is awaiting publication in the Official Journal of the EU, expected before 2 August, and will enter into force three days after that publication.
What remains in force on 2 August 2026 and what has been postponed
A partial postponement should not be confused with a general moratorium. The most serious prohibitions have been enforceable since February 2025 (subliminal manipulation, social scoring, mass biometric surveillance), together with the Article 4 obligation of AI literacy for all staff, which has not been affected by the postponement either, although the Omnibus itself reframes it as an obligation of reasonable means rather than of result. The obligations for providers of general-purpose models, such as GPT, Claude or Gemini, came into force in August 2025.
What does arrive in full on 2 August 2026, and has not been postponed, are the transparency obligations of Article 50 of the Regulation: any organisation that deploys a chatbot, a virtual assistant or a system that generates synthetic content must clearly inform the user that they are interacting with an AI, and artificially generated content must be labelled as such. For systems already on the market before that date, machine-readable technical marking (watermarking) has an additional margin until 2 December 2026. What is postponed to December 2027 and August 2028 is exclusively the block of high-risk obligations of Annex III and Annex I.
Who is affected and why there are no shortcuts
One of the most common misconceptions among organisations is believing that the Regulation only affects those who develop technology. That is not the case. Any company that uses an AI system in its processes has the status of deployer, with its own obligations that cannot be delegated to the provider. If a company uses CV screening software, a customer service chatbot or any generative AI tool in professional contexts, the Regulation applies to it, although the exact timetable depends on whether or not the system falls within the Annex III high-risk list.
The situation in Spain: supervisory infrastructure already operational
Spain was the first EU country to create its AI supervisory agency, AESIA, based in A Coruña. According to an analysis by Javadex, as of March 2026 the agency had already opened 23 preliminary investigations, and at that same date the AEPD recorded a 340% increase in AI-related investigations compared with the previous year. The supervisory machinery is therefore already up and running, regardless of the postponement of the high-risk regime.
However, according to data from Spain's National AI Observatory for January 2026, cited in the same source, only 32% of Spanish companies using AI had started processes to adapt to the Regulation, compared with 46% in France and 54% in Germany. The postponement of the high-risk regime gives some leeway, but it does not remove the transparency requirement of August 2026 or the activity already under way at AESIA and the AEPD.
What this means for educational organisations
Education remains classified as a high-risk sector in Annex III, and that is precisely the category whose full regime moves to 2 December 2027. This does not mean the issue can be put on hold: any educational institution that uses chatbots, assistants or tools that generate content remains subject to the transparency obligations of August 2026, and the work of inventorying systems, classifying them by risk and documenting human oversight is exactly the same as the high-risk regime will require when it arrives in 2027. Starting now, with the additional margin the Omnibus has provided, is an advantage, not an excuse to wait.
At LurNova we support educational organisations through this adaptation, with specific training in AI literacy and an approach of regulatory compliance built in from the design of the systems, not as a formality after their implementation.
CEO of LurNova, with extensive experience in technology and digital transformation. Involved in developing technology projects and applying artificial intelligence in organisations, he combines technical knowledge with business vision.
