The AI Act deadline for websites: what already applies, and what 2 December 2026 really changes
Superseded, 26 September 2026: a newer guide replaces this piece. The EU AI Act for small Irish and UK businesses: what actually applies to you covers the same ground and carries the full record.
Two dates turn up in almost everything written about the EU AI Act this year: 2 August 2026 and 2 December 2026. A lot of the advice online treats December as the deadline. We treated it that way in an earlier version of this page. The correction takes ten minutes.
The transparency duties on a normal business website have applied since 2 August 2026. 2 December 2026 adds a narrow window for one group: the makers of generative AI systems. The businesses that use them are outside it.
The two dates, side by side
| Date | What it means |
|---|---|
| 2 August 2026 | The AI Act's transparency rules (Article 50) became applicable. This is the date that catches websites that use AI: chatbot disclosure, disclosure of AI-generated content, and labelling obligations. |
| 2 December 2026 | Two narrow things: (1) providers of generative AI systems already on the market before 2 August 2026 get extra time to finish machine-readable marking of their output; (2) new prohibitions on AI-generated intimate imagery and child sexual abuse material apply. |
The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) added the 2 December grace period. Legacy systems are the only thing it touches, under the marking duty of Article 50(2). The delay is narrow. Any website that says a small business has until December to disclose that it uses AI is out of date.
What the Digital Omnibus actually delayed
The Omnibus moved the high-risk track. Standalone high-risk systems (Annex III) went from 2 August 2026 to 2 December 2027, and high-risk AI embedded in regulated products (Annex I: medical devices, machinery, vehicles) went to 2 August 2028. The sandbox obligation slipped to 2 August 2027.
Four things stayed put: Article 50 transparency, the prohibitions in force since February 2025, AI literacy duties, and the duties on general-purpose AI models.
If you read that "the AI Act is delayed" and assumed you could relax, check which delay. It applies to companies building high-risk AI systems: credit scoring, recruitment screening, medical software. For everyone else, nothing moved.
Who you probably are
The Act divides duties between providers (people who build and sell AI systems) and deployers (people who use them). A small business website almost always sits on the deployer side. What lands on you:
- A notice when someone is talking to an AI. If a chatbot, AI assistant or automated agent runs on the site or in your app, people have to be told before they interact. Not buried in a policy nobody opens.
- Disclosure when content is AI-generated or manipulated. Publish a deepfake, or AI-generated images, video or audio, and it has to be visibly disclosed. An editorial exception exists for some artistic and creative work.
- Emotion recognition and biometric categorisation carry their own duty. Use either, and the people concerned have to be informed in advance. Most SMEs can cross this off.
- AI literacy sits on the list too. Whichever way AI runs through the business, the staff using it should understand it. In force since February 2025, and rarely enforced with a fine.
What disclosure actually means in practice
Disclosure is mostly copy, not law. In practice: one visible line under the chat window, a short AI page linked from the footer, a caption or label on AI-generated media, and a policy note on what the company uses AI for. A lawyer is rarely needed.
Sell AI systems, or generate synthetic content at volume, and the bar rises. You also have to mark output in a machine-readable way (provenance metadata such as C2PA), and keep evidence of how you do it. The Commission adopted guidance on Article 50 on 20 July 2026. A voluntary Code of Practice on Transparency of AI-generated Content was published on 10 June 2026. Follow it, and you gain one accepted way to show you meet the marking and disclosure duties. The duties apply whether you follow it or not.
A ten-minute self-check
- Is there a chatbot or AI assistant on your site? If so, is a visible notice shown before the first interaction?
- Do you publish AI-generated images, video or audio, and are they labelled?
- Any emotion recognition or biometric categorisation in the business? For most businesses: no.
- Does an "AI" page sit in your footer, explaining what you use AI for and where?
- If asked, can you show what you checked and when? Evidence is the step everyone skips.
A "no" or a "not sure" on either of the first two is a live gap, and it will not wait for December.
We built a free check that walks a site through these questions and tells you what applies: https://rennwick.com/ai-act-check/. If you would rather have it done for you, the wording, the labelling, the AI policy page and the evidence file, our AI Act Fix is a fixed €390. The Readiness Pack (€1,500) covers the fuller version for companies with more than one site or product.
This article explains the rules. It is not legal advice. A specific situation needs a lawyer. For the website side, start with the free check.