AI & Technology Intelligence

AI NEWS INSIDER

Issue #70 · August 3, 2026

THIS WEEK: The EU AI Act's deadline everyone was watching finally arrived. Half of it landed exactly on schedule. The other half quietly disappeared for seventeen months. Most compliance teams are planning around the wrong half.

7 MIN READ  |  Sharp, actionable intelligence

The EU AI Act Just Went Live: What Actually Changed on August 2, and What Indian Tech Got Wrong About It

By AI News Insider Editorial · 7 min read

Two failure modes are already showing up in enterprise Slack channels this week. One team assumes the EU AI Act's toughest rules just landed and is freezing every AI project that touches Europe. The other assumes the whole thing got delayed and shelved its compliance work months ago. Both are wrong, and the confusion itself is now the bigger risk than the regulation.

What actually landed on schedule

On August 2, the European Commission's AI Office and national regulators across all 27 member states began enforcing a genuinely new set of obligations. Chatbots and other interactive AI systems must now tell users they are talking to a machine, not a person. Deepfakes and AI-generated images, video, and audio require machine-readable labels, with a grace period to December 2 for content already on the market before August 2. Providers of general-purpose models, the category that includes GPT, Claude, and Gemini, are now under formal AI Office oversight covering documentation, copyright policy, and training data summaries. More than 180 organizations have already signed the Commission's voluntary code of practice to get ahead of it.

That is the half that landed exactly on schedule. The half that did not is the half most compliance roadmaps for 2026 were built around.

What quietly slipped by seventeen months

A Digital Omnibus agreement, finalized by the European Parliament and Council in June, pushed the Act's heaviest obligations back. Standalone high-risk systems under Annex III, the category covering recruitment tools, credit scoring, education platforms, and critical infrastructure AI, now face full compliance on December 2, 2027 instead of August 2, 2026. High-risk AI embedded inside already-regulated products, think medical devices and industrial machinery, moves further still, to August 2028.

The reason was not political softening. Member states were slow to designate national competent authorities, and the harmonized technical standards regulators need to actually assess conformity were not finished in time. Regulators were on track to demand compliance against a rulebook that did not fully exist yet.

Why this is an India story, not just a Brussels one

NASSCOM estimates more than 1,200 Indian technology companies currently serve European clients that could fall under this regulation. That includes firms building exactly the kind of tools Annex III targets: automated resume screening, predictive credit scoring, and machine learning analytics sold into European banks, insurers, and HR platforms.

Here is the trap. The Annex III delay does not take these companies off the hook right now. Article 50 transparency obligations apply regardless of risk tier, so any Indian company whose product interacts with EU users through a chatbot, or generates content for EU markets, needs disclosure and labeling in place today. And EU enterprise buyers are not waiting until December 2027. Procurement teams at European banks and insurers are already writing AI Act compliance clauses into vendor contracts, which means a missing EU authorized representative or an incomplete risk classification can stall a deal long before any regulator gets involved.

As of April, roughly 78% of organizations globally had not taken meaningful steps toward compliance, according to Responsible AI Labs. Given how many Indian firms only just registered the Digital Omnibus delay as good news, that number is unlikely to be much better closer to home.

The scope nobody's headquarters can escape

The Act's reach works the way GDPR's does. Where your company is registered does not determine whether you are in scope. Whether your AI system's output touches an EU user does. A recruiting tool built entirely in Pune and sold to a hiring manager in Berlin is in scope. A credit model trained in Bengaluru and served through an API to a Dutch bank is in scope. The location of your servers, your founders, or your headquarters carries no weight against Article 2's extraterritorial reach.

Penalties scale with the violation, and none of these figures moved with the Omnibus delay. Prohibited practices, already enforceable since February 2025, carry fines up to €35 million or 7% of global turnover, whichever is higher. High-risk system violations top out at €15 million or 3%. Supplying regulators with incorrect information carries penalties up to €7.5 million or 1%.

You do not need a Brussels-based legal team to get ahead of this. You need to stop treating "delayed" and "live" as one status. Five steps separate the companies that lose a European deal from the ones that win it.

C. Classify every system against the four-tier risk model

Inventory every AI system you sell or use that touches an EU user, and tag which Annex it falls under. Most teams have never done this exercise. It is also the fastest way to find out you have less exposure than you feared, or far more.

L. Label AI interactions and synthetic content now

Article 50 duties are live, not delayed. If a chatbot talks to EU users or your product generates content for EU markets, disclosure and labeling belong in the product today.

E. Engage an EU authorized representative

If you serve EU clients without an EU entity, this is the single requirement most likely to block a procurement deal before a regulator ever gets involved.

A. Audit documentation gaps

GPAI usage and any system still on the original clock need technical documentation now. Waiting for the harmonized standards to finish is not a defense; it is what caused this delay in the first place.

R. Reserve budget for December 2027

The delay bought runway, not an exemption. Build the Annex III budget line now, while you have time to spread the cost, instead of scrambling in late 2027 with everyone else.

Holistic AI (AI Governance and EU AI Act Compliance Platform)

The easiest way to live the "C" in the CLEAR framework, if compliance just landed on your desk

What it is: A London-founded AI governance platform that grew out of algorithmic bias-audit work into org-wide AI system inventory, risk classification, and EU AI Act and ISO 42001 compliance workflows, with real-time runtime enforcement added this year through its Guardian Agents feature.

Why it matters now: Most AI Act tooling stops at policy templates and PDFs to sign. Holistic AI pairs its EU AI Act, ISO 42001, and NIST AI RMF control mapping with an actual audit practice, including bias audits and published jailbreak testing of frontier models, and was placed as a Challenger in Gartner's 2026 Magic Quadrant.

Who gets it: Compliance leads and CTOs at Indian firms serving EU clients who need a defensible system-of-record for classification and documentation, not just a checklist.

• Maps controls directly to EU AI Act articles, not just generic frameworks
• Runtime enforcement via Guardian Agents, including a kill switch for high-risk actions
• Real audit track record beyond workflow software, including regulator-facing conformity assessments

"...helping citizens know when they are interacting with AI."

Henna Virkkunen · Executive Vice-President for Tech Sovereignty, Security and Democracy, European Commission · on the Article 50 transparency guidelines, 2026

Share AI News Insider

Know a founder, compliance lead, or CTO whose product touches Europe? Forward them this issue before their next procurement call.

AI News Insider · Your weekly edge in artificial intelligence
aiinsider247.com