The EU AI Act delay covers the part that never applied to you. The part that does is already live.

Somebody put a line in your last board pack: "EU AI Act high-risk obligations delayed to December 2027." Around the same time, somebody else offered to sell you an AI Act readiness programme.

Both of them are telling you something true. Neither is telling you the useful part.

The delay covers the part of the Act that probably never applied to you. The parts that probably do apply are already live, and in one case the obligation sits with you rather than with whoever built the system.

What actually changed in July 2026

The EU's Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal in late July 2026 and is now in force. It moved the deadlines for the heavy end of the Act:

• Stand-alone high-risk systems (recruitment, credit scoring, education, access to essential services) moved from 2 August 2026 to 2 December 2027.
• High-risk AI built into regulated products such as machinery and medical devices moved to 2 August 2028.
• Systems used by public authorities have until 2 August 2030.

That is the headline everybody read. As one US law firm put it, it is "a reprieve rather than a repeal". The delay happened because the national regulators and the technical standards were not ready, not because anybody decided the rules were wrong.

What applies now

Everything else kept its date.

• Prohibited practices have applied since February 2025. The one most likely to catch an ordinary employer is the ban on emotion recognition in the workplace. If a call-centre analytics tool scores your staff's mood from their voice, that is the question to ask about it. Fines for this tier go up to €35 million or 7% of worldwide turnover.
• AI literacy (Article 4) survived the Omnibus but was softened. You no longer have to ensure a "sufficient level" of literacy; you have to take measures that support it. That is an obligation to do something, not to achieve a result. It still means something written down.
• Transparency (Article 50) has applied since 2 August 2026. People talking to a chatbot must be told it is AI unless that is obvious. Deepfakes must be labelled. Generated content must carry machine-readable marking, with a grace period to 2 December 2026 for systems already on the market. Breaches sit in the €15 million or 3% of turnover tier.

Does the EU AI Act apply to UK companies?

Yes, if your AI system is sold into the EU or its output is used there. A UK company with a customer chatbot answering people in Ireland, or a recruitment tool ranking applicants for a role in Amsterdam, is in scope wherever its servers and staff sit. A website that merely happens to be reachable from the EU is not enough on its own.

The part your supplier will not mention

Here is the uncomfortable bit.

If you paid a supplier to build you a chatbot on top of a model from OpenAI, Anthropic or Google, and it runs under your name, the Act treats you as the provider of that system. Not the supplier. Not the model company. You. A provider is anyone who develops an AI system or has one developed and puts it into service under its own name.

So the Article 50 duty to tell users they are talking to AI belongs to you. In most builds that is one line of interface text. The point is not that it is hard. The point is that nobody on the project thought it was their job, and the supplier's statement of work almost certainly does not mention it.

The same logic is why we keep saying that the quote ending at go-live leaves you holding the system. Regulation is one more thing that stays with you after the supplier moves on.

Confident, but unable to say where the AI is

UK firms are not short of confidence. A survey of 1,501 decision makers across the UK, Germany and France, commissioned by the software company Conga in late 2025, found:

89% of UK business leaders believe their organisations are ready for the EU AI Act, against 82% in Germany and 68% in France. 18% of UK respondents did not know whether AI was already embedded in their own contract and quoting systems.

Treat it as a vendor survey: the sponsor sells the contract software in question, and the fieldwork predates the Omnibus. But the gap it shows is the one that matters. You cannot be ready for a law that turns on where AI is used if you cannot say where AI is used.

And the AI you did not buy deliberately counts too. Your applicant tracking system may have added candidate ranking in a release last spring. Your helpdesk platform may have switched on a reply-drafting assistant. Your staff are almost certainly using tools you have not approved. None of those arrived with a compliance note attached.

What to do this month

You probably do not need a readiness programme. You need a list, and for most organisations below enterprise size it is a few days' work.

• List every system that uses AI, including features inside software you already pay for. Ask each vendor directly; check release notes for the last eighteen months.
• For each one, answer two questions. Is the output used by or about people in the EU? Are you the provider (built for you, under your name) or a deployer (bought off the shelf)?
• Fix the cheap things now. Chatbot disclosure, labels on generated imagery, a written note of what staff training on AI you have done. These are live obligations and they cost almost nothing.
• Flag anything near the high-risk list. Recruitment, promotion or performance decisions, credit, insurance pricing, access to services. If any of those touch EU residents, December 2027 is the date to plan for, and fourteen months is not long to get documentation out of a supplier.
• Ask your suppliers in writing who they consider the provider to be, and what documentation they will hand over. A supplier who cannot answer that has not thought about it. Our nine questions for anyone selling you an AI agent cover the rest.

If that list comes back with a chatbot and a few productivity tools, you are probably done after a morning of fixes. If it comes back with a CV-screening feature nobody knew was switched on, you have found it fourteen months early rather than in a complaint.

That is the work a £1,250 Sanity Check is built for: a day, an inventory of where AI actually sits in your organisation, which of it the Act reaches, and a written answer on what needs fixing now and what does not. Including, very often, the programme you do not need to buy.