August 3, 2026 • 16 mins
The Digital Omnibus has postponed the obligations on high-risk AI systems, but it has not modified the general date of application of the AI Act. As a consequence, as of the 2nd of August 2026, the enforcement powers on general purpose AI models, the transparency obligations under Article 50 and the entire sanctioning framework become fully enforceable.
In this episode of Diritto al Digitale, Giulio Coraggio, technology and data lawyer, reviews what is actually applicable as of today, the operational implications of the requalification from deployer into provider, what Regulation (EU) 2026/1744 has postponed to December 2027 and August 2028, and why the actual obstacle to compliance is not the legal text, but the absence of an allocated accountability. With a concrete five-point board paper for in-house legal functions.
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
SPEAKER_00 (00:09):
Let's imagine that on Monday morning you receive a
request for information from asupervisor at word, not an
inspection, an email of threelines.
Please provide a list ofartificial intelligence systems
used by your organizationindicated.
For each of them, the purpose,the owner, and the role
performed by your company underthe regulation.
(00:32):
How much time would you need inorder to reply?
In my experience, the honestanswer that I receive from
Inhouse Link of Council is thefollowing.
I do not know because I'm noteven aware of how many systems
are in place.
As of today, that in aid ispossible.
(01:07):
In this episode, we shalldiscuss the date of the 2nd of
August 2026 and themisunderstanding growing around
it.
What becomes actually applicableunder the UAI Act?
What has been postponed becauseof the digital omnibus package?
And above all, the operationalimplications for those who,
(01:28):
within companies, have totranslate all of this into
decisions.
I'm addressing in particularthose of you who work in house
since you are most likely theones who have already flagged
this issue internally and whonow have to put it back on the
agenda.
(01:53):
On the 27th of July, theregulation 2026-1744, the
so-called Digital Omnibus OAI,entered into force, amending the
UAI Act just a few days beforeits main date of application.
The intervention follows theso-called Draghi Report and the
(02:14):
debate on Europeanoverregulation.
The purpose was to simplify.
The outcome for anyone who hasto build a compliance plan is
considerably more articulated.
The point to be fixed is thefollowing, and I would suggest
to use it literally when youdiscuss the matter internally.
(02:35):
The digital omnibus haspostponed the obligations
relating to high-risk AIsystems.
It has not, however, modifiedthe general data application of
the UAI Act, which remains the2nd of August 2026.
Both statements are true at thesame time, and the mistake that
I see spreading, includingmemoranda circulated by
(02:59):
advisors, is the impropersummary according to which the
AAI Act has been postponed.
This is not the case.
Let's enter into the merit.
As of the 2nd of August 2026,three matters change.
Firstly, the enforcement powersof general purpose AI models.
(03:23):
The EU Commission and the UAIoffice obtain the power to
investigate and sanction theproviders of general purpose AI
systems with fines up to 15million euro or 3% of the
worldwide turnover.
The substantive obligationsapplied already since August
(03:43):
2026.
What is activated today is,however, is the sanctioning
apparatus.
Second point, the transparencyobligations under Article 50 of
the UAI Act become enforceable.
I shall come back to them later,since they affect the largest
(04:04):
number of organizations and evenindividuals.
Thirdly, the whole sanctioningframework becomes operational,
and national market surveillanceauthorities may enforce all the
provisions already enforced.
This includes also Article 5 onprohibited practices and Article
4 on AI literacy, applicablesince February 2025, but so far
(04:30):
without a fully activeenforcement mechanism.
It's now sufficient to adoptmeasures aimed at supporting its
development, withoutguaranteeing a specific level.
This is a real simplification,but not a repeal, and
(04:53):
documenting the traininginitiatives remains the easiest
manner to evidence compliance.
In my view, Article 50 is themost underestimated obligation
of this phase.
For a structural reason, it doesnot presuppose a high-risk
system, and therefore it remainsoutside the classification
(05:14):
exercise that has absorbed mostof the work of the last months.
Let me summarize its scope,since this is a checklist that
you may circulate to thebusiness already from today.
Those who provide systemsintended to interact with
(05:34):
natural persons shall ensurethat the artificial network, the
artificial network of the systemis recognizable.
Unless evident from the content,support, chatbots, voice agents,
virtual assistants, and avatarsshall have this kind of
disclosure.
Synthetic contents shall belabeled.
(05:56):
AI-generated texts published inorder to inform the public on
matters of general interestshall be declared as such unless
a natural person assumes theeditorial responsibility.
And those deploying emotionrecognition of biometric or
biometric categorization shallinform the individuals
(06:17):
concerned.
Two operational remarks,however.
The machine readable markingunder the second paragraph does
not apply to the systems alreadyplaced on the market before
today, for which the deadline isthe 2nd of December 2026.
On the contrary, the informationtowards individuals is
(06:38):
enforceable immediately.
The second remark is theargument that they usually raise
with CFOs.
What we are dealing with theleast expensive compliance
measure of the entire UAI Act.
A line of text within aninterface to defend before a
board the failure to adopt ameasure whose cost is one day of
(07:01):
development is a position inwhich I would not like to be.
(10:08):
This might remove from thehigh-risk perimeter more systems
than one would expect.
Therefore, it's advisable toreview the classification
performed before July.
In any case, the postponementdoes not represent a relief.
The technical documentation, thefundamental rights impact
(10:30):
assessments, and therequalification of agreement of
the agreements with suppliersrequire between 6 and 12 months
of work.
Moreover, the inventory that youshall need in December 2027 is
exactly the one that anauthority might request a very
easier.
And here I come to the reasonfor which I wanted to record
(10:51):
this episode.
In my experience, obstacle isalmost never the text of the
regulation.
You are familiar with the text,the obstacle is that with
organizations, AI compliancedoes not belong to anyone.
Either it's spread among legal,IT, security, procurement,
marketing, and the businesslines, with each of them
(11:14):
assuming that somebody else willbe dealing with it.
Or, and this is the moreinsidious variant, since it has
the appearance of a solution,it's entirely allocated to the
IT department, which maps thesystems and implements the
controls.
An essential contribution.
But it is not the functionequipped in order to determine
(11:37):
whether a used case falls underAnnex 3, whether a fine-tuning
has led to a requalification, orwhether a disclosure under
Article 50 is legally adequate.
There are legal qualificationstaken by default by individuals
who have never received suchmandate.
I've also mentioned twoarguments that I assume you have
(12:00):
already heard since I hear themconstantly.
First one, but these systems areused by everyone.
This is the most frequentobjection and also the weakest.
The circumstance that a tool iswidely adopted does not say
anything about how the same isactually used within your
(12:21):
organization, on which the datahas been trained and which
function is performed.
Moreover, the widespread breachof an obligation does not
consider the justification.
On the contrary, it increasesthe likelihood of an
intervention by the authority,and at that stage, somebody
should beat the first case.
(12:41):
Second argument is more subtle.
A number of organizations selectthe tool with considerable
rigor, due diligence on thesupplier, negotiated agreement,
preliminary assessment, and thenthey do not monitor anymore how
the system is used within yourorganization.
The system is introduced for agiven purpose and then six
(13:05):
months later it's serving adifferent one.
Nobody has taken such decision.
Compliance is not assessed onthe basis of the purchase
agreement, it's assessed on thebasis of the actual use.
And that the actual use within aconsiderable number of
organizations is not monitoredby anyone.
If this description soundsfamiliar, the issue is not
(13:29):
yours, but the solution passesthrough you, since you are the
only function having visibilityboth on the legal risks and on
the decisions making process.
Let me conclude with that.
Very pragmatically, I wouldsuggest to include in a board
paper due in the coming weeks.
(13:50):
Number one, the inventory of AIsystems in use, including shadow
AI, the purpose, the owner, andthe role performed by the
organization.
Everything else depends on it,as well as your ability to reply
to a request from an authority.
2.
The formal allocation of theresponsibility, an AI committee
(14:10):
with a defined mandate, anescalation path, and a minutes
decisions involving legal, ITcompliance, audits, UAD, and the
business.
We have dedicated a specificepisode of this podcast to this
uh establishment.
Number three, the assessmentunder article 5 and 50, which
(14:32):
has the closest deadline and thelowest cost.
So we're talking about thelabeling, the disclaimers that
need to be present when an AIsystem is interacting with an
individual.
Number four, the assessment ofthe potential re-qualifications
that means of the exercise onthe projects of the last year.
(14:54):
So re-qualification between adeployer and a provider.
Number five, the launch of thehigh-risk work stream to be
justified before the board onthe basis of the time required
rather than the deadline.
And above all, please documentthe decisions taken during an
inspection, a dated record ofwhat has been assessed and of
(15:19):
why a given option has not beenpursued is worth considerably
more than an impeccable policythat nobody has applied.
The question that I would raisebefore any board of directors
and that I suggest you do raiseyourself is a very short one.
Is there anyone with a name orand a surname accountable for AI
(15:43):
compliance within thisorganization?
If the answer requires more thana moment, that is the first item
of the agenda.
So just to conclude, the 2nd ofAugust 2026 is not the
compliance cliff that the marketwas expecting.
It's the moment in which theenforcement begins in relation
(16:04):
to the obligations that havebeen silently accumulating since
February 2023.
For organizations, having anaccountable function, the matter
is manageable, and under severalaspects, it represents a
competitive advantage towardsclients and partners that are
beginning to request at thecontractual stage.
(16:27):
For the others, the postponementto December 2027 shall pass
exactly in the same manner asthe last 18 months.com.
(16:52):
Thank you for listening.
Arrivederci
Let's imagine that on Monday morning you receive a
request for information from asupervisor at word, not an
inspection, an email of threelines.
Please provide a list ofartificial intelligence systems
used by your organizationindicated.
For each of them, the purpose,the owner, and the role
performed by your company underthe regulation.
(00:32):
How much time would you need inorder to reply?
In my experience, the honestanswer that I receive from
Inhouse Link of Council is thefollowing.
I do not know because I'm noteven aware of how many systems
are in place.
As of today, that in aid ispossible.
(01:07):
In this episode, we shalldiscuss the date of the 2nd of
August 2026 and themisunderstanding growing around
it.
What becomes actually applicableunder the UAI Act?
What has been postponed becauseof the digital omnibus package?
And above all, the operationalimplications for those who,
(01:28):
within companies, have totranslate all of this into
decisions.
I'm addressing in particularthose of you who work in house
since you are most likely theones who have already flagged
this issue internally and whonow have to put it back on the
agenda.
(01:53):
On the 27th of July, theregulation 2026-1744, the
so-called Digital Omnibus OAI,entered into force, amending the
UAI Act just a few days beforeits main date of application.
The intervention follows theso-called Draghi Report and the
(02:14):
debate on Europeanoverregulation.
The purpose was to simplify.
The outcome for anyone who hasto build a compliance plan is
considerably more articulated.
The point to be fixed is thefollowing, and I would suggest
to use it literally when youdiscuss the matter internally.
(02:35):
The digital omnibus haspostponed the obligations
relating to high-risk AIsystems.
It has not, however, modifiedthe general data application of
the UAI Act, which remains the2nd of August 2026.
Both statements are true at thesame time, and the mistake that
I see spreading, includingmemoranda circulated by
(02:59):
advisors, is the impropersummary according to which the
AAI Act has been postponed.
This is not the case.
Let's enter into the merit.
As of the 2nd of August 2026,three matters change.
Firstly, the enforcement powersof general purpose AI models.
(03:23):
The EU Commission and the UAIoffice obtain the power to
investigate and sanction theproviders of general purpose AI
systems with fines up to 15million euro or 3% of the
worldwide turnover.
The substantive obligationsapplied already since August
(03:43):
2026.
What is activated today is,however, is the sanctioning
apparatus.
Second point, the transparencyobligations under Article 50 of
the UAI Act become enforceable.
I shall come back to them later,since they affect the largest
(04:04):
number of organizations and evenindividuals.
Thirdly, the whole sanctioningframework becomes operational,
and national market surveillanceauthorities may enforce all the
provisions already enforced.
This includes also Article 5 onprohibited practices and Article
4 on AI literacy, applicablesince February 2025, but so far
(04:30):
without a fully activeenforcement mechanism.
It's now sufficient to adoptmeasures aimed at supporting its
development, withoutguaranteeing a specific level.
This is a real simplification,but not a repeal, and
(04:53):
documenting the traininginitiatives remains the easiest
manner to evidence compliance.
In my view, Article 50 is themost underestimated obligation
of this phase.
For a structural reason, it doesnot presuppose a high-risk
system, and therefore it remainsoutside the classification
(05:14):
exercise that has absorbed mostof the work of the last months.
Let me summarize its scope,since this is a checklist that
you may circulate to thebusiness already from today.
Those who provide systemsintended to interact with
(05:34):
natural persons shall ensurethat the artificial network, the
artificial network of the systemis recognizable.
Unless evident from the content,support, chatbots, voice agents,
virtual assistants, and avatarsshall have this kind of
disclosure.
Synthetic contents shall belabeled.
(05:56):
AI-generated texts published inorder to inform the public on
matters of general interestshall be declared as such unless
a natural person assumes theeditorial responsibility.
And those deploying emotionrecognition of biometric or
biometric categorization shallinform the individuals
(06:17):
concerned.
Two operational remarks,however.
The machine readable markingunder the second paragraph does
not apply to the systems alreadyplaced on the market before
today, for which the deadline isthe 2nd of December 2026.
On the contrary, the informationtowards individuals is
(06:38):
enforceable immediately.
The second remark is theargument that they usually raise
with CFOs.
What we are dealing with theleast expensive compliance
measure of the entire UAI Act.
A line of text within aninterface to defend before a
board the failure to adopt ameasure whose cost is one day of
(07:01):
development is a position inwhich I would not like to be.
(10:08):
This might remove from thehigh-risk perimeter more systems
than one would expect.
Therefore, it's advisable toreview the classification
performed before July.
In any case, the postponementdoes not represent a relief.
The technical documentation, thefundamental rights impact
(10:30):
assessments, and therequalification of agreement of
the agreements with suppliersrequire between 6 and 12 months
of work.
Moreover, the inventory that youshall need in December 2027 is
exactly the one that anauthority might request a very
easier.
And here I come to the reasonfor which I wanted to record
(10:51):
this episode.
In my experience, obstacle isalmost never the text of the
regulation.
You are familiar with the text,the obstacle is that with
organizations, AI compliancedoes not belong to anyone.
Either it's spread among legal,IT, security, procurement,
marketing, and the businesslines, with each of them
(11:14):
assuming that somebody else willbe dealing with it.
Or, and this is the moreinsidious variant, since it has
the appearance of a solution,it's entirely allocated to the
IT department, which maps thesystems and implements the
controls.
An essential contribution.
But it is not the functionequipped in order to determine
(11:37):
whether a used case falls underAnnex 3, whether a fine-tuning
has led to a requalification, orwhether a disclosure under
Article 50 is legally adequate.
There are legal qualificationstaken by default by individuals
who have never received suchmandate.
I've also mentioned twoarguments that I assume you have
(12:00):
already heard since I hear themconstantly.
First one, but these systems areused by everyone.
This is the most frequentobjection and also the weakest.
The circumstance that a tool iswidely adopted does not say
anything about how the same isactually used within your
(12:21):
organization, on which the datahas been trained and which
function is performed.
Moreover, the widespread breachof an obligation does not
consider the justification.
On the contrary, it increasesthe likelihood of an
intervention by the authority,and at that stage, somebody
should beat the first case.
(12:41):
Second argument is more subtle.
A number of organizations selectthe tool with considerable
rigor, due diligence on thesupplier, negotiated agreement,
preliminary assessment, and thenthey do not monitor anymore how
the system is used within yourorganization.
The system is introduced for agiven purpose and then six
(13:05):
months later it's serving adifferent one.
Nobody has taken such decision.
Compliance is not assessed onthe basis of the purchase
agreement, it's assessed on thebasis of the actual use.
And that the actual use within aconsiderable number of
organizations is not monitoredby anyone.
If this description soundsfamiliar, the issue is not
(13:29):
yours, but the solution passesthrough you, since you are the
only function having visibilityboth on the legal risks and on
the decisions making process.
Let me conclude with that.
Very pragmatically, I wouldsuggest to include in a board
paper due in the coming weeks.
(13:50):
Number one, the inventory of AIsystems in use, including shadow
AI, the purpose, the owner, andthe role performed by the
organization.
Everything else depends on it,as well as your ability to reply
to a request from an authority.
2.
The formal allocation of theresponsibility, an AI committee
(14:10):
with a defined mandate, anescalation path, and a minutes
decisions involving legal, ITcompliance, audits, UAD, and the
business.
We have dedicated a specificepisode of this podcast to this
uh establishment.
Number three, the assessmentunder article 5 and 50, which
(14:32):
has the closest deadline and thelowest cost.
So we're talking about thelabeling, the disclaimers that
need to be present when an AIsystem is interacting with an
individual.
Number four, the assessment ofthe potential re-qualifications
that means of the exercise onthe projects of the last year.
(14:54):
So re-qualification between adeployer and a provider.
Number five, the launch of thehigh-risk work stream to be
justified before the board onthe basis of the time required
rather than the deadline.
And above all, please documentthe decisions taken during an
inspection, a dated record ofwhat has been assessed and of
(15:19):
why a given option has not beenpursued is worth considerably
more than an impeccable policythat nobody has applied.
The question that I would raisebefore any board of directors
and that I suggest you do raiseyourself is a very short one.
Is there anyone with a name orand a surname accountable for AI
(15:43):
compliance within thisorganization?
If the answer requires more thana moment, that is the first item
of the agenda.
So just to conclude, the 2nd ofAugust 2026 is not the
compliance cliff that the marketwas expecting.
It's the moment in which theenforcement begins in relation
(16:04):
to the obligations that havebeen silently accumulating since
February 2023.
For organizations, having anaccountable function, the matter
is manageable, and under severalaspects, it represents a
competitive advantage towardsclients and partners that are
beginning to request at thecontractual stage.
(16:27):
For the others, the postponementto December 2027 shall pass
exactly in the same manner asthe last 18 months.com.
(16:52):
Thank you for listening.
Arrivederci
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
The Bobby Bones Show
Listen to 'The Bobby Bones Show' by downloading the daily full replay.