The Delay Trap: EU AI Act Rules That Apply Now, and Every EU and UK Compliance Deadline Left in 2026

The most expensive word in European compliance this year is "delayed". It travelled through the summer's coverage of the EU AI Act in every language of the Union, it sounded like permission to look away, and it was half true. The half that was false is the half that carries fines, and it reaches a firm in Lyon or Leipzig exactly as it reaches one in Leeds. ComplianceSME has spent the month reading the same headlines the market read, and the firms that relaxed have relaxed about the wrong law.

The deferral was real. The relaxation was not.

The Digital Omnibus on artificial intelligence entered into force on 27 July 2026. It deferred the AI Act's Annex III high-risk obligations from 2 August 2026 to 2 December 2027, and pushed the Annex I product rules to August 2028. On its own terms the delay is real. No Annex III high-risk obligation is live today, and a firm building a standalone high-risk system gained sixteen months of runway.

Article 50 did not move.

The transparency duties went live across the Union on 2 August, exactly as written. A chatbot must disclose itself to the person using it. Synthetic content must carry a label. The fines run to EUR 15 million or 3 per cent of worldwide turnover, and to 7 per cent for prohibited practices. Enforcement is no longer a future tense: the Commission's AI Office and the national authorities took up their powers on 2 August, and for general-purpose AI models the Commission has confirmed that violations dating back to August 2025 are in scope. One relief is real and dated: systems already on the market before 2 August 2026 have until 2 December 2026 to meet the marking duty. A firm that read "delayed" and closed the folder is carrying live duties it believes are parked until December 2027. The free EU AI Act checker at compliancesme.com states in about a minute which side of that line a company stands on.

The next date is European, and it is close

On 11 September 2026 the Cyber Resilience Act's reporting regime begins: manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents within 24 hours, to their national CSIRT and ENISA through the single reporting platform. The duty applies to products already on the market, more than a year before the CRA's full obligations arrive in December 2027, and a firm cannot report on software it has not mapped. For most small manufacturers this is the nearest hard deadline in Europe, and the least covered.

Behind it, the second half of the Omnibus is still moving: the data package covering GDPR, ePrivacy and the reporting single entry point remains under negotiation, with adoption expected no earlier than late 2026 and a Commission target of cutting SME administrative burden by 35 per cent. Firms that track it will inherit the relief; firms that do not will simply inherit new confusion.

Britain's calendar never paused either

There is no government UK AI bill; ministers deferred it, and the one private member's bill in Parliament has sat at first reading in the Lords since March 2025. What exists instead is a patchwork tightening on its own schedule: the ICO has found most AI recruitment tools non-compliant and its statutory code on AI and automated decision-making is imminent, while 54 per cent of SMEs now use AI, up from 35 per cent in 2025.

The domestic deadlines are less forgiving than Brussels. The first Making Tax Digital quarterly deadline arrived on 7 August with around 400,000 sole traders and landlords still unregistered of the 864,000 brought into scope in April, and Taxfix found 45 per cent of sole traders would rather quit than deal with it. From 1 October, right-to-work checks extend to gig and agency workers with penalties up to GBP 60,000 per worker, and from 30 October the harassment duty requires "all reasonable steps", with an Acas and YouGov survey finding 1 in 5 employers not confident on the new rules. The same autumn ends the Companies House identity verification transition on 18 November, 983,000 warning letters already sent, and each director's true deadline is the company's next confirmation statement, which may land far sooner. Preparation has not kept pace: only 34 per cent of SMEs have digitised compliance, against 63 per cent for accounting, and the FSB puts the typical nine-person firm's added employment bill at GBP 25,850 since January 2025.

Dates, not verdicts

None of this needs panic. It needs dates, read once, properly, wherever the firm sits.

A firm in the Union closes its Article 50 gaps first, because those duties are live now; marks its pre-existing generative systems before 2 December 2026; and if it makes products with digital elements, prepares for 24-hour reporting before 11 September. A firm in Britain puts its October employment duties on paper before October, verifies its directors before the 18 November backstop, and, if it faces EU customers or uses AI in front of them, treats Article 50 as its own. Both treat 2 December 2027 as a delivery date for high-risk work, not a reprieve. The deferral bought time on one regime, and everything else in this article is still running.

Essential dates for the diary

The window of action remaining on each, counted from 19 August 2026.

August

• 25 August, UK: electronic and workplace balloting arrives for statutory union ballots. 6 days.

September

• 1 September, UK: packaging producers resubmit 2025 pEPR data. 13 days.
• 1 September, France: every business must be able to receive electronic invoices; large firms must issue them. 13 days.
• 1 September, UK financial services: FCA non-financial misconduct rules extend to around 37,000 further firms. 13 days.
• 11 September, EU: Cyber Resilience Act reporting begins, 24 hours to report exploited vulnerabilities and severe incidents, products already on the market included. 23 days.
• 12 September, EU: Data Act access-by-design duties bind connected products placed on the market from this date. 24 days.
• 27 September, EU: the Empowering Consumers Directive applies, green claims and labels must hold up or come down. 39 days.

October

• 1 October, UK: right-to-work checks extend to gig, agency and subcontractor labour, penalties to GBP 60,000 per worker. 43 days.
• 1 October, UK: employment tribunal time limits double from three months to six. 43 days.
• 1 October, UK construction: the Building Safety Levy starts. 43 days.
• 1 October, Greece: B2B e-invoicing reaches all remaining resident taxpayers. 43 days.
• 3 October, Poland: NIS2 registration deadline for an estimated 42,000 firms. 45 days.
• 5 October, UK: Self Assessment registration deadline. 47 days.
• 30 October, UK: the harassment duty tightens to "all reasonable steps", third-party harassment included. 72 days.
• 31 October, UK: paper Self Assessment returns close. 73 days.
• 31 October, Italy: NIS2 basic security measures fall due and ACN inspections begin. 73 days.

November

• 7 November, UK: second Making Tax Digital quarterly update. 80 days.
• 18 November, UK: the Companies House identity verification transition ends; each director's true deadline is the company's next confirmation statement, and acting unverified beyond the backstop is a criminal offence. 91 days.

December

• 2 December, EU: three AI Act events on one day: the marking grace for pre-August generative systems expires, and two new prohibitions bind, on nudifier systems and CSAM-generating systems. 105 days.
• 2 December, EU: Platform Work Directive transposition deadline. 105 days.
• 9 December, EU: the revised Product Liability Directive applies, software and AI become products with strict liability attached. 112 days.
• 30 December, EU: Deforestation Regulation main obligations bind large and medium operators. 133 days.
• 30 December, UK: online Self Assessment deadline for PAYE code collection. 133 days.

Watching, undated: the EU Data Omnibus (adoption expected late 2026, Commission target of a 35 per cent SME burden cut), the ICO's statutory AI code, the UK Cyber Security and Resilience Bill, and the DMCC subscription rules now brought forward to January 2027.

The questions this year is asking

If you are asking any of these, ComplianceSME has your answer, most of them free.

• Does the EU AI Act apply to my small business?
• Do I have to tell customers my chatbot is AI?
• Does AI-generated content have to be labelled, and by when?
• Which EU AI Act rules are delayed and which apply right now?
• What is the Cyber Resilience Act 24-hour reporting rule, and does it cover products I have already sold?
• Does NIS2 apply to my company, and has my country set a registration deadline?
• Who must comply with the Deforestation Regulation by 30 December 2026?
• When do directors have to verify their identity with Companies House?
• What employment law changes reach UK firms in October 2026?
• What compliance deadlines are left in 2026, and how long do I have?

The reading is the part no small firm should have to fund alone, and it no longer has to. The national company law libraries of all twenty-eight nations, the GDPR system, and the free EU AI Act checker are open at compliancesme.com against a free account. The firms that come through the delay trap intact will be the ones that knew which duties were live, and the price of knowing is now zero.

ComplianceSME research articles are available for republication in full, free of charge, with attribution. Requests to toolkit@compliancesme.com.

Every claim and its source

Omnibus entry into force, deferral dates, and the 2 December 2026 prohibitions: Regulation (EU) 2026/1744, Official Journal 24 July 2026. Article 50 duties, fines, marking grace to 2 December 2026: Commission FAQ and press release IP/26/1714; Cooley, 3 August 2026. Enforcement live and GPAI violations since August 2025 in scope: Commission IP/26/1714. CRA reporting from 11 September 2026 via national CSIRT and ENISA single reporting platform: Regulation (EU) 2024/2847. Data Omnibus timing and 35 per cent SME target: Commission Digital Omnibus materials. UK bill status: bills.parliament.uk, Artificial Intelligence (Regulation) Bill [HL], first reading 4 March 2025. ICO AI recruitment finding and AI/ADM code: ICO. MTD figures: HMRC 23 July; ByteStart 5 February; Startups.co.uk (Taxfix) 6 August. Right-to-work and harassment dates: DLA Piper, Howes Percival, Fox Williams, Baker McKenzie. Acas/YouGov: People Management, 6 August. Companies House transition end: gov.uk (transition from 18 November 2025), ICAEW, Norton Rose Fulbright. Digitisation and AI adoption: CFOtech UK (Be Certified) 1 April; BCC/Atos. FSB cost figures: People Management, 20 February. Essential dates: each verified 19 August 2026 against primary sources (EUR-Lex, gov.uk, HMRC, Companies House, ENISA, ACN, national gazettes) or two independent professional briefings; the full per-date source register is held on file.