The delay is real. It does not cover your chatbot.

Picture this: July 2026, a hotel director in Lucerne reads the headline “Brussels delays AI rules until 2027” and closes the file with some relief. The project can wait. Meanwhile, on the hotel’s website, a chat assistant answers guests from Munich and Milan in their own language, signs as “Laura” and never says that Laura is a program.

The headline was correct. The conclusion was not. What the EU postponed is what very few companies in my sectors have. What almost all of them have was not postponed.

What was actually postponed.

On 24 July 2026 the Official Journal of the EU published Regulation (EU) 2026/1744 of 8 July, known as the Digital Omnibus on AI, which amends the AI Act. According to the analysis by the law firm Cuatrecasas, its most important practical change is the calendar for high-risk systems. Stand-alone systems listed in Annex III, in areas such as biometrics, employment, education, migration or access to essential services, are now subject to those rules from 2 December 2027. Systems embedded in products covered by EU product safety legislation, from 2 August 2028. The original date for both was 2 August 2026.

The Commission had proposed a flexible date, tied to the availability of technical standards. Parliament and Council rejected it and wrote fixed dates into the text. That detail matters: the new deadlines do not depend on anything else happening first.

What was not postponed.

The transparency obligations of Article 50 have applied since 2 August 2026. An AI system that interacts directly with people must be designed so that they know they are dealing with a machine, unless that is obvious from the context. Images, audio or video generated or manipulated with AI that would pass as authentic, what the law calls a deep fake, must be disclosed as such by whoever uses the system to create them. Only the technical marking of generated content, for providers whose systems were already on the market before August, received a short extension, until 2 December 2026.

Article 4 also remains. Providers and deployers must take measures to support the AI literacy of the people who use these systems on their behalf. The Omnibus softened the wording, and the article now states that it does not require any specific level of literacy from anyone. It did not remove the obligation. The prohibited practices of Article 5 have applied since February 2025, and the Omnibus added two more, on non-consensual sexual deepfakes and child sexual abuse material.

What was postponed is what almost no one has. What almost everyone has already applies.

The blind spot: you may be the provider.

Most companies assume the obligations belong to the software vendor. The AI Act defines the provider as whoever develops an AI system, or has one developed, and puts it into service under its own name or trademark. A clinic that commissions a custom assistant and launches it under its own brand is not just a user. And the duty to design the chatbot so that people know it is a machine falls on the provider.

Nor does the regulation stop at the border. It also covers providers and deployers established outside the EU when the output of the system is used in the Union. A Swiss hotel whose assistant answers guests in Germany or Italy should not assume that being in Switzerland settles the question.

Where high risk is closer than it seems.

In my sectors, few companies build high-risk systems. More of them use one without calling it that. Annex III includes, among others:

• Schools and boarding schools. Systems that decide on admission, evaluate learning outcomes, determine the appropriate level of education or monitor students during tests.
• Recruitment, in any sector. Tools that filter applications or evaluate candidates, including the screening feature of the hiring platform a hotel uses every season.
• Emergencies. Triage systems for patients in emergency healthcare.

For these uses there is time until December 2027, and it is worth using. Discovering in late 2027 that the admissions tool is high risk is too late, because human oversight, records and a proper contract with the vendor are not built in a month.

Images: the rule agencies and hotels overlook.

Real estate agencies and hotels publish more and more AI images: furnished living rooms in empty flats, terraces at a sunset that never happened, rooms with a light they never have. When an image resembles a real place and would pass as authentic, it falls under the deep fake rule and must be disclosed as generated or manipulated. The law allows a discreet notice for evidently artistic or fictional work. The photo of a flat for sale is not one.

Switzerland: no AI law yet, but already a rule.

Switzerland has no specific AI legislation today. On 12 February 2025 the Federal Council instructed the Federal Department of Justice and Police to prepare a consultation draft by the end of 2026, covering transparency, data protection, non-discrimination and oversight, so that Switzerland can ratify the Council of Europe convention on AI, which it signed in March 2025.

That does not mean nothing applies. The Federal Data Protection and Information Commissioner (FDPIC) considers the current Data Protection Act directly applicable to AI. In its reading, people who talk to a language model have a legal right to know whether they are dealing with a machine and whether what they type is used to improve the program or for other purposes. Programs that falsify the faces, images or voices of identifiable people must be clearly indicated, and high-risk processing requires a data protection impact assessment. In practice, for the chatbot, a clinic in Zurich and a hotel in Málaga reach a very similar duty by different roads.

Where I stand.

I build AI automations, and I would advise any client to read the delay the other way round: as time to do the high-risk homework calmly, not as a reason to postpone the transparency already owed. In an assistant, the first sentence matters more to me than the personality: who is speaking, that it is automatic and how to reach a person. In a premium house, a guest forgives a machine. A guest does not forgive being misled.

What I would check.

• Every AI use in the company. Website chat, WhatsApp, email replies, images, recruitment, admissions, reports.
• The assistant’s first sentence. That it says it is automatic and offers a person.
• Who the provider is. If the system was built for you and runs under your name, read Article 50 as if it were addressed to you.
• The images. Which ones are generated or retouched with AI, and where that is disclosed.
• The people. What training the staff who use these tools receive, and whether it is documented.

A calendar that does not wait.

1. This week

   Make the inventory

   Every AI tool, who supplies it and under whose name it runs.

2. This month

   Fix transparency

   The assistant’s first sentence, a label on realistic AI images and a visible route to a person.

3. End of 2026

   Follow the Swiss draft

   The consultation draft is due by the end of the year and will show what Switzerland adds.

4. Before December 2027

   Classify high risk

   Admissions, assessment, recruitment, triage: decide with your lawyer which uses fall under Annex III.

A question to ask yourself before the year ends. If someone asked you tomorrow who the provider of your website’s assistant is, would you answer with the name of a company or with your own? This note explains why the answer may not be the one you expect.

And another for whoever runs your marketing: how many images on your website were generated with AI, and does any of them say so?

If you would like me to review your assistants, your images and your automations from this angle, start with the Strategic Diagnostic. Whether a specific use is high-risk is a legal assessment for your lawyer.