TL;DR for the DPO
Many articles still circulate the old calendar. 2 August 2026 is NO LONGER the start of high-risk obligations: those moved to 2 December 2027 and 2 August 2028. What starts on 2 August is transparency (Art. 50), governance and penalties. Anyone who has told clients that everything arrives in August needs to correct course.
What becomes applicable on 2 August 2026
- Transparency obligations (Art. 50): those making available systems that interact directly with people - chatbots, voice assistants, conversational agents - must make their artificial nature recognisable. Synthetic content (text, images, audio, video) must be identifiable as such. The European Commission has published final guidelines on this article.
- Governance and penalties: national supervisory authorities become fully operational and acquire enforcement powers.
- For systems ALREADY on the market the transitional period to meet transparency requirements has been cut from six to three months: anyone running chatbots or content generators in production has less time than they might have expected.
What has been moved
- Stand-alone high-risk systems (Annex III): 2 December 2027. These are the ones used in recruitment, creditworthiness, biometrics, education, justice and migration.
- High-risk systems embedded in products already governed by sectoral legislation, such as medical devices and machinery: 2 August 2028.
- Two new absolute prohibitions are added from 2 December 2026: using AI to create or manipulate realistic intimate images or video without consent, and generating child sexual abuse material.
What to do now, in practice
1) Check whether clients have tools that talk to people or generate content: website chatbots, assistants in the customer area, AI-produced text or images. These are the Art. 50 cases and must be made recognisable; 2) review notices and interfaces: the disclosure must be visible to the user, not buried at the foot of a page; 3) do NOT shelve the high-risk files: postponement is not cancellation, and mapping systems, assigning responsibilities and training staff remains work to do now, with more time to do it properly; 4) update documents citing the old calendar, starting with AI system registers already delivered.
The point that concerns the DPO directly
The Digital Omnibus introduces a legal basis allowing providers of high-risk systems to process special categories of data under Art. 9 GDPR in order to correct algorithmic bias, and provides for coordination between the fundamental rights impact assessment (FRIA) and the data protection impact assessment (DPIA). The stated aim is to avoid duplicated documentation while maintaining the same level of protection. This is precisely the ground on which the DPO is asked to have a view.
A note on AI literacy
The staff literacy obligation (Art. 4), in force since February 2025, has been softened in wording: from measures to ENSURE a sufficient level of literacy to measures aimed at SUPPORTING the development of literacy. The duty remains, but its intensity changes. Anyone who has already delivered training and kept the records need not redo anything.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
