AI Act: Chatbots and Deepfakes Under Scrutiny Starting August 2026

Chatbots, Deepfakes, and Large Models: What Takes Effect on August 2

August 2, 2026 marks a key date for the regulation of artificial intelligence in Europe with the implementation of new obligations outlined in the AI Act. This legislation, framed by the Digital Omnibus, was officially published in the Official Journal of the European Union on July 24 and became effective three days later.

This date is part of a gradual application of the European AI regulation, which initially came into force on August 1, 2024. Some obligations have already been implemented since 2025.

Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, reaffirms the transparency requirements stipulated by Article 50 of the AI Act for August 2, 2026.

Chatbots, these conversational agents, as well as virtual avatars, will now be required to clearly inform users that they are interacting with an AI, unless this is obvious. Similarly, AI-generated or modified content, such as deepfakes, must be identifiable through technical marking or a visible mention. Systems already in circulation before this date have until December 2, 2026 to comply with these new rules.

The European Commission is also granted expanded oversight powers over providers of general-purpose AI models, such as ChatGPT, Gemini, or Claude. It can now demand additional information and impose sanctions in cases of non-compliance.

High-Risk Obligations Will Wait Until 2027 and 2028

The strictest obligations of the AI Act, concerning systems classified as high-risk such as those used in recruitment, credit scoring, education, or biometrics, will only take effect on December 2, 2027 for autonomous systems. For those integrated into already regulated products, such as medical devices or connected toys, implementation is scheduled for August 2, 2028.

The Digital Omnibus has pushed back these deadlines compared to the initial proposal from the European Commission, presented in November 2025. Before being brought to market, these systems must meet rigorous requirements: risk assessment and mitigation, quality of training data, traceability of results, detailed technical documentation, and human oversight.

The text also introduces, in Article 5, two new prohibitions applicable from December 2, 2026: AI systems generating non-consensual intimate content, referred to as nudification systems, and those producing child sexual abuse material.

What Companies Need to Check Before August 2

Two waves of obligations have already been implemented ahead of the August 2 deadline. The first, active since February 2025, prohibits eight AI practices deemed to pose unacceptable risks to fundamental rights. It also requires employees using AI tools to have a sufficient understanding of their functioning, limitations, and risks. These practices include:

• Harmful manipulation and deception based on AI.
• Exploitation of vulnerabilities related to age, disability, or social situation.
• Social scoring.
• Assessment or prediction of recidivism risk based solely on profiling.
• Non-targeted collection of facial images for facial recognition.
• Emotion recognition in workplaces and educational institutions.
• Biometric categorization of protected characteristics.
• Remote real-time biometric identification in public spaces.

The second wave, in effect since August 2025, concerns providers of general-purpose AI models. They must document their training data and comply with copyright policies, with additional obligations for models deemed to pose systemic risks, which must assess their risks and report serious incidents.

The general sanctions regime of the AI Act has also been active since this date, with national authorities, such as DGCCRF, CNIL, and Arcom in France, empowered to intervene against violations.

The AI Act Timeline

• February 2, 2025: Prohibition of unacceptable risk practices and obligation for AI literacy for employees.
• August 2, 2025: Implementation of the regime for general-purpose AI models and the general sanctions regime.
• August 2, 2026: Transparency obligations for chatbots, deepfakes, and AI-generated content, expanded oversight powers over GPAI providers.
• December 2, 2026: New prohibitions (nudification, child sexual abuse material) and end of the transition period for marking existing AI content.
• December 2, 2027: Obligations for high-risk autonomous systems (recruitment, credit, education, biometrics).
• August 2, 2028: Obligations for high-risk systems integrated into regulated products (medical devices, connected toys).