AI Act: 2 December ends the grace period for labelling

This summer many businesses relaxed. They read that Europe was postponing its artificial intelligence obligations and filed the subject away until 2027. That was a mistake. Only part of it was postponed, and the part that most affects a small business has not moved: in five weeks the grace period ends.

What has happened

Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, was published in the Official Journal of the EU on 24 July 2026 and came into force on the 27th. It amends the EU AI Act on three key points:

• It postpones the high-risk AI rules. Stand-alone high-risk systems move to 2 December 2027, and those built into regulated products to 2 August 2028.
• It does not postpone transparency. The obligations to tell people when AI is being used have applied since 2 August 2026 and still do.
• It shortens the grace period for AI-generated content. The grace period for marking that content ends on 2 December 2026.

On that same date, 2 December, two new prohibitions also start to apply: AI-generated intimate images made without consent, and AI-generated child sexual abuse material.

What it means for your business

High risk sounds like hospitals, banks and recruitment. Transparency, on the other hand, sounds like your website. That is the trap: almost every business that uses AI is in this second group without knowing it.

In practice, it affects you if:

• You have a chatbot on your website or on WhatsApp. The customer has to know they are talking to a machine.
• You publish AI-generated images, videos or audio in your advertising or on social media. They must be marked as such.
• You use AI to write texts that are published to inform the public on matters of public interest.

We call it the forgotten label: the cheapest obligation to meet and the easiest one to overlook. It does not require audits or engineers. It requires you to know where you use AI and to say so.

Another obligation has applied since February 2025 and is also often forgotten: AI literacy. Businesses that use these tools must make sure their staff know how to use them with sound judgement. In Spain, the supervisor is AESIA, Spain's AI supervisory agency (Agencia Española de Supervisión de la Inteligencia Artificial).

Four everyday examples

A dental clinic with a WhatsApp assistant that books appointments. From the first message, the patient has to know that a person is not replying.

An estate agency that publishes photos of flats furnished with AI. If the living room in the picture does not exist, you have to say so. As well as meeting the rules, it avoids complaints from customers who feel misled.

An online shop that uses synthetic voices in its product videos. The AI-generated voice must be identified as such.

An advisory firm that writes its blog articles with AI. If it publishes AI-generated information of general interest, it has to say so, unless a person has reviewed it and takes editorial responsibility.

In all four cases the cost of compliance is minimal: a line of text, a mark on the image, a notice at the start of the conversation. The cost of not complying, however, includes the Regulation's penalty regime, which has applied since August.

Why you should not relax about high risk

The postponement to December 2027 is not a gift: it is time to prepare. High-risk systems will require technical documentation, logs of how they operate, human oversight and a prior assessment. None of that can be improvised in a quarter. Businesses that use AI to screen CVs, assess employees or decide on credit should start now.

What to do before 2 December

• Make an inventory. A simple list: which AI tools you use, what for and who uses them.
• Mark what goes out. Chatbots, images, videos and voices generated with AI, identified as such.
• Train your team. A practical session and an internal policy on responsible use cover the basics.
• Do not wait until 2027 for the rest. If you use AI to make decisions about people, such as selecting candidates or granting credit, the high-risk rules will arrive. Preparing with a year to spare is much cheaper.

At Grupo Dauro we work on artificial intelligence inside businesses through Dauro IA, and we build it into the companies we set up with transparency included from day one. If you do not know whether your website or your social media comply, message us on WhatsApp and we will review them.