The AI Act changed in July: what binds your firm today and what was postponed

On 24 July 2026 the Official Journal of the EU published Regulation (EU) 2026/1744, the so-called Digital Omnibus on AI, which amends the AI Act, Regulation (EU) 2024/1689. It entered into force on 27 July, six days before the bulk of the AI Act was due to start applying. Much of what was written in the spring about “what kicks in this August” went out of date that week.

The quick reading doing the rounds in law firms is “everything has been pushed to 2027”. It is wrong, and it is the dangerous reading. What was postponed is precisely what rarely touched a law firm. What does touch it stayed where it was.

What was postponed

The Omnibus moves the dates for the high-risk obligations (Sections 1 to 3 of Chapter III), under the new Article 113:

• Annex III high-risk systems (classified by use: employment, credit, education, justice and so on): from 2 August 2026 to 2 December 2027.
• Annex I high-risk systems (AI built into regulated products: machinery, medical devices…): to 2 August 2028.

In addition, providers of generative AI systems already on the market before 2 August 2026 have until 2 December 2026 to comply with Article 50(2), that is, the machine-readable marking of generated content (new Article 111(4)). Note the scope: that transitional period is for providers and for 50(2) marking. It does not postpone the user-side duties in Article 50(4).

What did not move

• Prohibited practices (Article 5): applicable since 2 February 2025. The Omnibus adds two new prohibitions — AI-generated non-consensual intimate imagery and child sexual abuse material — applying from 2 December 2026.
• AI literacy (Article 4): applicable since 2 February 2025, with new wording (below).
• General-purpose AI models: their providers’ obligations have applied since 2 August 2025.
• Penalties (Chapter XII): applicable since 2 August 2025. Breaching the transparency obligations can cost up to €15 million or 3% of worldwide turnover; for SMEs, whichever is lower.
• Transparency (Article 50): applicable since 2 August 2026, which remains the AI Act’s general date of application.

Why a law firm is rarely “high-risk”

A firm using an AI tool is, in the Regulation’s terms, a deployer: it uses the system under its authority in a professional activity. Its heavy obligations (Article 26) only exist if the system is high-risk.

Point 8 of Annex III, the justice item, covers systems intended to be used by a judicial authority or on its behalf to research and interpret facts and law and apply the law to a concrete case, or in a similar way in alternative dispute resolution. An assistant that helps a lawyer draft a claim, summarise a file or find case law is not on that list. Two exceptions deserve a closer look. First, where the firm acts as arbitrator or mediator and uses AI to decide. Second, less obviously: if it uses AI to hire — filtering CVs, assessing candidates — that is high-risk (Annex III, point 4), and from 2 December 2027 it will carry deployer obligations.

What binds you today: AI literacy (Article 4)

The original wording required providers and deployers to ensure, “to their best extent”, a sufficient level of AI literacy among their staff. The Omnibus replaces it: they must now take measures to support the development of AI literacy of their staff, and the text clarifies that this does not require guaranteeing any specific level for any individual.

It is a softer duty, but still a duty, and in a law firm its content is obvious. Anyone using AI on client files must know at least that the model can invent judgments, which data must not go into tools without a data processing agreement, and that responsibility for the filing is theirs. Reasonable measures fit on one page: an internal use policy, a training session on joining and another when the tool changes, and a record of both. We covered telling useful tools from marketing in AI in the law firm: what works and what is hype.

What binds you today: transparency (Article 50(4))

Since 2 August, deployers have two disclosure duties:

1. Deepfakes. If you generate or manipulate image, audio or video that resembles real people, places or events and could pass as authentic, you must disclose that it is artificial.
2. Public-interest text. If you publish AI-generated or manipulated text “with the purpose of informing the public on matters of public interest”, you must say so — unless the text has undergone human review or editorial control and a natural or legal person holds editorial responsibility.

The Commission’s guidelines on Article 50, published on 20 July, read “public interest” broadly — justice is expressly included — and require human review to be substantive, not a glance. For a law firm, this reaches the blog, the newsletter on legislative changes and opinion pieces signed by partners. Court filings, client advice and correspondence are not published to inform the public, and fall outside.

Article 50(1) — telling people they are talking to an AI — is the system provider’s obligation, not the firm’s. But if you put a chatbot on your website, the client will blame you, not the vendor: check that the notice appears at the first interaction.

An example: four uses, four answers

An eight-lawyer firm in Valencia takes stock in September:

• Monthly newsletter on legal reforms, drafted with an AI assistant. Public interest, yes. But a partner reviews and rewrites it and signs it. It falls within the 50(4) exception, provided the review is real and there is a record of who did it. If an issue ever goes out unreviewed, it needs a label.
• A 90-second video with a synthetic avatar of the managing partner explaining a procedural reform. It is a deepfake even though the partner approved the script: visible notice that it is AI-generated.
• Website chat for booking appointments, from an outside vendor. The vendor’s obligation since 2 August; the firm checks the notice is there.
• Screening 140 CVs with AI to hire a junior lawyer. High-risk (Annex III, point 4). The Article 26 obligations do not apply yet — they arrive on 2 December 2027 — and the firm decides to shortlist by hand rather than build a process it would have to rebuild in fifteen months.

Total cost of compliance: a one-page policy, one training session and a label on one video.

Spain: the organic law is still in Congress

On 26 May the Spanish government approved the draft Organic Law on the good use and governance of artificial intelligence, published in the parliamentary gazette on 12 June and now before the Economy, Trade and Digital Transformation Committee of the Congress. It is not law. When it is, it will set Spain’s penalty regime and allocate supervision: AESIA as the central authority, with specific powers for other bodies, including the General Council of the Judiciary (CGPJ) for systems affecting the administration of justice. Meanwhile, the EU Regulation’s obligations apply directly.

What to ask your vendor

Four questions, with written answers:

1. Which general-purpose AI model sits underneath, where is the data processed, and is there a GDPR Article 28 processing agreement? It is the same question as in our piece on GDPR for law firms.
2. If the tool generates text, images or audio, does it already comply with Article 50(2) marking, or is it relying on the 2 December 2026 deadline?
3. Does any feature fall under Annex III? If the answer is “we don’t know”, that is a bad sign.
4. What material do you provide to train the team? It helps document Article 4.

This article’s view: the Omnibus gave law firms time on what never concerned them, and none on what does. Anyone who read “postponed” and filed the matter away is now without a use policy and with an unreviewed newsletter.

Where Mandato fits

AI inside the Mandato case file works as proposals: it summarises, drafts and extracts deadlines, and the lawyer reviews and decides before anything leaves the firm. That design fits the human review the Regulation rewards, but it does not replace the internal policy or the training, which belong to the firm. The wider tool landscape is in AI for lawyers in 2026, and the text of Regulation 2026/1744 is on EUR-Lex.