The AI Act got delayed. Three parts of it did not.

If you sell software into the EU, somebody in your building has said the AI Act got postponed. They are right about the expensive half and wrong about the half that was going to affect them.

The Digital Omnibus on AI reached political agreement on 6 May 2026 and was confirmed by the Council on 13 May. It moved the high-risk regime, which is genuinely the costly part, well into the future. It left the transparency rules exactly where they were, and those came into application on 2 August 2026.

What actually moved, and where to

The deferral is real relief for anyone building recruitment scoring, credit decisions, education assessment or the other Annex III categories. Conformity assessment, a risk management system, data governance, logging and demonstrable human oversight is a programme of work, not a checkbox, and having eighteen more months for it matters.

It is also a trap for anyone who now stops reading.

What Article 50 asks for

Three duties, and none of them require you to be doing anything exotic.

A system that interacts directly with a person has to make clear that it is an AI system, unless that is already obvious to a reasonably well-informed person in the circumstances. That is the chatbot on the contact page.

Generated audio, image, video and text has to be marked, in a machine-readable format, as artificially generated or manipulated. That is the marketing image nobody photographed and the product copy nobody wrote. The Omnibus gave this one a four-month grace period, to 2 December 2026, and only for systems that were already on the market before 2 August 2026. A system you ship in October does not get it.

And a deployer publishing a deep fake, or AI-generated text put out to inform the public on a matter of public interest, has to disclose that too.

The ceiling in Article 99 for getting this wrong is up to 15 million euros or 3 percent of worldwide annual turnover, and for an SME the lower of the two rather than the higher. Nobody expects a first enforcement wave aimed at a twelve-person agency. That is not the same as the obligation not existing.

Why a Swiss company is in scope at all

Article 2 does not ask where you are established. It reaches providers and deployers in a third country where the output produced by the AI system is used in the Union.

That sentence is the whole of the Swiss question. A studio in Zurich running a generation pipeline whose output is published on a German client’s website is inside it. So is a Swiss SaaS product with users in Vienna. Having no EU entity does not help, and the client contract does not either: it allocates liability between the two of you, and it does not change which of you the regulation names as the provider or the deployer.

The practical consequence is that “are we in scope” is usually the wrong first question, because for most companies doing any EU work the answer is yes for at least one system. The useful first question is which systems, and there are normally fewer than people fear.

What Switzerland itself requires

Nothing yet, and it is worth being precise about that rather than letting the AI Act stand in for Swiss law.

Switzerland has no AI statute. The Federal Council decided to ratify the Council of Europe’s convention on artificial intelligence and to regulate sectorally rather than horizontally, with the EJPD preparing a consultation draft together with UVEK and the EDA by the end of 2026, aimed at transparency, data protection, non-discrimination and supervision. Alongside it there is a plan for non-binding measures: guidelines, self-regulation, sectoral solutions.

Until that lands, the binding Swiss rule for almost everything a company does with a model is the revised FADP, which is technology neutral and applies to AI-assisted processing exactly as it applies to everything else. We wrote up the obligation people miss most often in the Swiss case for running a model on your own hardware, and it has nothing to do with the AI Act: it is that the provider of a hosted model is your processor and Article 9 wants a contract with them.

So a Swiss company with EU customers is currently answering to two regimes with different logics. The FADP asks who is responsible for the data. The AI Act asks what the system does and who it does it to.

The version of this that fits on one page

Take an afternoon and write down every place a model touches something a customer or the public sees. Chat widgets, generated imagery, generated copy, voice, summarisation shown as fact, anything where a person could reasonably think they were dealing with a human or looking at a photograph.

For each one, three columns: does it need to announce itself, is its output marked, and would you be comfortable if a customer found out how it was made. The third column is not in the regulation and it is the one that predicts the complaint.

That list is the input to every conversation you will have about this over the next two years, including the high-risk one in 2027, and almost nobody has written it down. Doing it properly is a small piece of AI engineering work and it is considerably cheaper than the version where you compile it in response to a letter.