The AI Act's human-oversight obligations land August 2 — and the delay everyone is counting on isn't law

What changed

Nothing — and that is the news. As of this briefing’s date, August 2, 2026 remains the application date for the EU AI Act’s high-risk regime (Regulation (EU) 2024/1689): the provider requirements of Articles 9–17 — risk management, data governance, technical documentation, record-keeping, transparency, human oversight (Article 14), accuracy and robustness — the deployer obligations of Article 26, conformity assessment, post-market monitoring, and the market-surveillance and penalty framework that gives all of it teeth.

In November 2025 the European Commission proposed a “Digital Omnibus” package that would postpone the high-risk obligations for Annex III systems to late 2027. That proposal has not been enacted. A postponement that exists as a proposal is not a compliance date; firms planning around it are planning around a rumor with a letterhead.

What Article 14 actually requires, stated plainly: high-risk AI systems must be designed so they can be “effectively overseen by natural persons” — and under Article 26, deployers must assign that oversight to people with the competence, training, and authority to do it, including the effective capacity to intervene in or override the system’s decisions, with explicit attention to automation bias.

What it means for you

Treat August 2 as operative. If the omnibus passes, you gain time; the obligations’ shape doesn’t change. Building the oversight gate now is the no-regret move — waiting converts a design problem into a deadline problem.

“Effectively overseen” is a design requirement, not a staffing line. The meta-analytic evidence is blunt: the average naive human-AI combination underperforms the better of the two alone (Vaccaro, Almaatouq & Malone 2024, 100+ experiments). A person watching a dashboard does not satisfy the regulation’s intent — and after thirty minutes of vigilance decay, barely satisfies its letter. Oversight that survives scrutiny is engineered: independent of the generating system, bounded in workload, trained, and with documented authority to stop the line.

The evidence artifact is the record. When a market-surveillance authority — or your own counsel — asks how oversight operates, the answer is not a policy paragraph; it is a signed, dated record of what was checked, against which standard, by whom, with the intervention trail. That artifact is what WTD’s engagements produce by default; Article 14 is one of the frameworks it crosswalks to on the Proof page.

Deployer duties are yours, not your vendor’s. “The tool is compliant” answers the provider’s obligations, not Article 26. Assigning competent, trained, authorized oversight is the deploying firm’s job — sweep vendor materials that imply otherwise.