The headlines this summer were about relief. In late June the EU institutions signed off on the Digital Omnibus, the package that pushed the AI Act’s most feared provisions, the high-risk obligations under Annex III, out to December 2027 for standalone systems and August 2028 for AI embedded in regulated products. The trade press read it as a reprieve. Compliance teams that had spent a year building conformity assessments exhaled.
They were watching the wrong clause.
The Omnibus did not touch Article 50. Its transparency obligations take effect on 2 August 2026, this Sunday, and they bind a far wider population than the high-risk regime ever would. If your product talks to a person, generates an image, writes a public-facing paragraph, or reads a face, the deadline that matters arrived while everyone was reading about the one that slipped.
What actually comes due
Article 50 is short and blunt. It imposes four duties, split between the companies that build AI systems and the ones that deploy them.
Providers of systems that interact directly with people, meaning chatbots, virtual assistants and support agents, must tell the user they are dealing with a machine at the start of the interaction. No buried disclosure, no dark pattern. Providers of generative systems, the models producing text, images, audio and video, must mark their outputs in a machine-readable format so downstream tools can detect that the content is synthetic.
The other two duties land on deployers. Anyone running emotion-recognition or biometric-categorisation systems must notify the people exposed to them. And anyone publishing a deepfake, or AI-generated text on a matter of public interest, must label it as artificial, unless a human editor has taken responsibility for the content.
None of this requires a conformity assessment, a notified body, or the machinery that makes the high-risk regime so heavy. That is precisely why it was easy to overlook. Transparency is cheap to state and awkward to implement at scale, and it applies now.
The one carve-out, and why it proves the point
There is a single concession, and it is narrow enough to confirm the rule. The machine-readable marking duty in Article 50(2), the provenance requirement for generative outputs, has been pushed to 2 December 2026 for systems already on the market before this Sunday. New systems get no such grace. Everything else in Article 50 is live on 2 August.
That is the entire scope of the relief. Brussels deferred the expensive high-risk regime by more than a year and gave the transparency rules a four-month technical extension on one sub-clause. The gap between those two decisions is the story. The obligations that touch the most products got the least relief.
Who is in scope, wherever they sit
The reach is extraterritorial, and this is where US and UK teams tend to get it wrong. Article 50 binds any provider or deployer placing an AI system on the EU market, regardless of where the company is established. A San Francisco startup with European users is in scope. So is a London deployer, Brexit notwithstanding, once its output reaches EU users.
Enforcement carries teeth to match. Breaching Article 50 exposes a company to fines of up to EUR 15 million or 3 percent of worldwide annual turnover, whichever is higher. That is the lower of the Act’s two headline tiers, below the EUR 35 million reserved for prohibited practices, but it is calculated on global revenue, not EU revenue. For a large model provider, 3 percent of worldwide turnover is not a rounding error.
The Code of Practice, and the burden it shifts
The Commission did not leave companies to guess. On 20 July it approved the AI Office’s guidelines on Article 50, now the primary reference national regulators will use to interpret the text. Alongside them sits a voluntary Code of Practice on the transparency of AI-generated content, whose signatory window closed on 22 July.
Signing matters more than it looks. Adherence to the Code is treated as evidence of compliance, which in practice shifts the evidentiary burden: a signatory that follows the Code can point to it when a regulator asks, rather than defending a bespoke approach from scratch. Google confirmed it would sign. Firms that declined keep full flexibility and full exposure.
The technical standard underneath all this is still settling. The primary text points to machine-readable marking, watermarking and metadata, and to EU standardisation work still in progress, rather than mandating a single format. Providers building provenance today are aiming at a target that will harden later, which is its own reason to sign the Code rather than improvise.
What to do before Sunday
The practical checklist is short, which is the trap. Confirm every user-facing AI surface announces itself. Confirm generative outputs carry machine-readable provenance, or that you qualify for the December extension on the specific systems that predate Sunday. Confirm deepfake and public-interest text is labeled. Confirm biometric and emotion systems notify the people they read.
The Annex III deferral bought high-risk teams eighteen months. It bought the transparency deadline nothing. The rule that binds the most products in Europe is the one nobody deferred, and it is the one that lands first.
Discussion
Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.