For two years, 2 August 2026 was the date the EU AI Act was supposed to become real: the day chatbots had to say they were chatbots, AI-generated media had to carry a mark, and the sweeping "high-risk" obligations for AI in hiring, credit, education and policing kicked in. Half of that happened on Sunday. The transparency rules in Article 50 are now in force across the EU. The high-risk rules were pushed back to December 2027 by a last-minute amendment that entered into force six days before the deadline. Our thesis is that Brussels got the order right and the delay wrong: labeling is the part of the Act the public will actually feel, and it arrived on time, while the deferral of the high-risk regime buys industry time it had already been given.
The date everyone circled, and what survived it
The AI Act, Regulation (EU) 2024/1689, was built as a staircase. Prohibited practices applied from February 2025, general-purpose model rules from August 2025, and the bulk of the Act, including the transparency obligations and the high-risk regime, from 2 August 2026. That third step was the one companies planned around.
What actually applied on Sunday:
- Article 50 transparency obligations, in full, for AI systems that interact with people, generate synthetic content, recognize emotions or produce deepfakes and public-interest text. The Commission's guidelines page states plainly that Article 50 applies from 2 August 2026.
- Member-state governance: national authorities, penalties and the Commission's enforcement powers.
What did not apply: the standalone high-risk obligations in Annex III, which the Digital Omnibus on AI moved to 2 December 2027, and the rules for AI embedded in regulated products such as machinery and medical devices, which moved to 2 August 2028. We cover the mechanics below.
What is live now: Article 50 transparency rules
Article 50 is short by the Act's standards, but it reaches almost every AI product a European consumer touches. The practical guide at artificialintelligenceact.eu breaks it into four duties.
Scroll sideways to see the full table →
| Paragraph | Who | Obligation |
|---|---|---|
| 50(1) | Providers | Chatbots and assistants must be designed so people know they are talking to an AI, unless it is obvious to a reasonably informed person |
| 50(2) | Providers | Generative systems must mark audio, image, video and text output in a machine-readable, detectable way |
| 50(3) | Deployers | People exposed to emotion recognition or biometric categorization must be told |
| 50(4) | Deployers | Deepfakes must be disclosed; AI-generated text published to inform the public on matters of public interest must be disclosed unless a human has reviewed it and taken editorial responsibility |
Two things soften the edges. Assistive tools such as grammar correction are outside 50(2), and artistic or satirical deepfakes get a lighter disclosure duty under 50(4). Law-enforcement uses have their own carve-outs.
The penalties are real. Breaching the transparency obligations can draw fines of up to EUR 15 million or 3 percent of worldwide annual turnover, whichever is higher, according to Stibbe's analysis. That is the Act's middle tier, below the ceiling for prohibited practices but well above a nuisance.
There is also a grace period that matters for the products you already use. Generative systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking requirement, and interoperability requirements for watermark detection run to 2 February 2027, as the Paul, Weiss memo on the final guidelines notes. So the labels will phase in over the autumn rather than switch on overnight.
AI labels you will start seeing: chatbots, deepfakes, generated media
The Commission finalized its Article 50 guidelines on 20 July 2026, and they answer the question most people have: what will this look like? Three changes should become visible.
Chatbots announce themselves. Customer-service bots, in-app assistants and voice agents must make clear at first contact that you are dealing with AI. The guidelines say the notice has to be perceivable in practice; a line buried in the terms of service does not count, and for audio formats such as podcasts or long videos a single notice at the start may not be enough.
Generated images, audio and video carry an invisible mark. Under 50(2) the mark is machine-readable rather than a visible badge, and the Commission has not blessed any single technique. The guidelines instead describe a layered approach combining signed, tamper-evident metadata with imperceptible watermarking. In practice this is why the major image and video generators have been adding provenance metadata over the past year. You will not see the mark; platforms and verification tools will.
Deepfakes and AI news copy get a visible disclosure. This is the deployer duty under 50(4), and it is the one that touches publishers, marketers and anyone posting synthetic media of real people. AI-written articles on public-interest topics need a label unless a person has reviewed them and taken editorial responsibility, which is the route most newsrooms will take.
One relief for everyone with an archive: content generated or published before 2 August 2026 does not need to be labeled retroactively.
For providers, the Code of Practice on Transparency of AI-Generated Content is the on-ramp. Its first draft appeared on 17 December 2025, the Commission and the AI Board gave it a positive adequacy assessment in July, and roughly 190 organizations had signed by 31 July. Sign the code and you have a presumption of compliance; decline it and you must show equivalent measures yourself.
The Digital Omnibus: how the high-risk deadline moved to 2027
The high-risk regime is the heavy machinery of the Act: risk management, data governance, technical documentation, human oversight, conformity assessment and registration for AI used in the areas listed in Annex III, such as recruitment, credit scoring, education, essential services, migration and law enforcement. It was due on 2 August 2026 alongside Article 50.
It is not. The Digital Omnibus on AI, proposed by the Commission on 19 November 2025, rewrote the timetable, and the legislative sprint to get it adopted before the deadline was remarkable by EU standards:
- 16 June 2026: The European Parliament adopted the text by 423 votes to 57 with 174 abstentions, as Secure Privacy's timeline records.
- 29 June 2026: The Council gave its final approval.
- 24 July 2026: Publication in the Official Journal as Regulation (EU) 2026/1744.
- 27 July 2026: Entry into force, six days before the original high-risk deadline.
The new dates are 2 December 2027 for standalone Annex III systems and 2 August 2028 for AI that is a safety component of a product already covered by EU product law. The Omnibus also links those dates to the availability of harmonized standards and guidance, which was the industry's central complaint: it is hard to conform to a standard that does not yet exist.
Why the delay happened and who lobbied for it
The official rationale is simplification. The Commission's Omnibus package covered AI, data and cybersecurity rules together, and the pitch was that the high-risk obligations could not sensibly apply before the standards bodies had finished the technical standards companies would use to comply.
The unofficial rationale is pressure. The proposal followed a year of lobbying by large technology companies and open criticism of the Act from Washington. Euronews reported in November 2025 that the Commission itself blamed slow implementation by member states and companies' need for time to adapt, while the tech industry group CCIA, whose members include Amazon, Apple and Google, welcomed the proposed delay and asked for bolder and clearer steps. Several member states, worried about European competitiveness, backed a "stop the clock" approach that the Commission had resisted earlier in 2025.
Civil-society groups and some MEPs argued the opposite: that the standards delay was partly self-inflicted, that the affected sectors had known their obligations since 2024, and that pausing the high-risk rules while keeping the rest of the Act would leave the most consequential uses of AI, in hiring and credit and policing, the least regulated for another 16 months. The vote count in Parliament, with 174 abstentions, reflects how uneasy that compromise was.
General-purpose model providers: the Code of Practice route
The rules for general-purpose AI models, the layer beneath ChatGPT, Claude and Gemini, are unaffected by the Omnibus and have applied since August 2025. What changed this summer is enforcement: from 2 August 2026 the Commission's AI Office can use its full powers against GPAI providers, including fines.
For those providers the path is the same one Article 50 now uses: a voluntary Code of Practice. As artificialintelligenceact.eu explains, signing the GPAI Code of Practice is a way to demonstrate compliance until harmonized standards exist; providers who do not sign must show alternative adequate means. The major US and European labs signed the GPAI code last year, with one notable holdout, and the transparency code has now followed the same pattern. The practical effect is that the Act is, for now, enforced largely through codes the industry helped draft, with the formal standards still in the pipeline.
Our view: transparency first was the right call, the delay was not
The sequencing that survived the Omnibus is defensible. Article 50 is cheap to comply with, technically mature (provenance metadata and watermarking already exist), and addresses the harms ordinary people encounter: a synthetic voice on the phone, a fabricated video of a politician, an article that reads like news and was never checked. Making those visible on schedule is the part of the Act that will change daily life in Europe, and it happened.
The high-risk delay is harder to defend. The obligations in Annex III are not new; they were the reason the Act existed, and the companies subject to them are mostly not startups but banks, insurers, recruiters and public bodies with compliance departments. The standards gap is real, but the Act already contained a mechanism for it: the Commission can adopt common specifications when standards are missing. Choosing a 16-month deferral instead sends a message that deadlines in EU tech law are negotiable if the lobbying is loud enough, and it lands right as AI-driven hiring and credit decisions are spreading fastest.
The counter-argument deserves weight. A rule that cannot be complied with is a rule that gets ignored, and enforcing Annex III against firms with no standard to follow would have produced litigation rather than safer systems. There is also a fairness point: European firms would have borne the burden first, while foreign competitors waited to see what enforcement looked like. Those are real costs. They are, in our view, smaller than the cost of teaching the market that the hard parts of the Act can be postponed. The labels are the right first step. The deferral is a precedent Europe may regret.
What to do if you build or use AI in Europe
If you run a chatbot or assistant for EU users: make the AI disclosure visible at first contact, in the interface, not the terms. Audit any voice or audio channel for repeated disclosure. Check whether your model provider has signed the transparency code and what marking it applies to outputs you pass through.
If you generate images, audio or video: confirm that your pipeline preserves provenance metadata and watermarks rather than stripping them on export. If you built the system before 2 August, your marking deadline is 2 December 2026.
If you publish AI-assisted text on public-interest topics: decide now whether you label it or route it through human editorial review with a named responsible person. Either is compliant; doing neither is not.
If you deploy AI in hiring, credit, education or public services: the Annex III deadline is 2 December 2027, not never. Use the extra time to build the documentation and oversight the rules require, because the standards they will reference are being finalized during the deferral, and the deferral does not repeat.
If you are a consumer: expect more "you are chatting with an AI" notices and more labels on synthetic media this autumn, and expect them to be uneven at first. Where a label is missing on something that clearly should carry one, national market-surveillance authorities are now the place to complain. For the mechanics of how these assistants actually reach your data, see our explainer on AI agents and MCP; for the assistants themselves, our comparison of ChatGPT Plus, Claude Pro and Google AI Pro covers what each offers EU users.
Sources and further reading
- Guidelines on transparency obligations for providers and deployers of certain AI systems (European Commission)digital-strategy.ec.europa.eu
- The EU AI Act's Transparency Rules: A Practical Guide to Article 50 (artificialintelligenceact.eu)artificialintelligenceact.eu
- EU Finalises Transparency Rules for AI-Generated Content (Paul, Weiss)paulweiss.com
- The AI Act's Transparency Obligations: Rules, Scope and Timeline (Stibbe)stibbe.com
- Artificial intelligence: Council gives final green light to simplify and streamline rules (Council of the EU)consilium.europa.eu
- Regulation (EU) 2026/1744 (EUR-Lex)eur-lex.europa.eu
- EU AI Act Digital Omnibus: The New High-Risk AI Deadlines After Council Approval (Secure Privacy)secureprivacy.ai
- European Commission delays full implementation of AI Act to 2027 (Euronews)euronews.com
- An Introduction to the Code of Practice for General-Purpose AI (artificialintelligenceact.eu)artificialintelligenceact.eu