The EU AI Act reaches your product through what customers see and are told. Article 50 transparency duties have applied since 2 August 2026. The high-risk rules were pushed back to 2 December 2027 for Annex III systems and 2 August 2028 for AI built into regulated products. The provider duty to mark AI-generated content starts on 2 December 2026.
In this article we explain who is covered, what the 2026 Omnibus changed, what each Article 50 duty means in practice, what the fines look like, and what each team should check. It ends with a checklist you can run once per product.
This is general information, not legal advice. We checked the dates against published sources on 3 November 2026. Confirm them against the official texts, and with counsel, before you rely on them.
Key takeaways
- The Act applies to companies that use AI under their own name, not only to companies that build models.
- Transparency duties under Article 50 are not delayed. High-risk duties are, to December 2027 and August 2028.
- Disclosure has to reach a person clearly, at the latest at first interaction or exposure. A line in the terms does not do that.
- Provider marking of AI-generated content moves to 2 December 2026.
- Fines for breaching transparency duties reach €15 million or 3% of worldwide annual turnover. For SMEs, the lower of the two amounts applies.
- The Omnibus moved dates. It did not remove the Act, so a plan paused in spring is now behind.
Who has to comply with the EU AI Act?
The Act sorts organisations by role. A provider develops an AI system, or has one developed, and puts it on the market under its own name. A deployer uses a system under its own authority. Importers and distributors have their own duties. Building a product on someone else’s model can still make you the provider of that product, and changes to a system can shift your role.
So if you run an AI chat on your website, publish generated images, or send automated decisions to customers, you carry duties even though you wrote none of the model. Record your reasoning for each system and ask counsel when the answer has real consequences.
What changed in 2026?
- The AI Act, Regulation (EU) 2024/1689, applies in stages. The ban on prohibited practices has applied since 2 February 2025.
- The Digital Omnibus on AI was adopted in mid-2026: Parliament on 16 June, the Council on 29 June. Law-firm reports say it was published on 24 July and entered into force on 27 July 2026.
- High-risk obligations for Annex III systems (such as some employment and education uses) moved to 2 December 2027. AI embedded in regulated products (Annex I) moved to 2 August 2028, per Gibson Dunn’s summary of the agreed text.
- The Commission published final, non-binding Article 50 guidelines on 20 July 2026.
What does Article 50 require in practice?
Article 50 sets four transparency duties. Two of them fall on product and marketing teams every day.
| Duty | Who it falls on | What it means for your product |
|---|---|---|
| Tell people they are dealing with AI (Art. 50(1)) | Providers | Chat, voice and agent features must make clear that the user is talking to an AI, unless that is obvious to a reasonably well-informed person. |
| Mark synthetic content (Art. 50(2)) | Providers | AI-generated audio, image, video and text must be marked in a machine-readable way. Postponed to 2 December 2026. |
| Inform about emotion recognition or biometric categorisation (Art. 50(3)) | Deployers | Tell the people exposed to such a system that it is in use. |
| Disclose deepfakes and certain AI-written text (Art. 50(4)) | Deployers | Label AI-generated or manipulated media that looks real, and AI text published to inform the public on matters of public interest. |
What counts as a clear disclosure, and what does not?
Article 50 asks for information that is clear and distinguishable, given at the latest at the first interaction or exposure. The Commission reads the “obvious” exception narrowly. The table below turns that into practical review questions. These are our recommendations, not legal tests.
| Where it appears | Likely to fall short | Safer approach |
|---|---|---|
| Support chat | A note about AI use in the help centre only | A visible line in the chat itself: you are talking to an AI assistant, working on behalf of the company |
| Campaign image with a generated face | A label that exists only in the CMS caption | A label on or beside the image, decided before export, that survives sharing |
| Advice or news post written with AI | “Generated with AI” in the page footer | A line under the headline, before the first paragraph |
| Marketing video with a synthetic voice | A disclosure in the description only | An on-screen or spoken disclosure at the start of the video |
| Automated decision screen | “Your application was unsuccessful” | The reason, the role the AI played, and a way to ask for human review |
Three patterns to avoid: a hover or tooltip that needs interaction, a one-time popup that people dismiss, and wording so vague that it does not say AI is involved.
What are the fines for getting it wrong?
Article 99 of the Act sets three tiers, each capped at a fixed amount or a share of worldwide annual turnover:
- Prohibited practices (Article 5): up to €35 million or 7%.
- Other obligations, including Article 50 transparency: up to €15 million or 3%.
- Incorrect or misleading information given to authorities: up to €7.5 million or 1%.
For large companies the higher figure applies. For SMEs, including start-ups, the lower figure applies. Fines are a ceiling, not a price list, but they show where regulators expect effort.
Which AI systems do we actually have?
Start with an inventory. Write down, for each system, its purpose, owner, users, provider, model, data, countries and the people it affects. Include AI features inside tools you buy, and experiments that reach real users. For each one, ask four questions: Is the use prohibited? Is it on the high-risk list? Does it trigger transparency duties? Does it use a general-purpose AI model?
Do not infer risk from how powerful a model is. A simple model used in hiring can raise more concerns than a powerful one that drafts internal notes.
What should each team review?
| Role | What they own | First question to answer |
|---|---|---|
| Business owner | Budget, timeline and sign-off on residual risk | Which of our products are in scope, and who is accountable if one fails review? |
| Legal | Scope, exemptions and evidence | Are we a provider, a deployer or both, for each system? |
| Product and design | Placement, contrast, timing, override controls | Does the disclosure hold up on every theme, screen size and export path? |
| Marketing and brand | Campaign assets and published text | Which published assets are AI-generated or manipulated, and are they labelled? |
How do we build human oversight and keep evidence?
Name who can review, who can override and what evidence they see. Oversight is nominal when the reviewer cannot understand the output or change the result. Our guide to human-in-the-loop automation shows where to place review in a workflow, and privacy by design for software projects covers the data side.
Keep the records an investigator would ask for: what the system is for, where inputs come from, what it cannot do, who reviewed what, and when. Keep personal data in those records to the minimum.
The EU AI Act checklist for SMEs
Work through this once per product, then once per campaign.
- Scope: we have a written list of every AI system and every place AI meets a customer, with a named owner for keeping it current.
- Role: we know whether we are provider, deployer or both for each system, and we recorded why.
- Disclosure: every chat, voice or agent feature says it is AI before the first exchange, without a hover, click or popup.
- Content: generated or manipulated images, audio and video carry a visible label that survives download and resharing.
- Decisions: every automated decision that affects a customer shows a plain-language reason and a route to a human.
- Oversight: reviewers can understand, override and stop the system, and we keep a record of what they did.
- Register: we track obligations and dates, and we recheck them when the product or the law changes.
Frequently asked questions
Does the AI Act apply only to companies that build models?
No. Deployers, importers and distributors have duties too, and a company that builds a product on a third-party model can be a provider.
Are all AI systems high-risk?
No. High-risk systems are those in listed categories or built into regulated products. Many systems fall into lighter categories, and some uses are prohibited outright.
Did the Omnibus postpone everything?
No. It moved the high-risk dates and the provider marking duty in Article 50(2). The other Article 50 duties applied from 2 August 2026.
Is compliance a one-time assessment?
No. Your purpose, data, model and the law all change, so the register and the evidence need regular review.
Sources
- Regulation (EU) 2024/1689 on EUR-Lex
- Garrigues: AI Omnibus published, deadlines redefined
- Gibson Dunn: AI Omnibus agreement, postponed high-risk deadlines
- Stephenson Harwood: Commission adopts Article 50 guidelines
- iubenda: Parliament adopts the AI Omnibus
Need help mapping your product?
If your product uses AI and you want an inventory and an evidence trail, our AI integration and security and compliance teams can help.