What Actually Turned On

Article 50 does not care whether your system is high-risk. It applies based on what the system does with people, and there are four buckets.

If your AI talks directly to a person, that person has to be told they are dealing with a machine. Chatbots, virtual assistants, voice agents, anything conversational. The exception is where it would be obvious to a reasonably observant user, which is a narrower carve-out than most product teams assume.

If your AI generates or meaningfully alters audio, images, video, or text, the output has to carry machine-readable marking so it can be detected downstream. Systems already on the market before August 2 got a short extension to December 2, 2026 for the marking piece. New ones did not.

If you deploy something that produces deepfakes of real people, places, or events, you have to disclose it.

And if you run emotion recognition or biometric categorization, the people being scanned have to be informed, and the underlying personal data must be handled in accordance with EU data protection law.

Penalties run up to €15 million or 3% of worldwide annual turnover, whichever is larger. The Commission adopted its guidelines on these obligations on July 20 and published a first list of more than 180 organizations that have signed the Code of Practice on transparency of AI-generated content, which is the practical route to showing you complied.

Why This Reaches Companies With No European Office

The reflex on this side of the Atlantic is to file EU regulation under “someone else’s problem.” Article 2 makes that hard to sustain. The Act reaches providers who place AI systems on the EU market and, separately, providers and deployers whose AI output gets used in the EU, no matter where the company sits or where the system is hosted.

There is no revenue floor and no requirement to have a European entity. A support chatbot on a website that European customers can reach, a marketing tool generating images for a campaign that runs in Germany, a screening assistant reviewing candidates who happen to live in Ireland. Output used in the EU is the test, and most companies have never mapped their systems against it.

The Question Most Companies Cannot Answer Today

Article 50 compliance is not a heavy technical lift. Adding a disclosure line to a chatbot is a small ticket. Turning on content provenance marking in most modern generation tools is a settings change.

The hard part is knowing what you have. Ask your team for a list of every system in the company that either talks to a person or produces content, including the ones that came bundled inside a platform you bought for something else. Marketing automation with a generative writing assistant. A service desk tool that quietly added a customer-facing AI agent in a release last quarter. An HR platform that now summarizes interview notes. Most of these arrived through a vendor update, not a procurement decision, and nobody logged them.

That inventory gap is the actual exposure. A readiness analysis published this spring by Vision Compliance found 78% of organizations had not taken meaningful steps toward AI Act compliance, and 74% had no designated internal owner for it. Vendor research deserves the usual grain of salt, but the direction matches what we see in the field. When there is no owner, there is no inventory, and when there is no inventory, you cannot answer a regulator’s first question, which will not be “are you compliant.” It will be “which of your systems are in scope.”

One Change Worth Reading Carefully

The Omnibus also softened Article 4. The obligation on providers and deployers used to be to ensure a sufficient level of AI literacy among staff. Now it is to take measures to support the development of AI literacy for staff and others operating AI on their behalf.

That is a real reduction in legal exposure, and it will get read by some finance teams as permission to cut the training line. We would push back on that read.

The people most likely to put an undisclosed chatbot in front of a European customer, or push generated content out without provenance marking, are the people who do not know the rule exists. Every Article 50 obligation is ultimately enforced by an employee deciding at their desk. Softer training language does not change who is holding the risk when that decision goes wrong. It just means the regulator will fine you for the gap you produced.

Where We Come In

The extended high-risk timeline is a gift, and the way to waste it is to treat December 2027 as the date work starts. The inventory you need for Article 50 right now (what systems you have, what they do, who owns them, which ones touch a person) is the same inventory that high-risk classification will demand next year. Building it once serves both.

Our AI readiness assessments and governance questionnaires are built around exactly that question: not whether you have a policy, but whether you can produce a defensible list of what you are running and who is accountable for each item. If you want a scoped review of your Article 50 exposure, or a broader look at where your AI governance program stands before someone else looks for you, reach out, and we will help you find the right starting point.

Sources: Commission starts enforcing AI Act rules and new transparency requirements on 2 August — European Commission; Not Delayed, Not Deferred: EU AI Act Transparency Obligations Are Now in Force — Goodwin; Regulation (EU) 2026/1744 (AI Omnibus) — EUR-Lex; EU AI Act: Transparency Obligations Take Effect 2 August 2026 — Cooley; Guidelines on transparency obligations for providers and deployers of AI systems — European Commission; EU begins enforcing AI Act, putting AI models under the microscope — Help Net Security; 2026 EU AI Act Readiness Report — Vision Compliance