The EU AI Act Transparency Rules Are Live. Here Is What Actually Applies.

Article 50 of the EU AI Act took effect on 2 August 2026. The European Commission published guidelines alongside it and began enforcing the new transparency requirements the same day.

The most important detail for anyone already running a product: the obligations apply immediately to all in-scope systems, regardless of when they were placed on the market. There is no grandfathering. A tool that shipped in 2024 is in scope today.

The four things that require disclosure

Direct interaction with a person. If your system talks to someone, a chatbot, a voice assistant, an agent, you disclose that they are dealing with AI, unless it would already be obvious to a reasonably informed person.

AI-generated content. Synthetic audio, image, video, or text must be marked as machine-readable and detectable as artificially generated.

Emotion recognition and biometric categorisation. If you use either, the people subjected to it must be informed.

Deep fakes and AI-generated text on matters of public interest. Both carry labelling duties.

What is not on that list

“There is no grandfathering. A tool that shipped in 2024 is in scope today, and the fixed penalty figure is not proportionate to company size in any way that helps.”

Most of what a small vertical product does. If your system analyses data and shows a human the result, and no part of it pretends to be a person or generates synthetic media, your Article 50 exposure is narrow.

This is worth stating plainly because the volume of commentary has been high and much of it is written for enterprise compliance functions with a very different risk profile. Reading it, a small founder could reasonably conclude they need a programme they do not need.

The penalties are real

There is no grandfathering. A tool that shipped in 2024 is in scope today, and the fixed penalty figure is not proportionate to company size in any way that helps.

Non-compliance can reach €15 million or 3% of worldwide annual turnover, whichever is higher. For a company with no turnover to speak of, the fixed figure is the one that matters, and it is not proportionate to company size in any way that helps.

That asymmetry is the argument for spending an afternoon on this rather than deferring it. The work required for a narrow product is genuinely small. The consequence of having skipped it is not.

The afternoon of work

Write down every place AI appears in your product and what it does. If any of it interacts with a person as though it were a person, add a disclosure. If any of it generates content, label it. Check what your model provider's terms say about how disclosure duties are split between you and them, because providers and deployers can carry distinct obligations for the same feature.

Then keep a record of what the system decided and on what basis. That is useful for customers before it is ever useful for a regulator, and it is the thing that cannot be reconstructed later.

What comes next

The heavier high-risk obligations remain deferred, to 2 December 2027 and 2 August 2028. SME simplifications were extended and the Digital Omnibus targets a meaningful reduction in administrative burden for smaller companies.

So the direction of travel for a small vendor is still toward less burden rather than more. August was the date that mattered this year, and for most narrow products it was a disclosure sentence rather than a project.

I wrote about what to expect from this deadline before it landed. The scope held up, and compliance as a wedge covers turning obligations like these into a way in rather than a cost.