From 2 August 2026, the transparency obligations under Article 50 of the EU AI Act take effect, alongside enforcement powers over general-purpose AI and the full penalty regime. Enforcement expands around transparency, AI literacy, and the existing prohibitions.
The heavier high-risk obligations were pushed back, to 2 December 2027 and 2 August 2028. That deferral is the most commercially relevant fact in the whole regulation for a small vendor, and it is the one most commonly missed.
What is actually landing in August
Step 1
Document where AI appears in your product and what it decides
Step 2
Add plain disclosure wherever a user would not otherwise know
Step 3
Check how your model provider's terms allocate disclosure duties
Step 4
Log what the system decided and on what basis, for customers first
Transparency, principally. If your product uses AI in ways a user would not obviously infer, you disclose it. If it generates or manipulates content, that content is labelled. If it interacts with people as though it were a person, they are told otherwise.
There is also an AI literacy obligation, reformulated to be less onerous than originally drafted, and the penalty regime becomes fully operative, which is what changes the risk calculation from theoretical to real.
Duties depend on your role, not your size
The Act does not require the same compliance programme from every company. Duties depend on role, purpose, and risk. Providers and deployers can each carry distinct transparency obligations in relation to the same AI-enabled product.
That last point matters for anyone building on top of a model API. You may be a deployer with respect to the underlying model and a provider with respect to your own product. Those are different sets of duties, and they are allocated between you and your vendor by contract. Reviewing what your model provider's terms actually say about disclosure responsibility is a genuinely useful afternoon.
“The regulatory direction for small vendors is toward less burden, not more. That runs against the tone of most commentary, which is written for enterprise compliance functions.”
The SME position is better than the discourse suggests
SME simplifications were extended, including to small mid-caps, and the European Commission proposed the Digital Omnibus on AI with a goal of reducing administrative burden by at least 25% overall and 35% for SMEs.
The regulatory direction for small vendors is toward less burden, not more. That runs against the prevailing tone of most commentary, which is written by and for enterprise compliance functions with a different risk profile and a commercial interest in the complexity.
The regulatory direction for small vendors is toward less burden, not more.
What a small vendor should actually do
Turn what you know into what you own.
Vibepreneur builds structured ventures from professional expertise, with positioning, launch assets, and growth systems included.
Join the WaitlistWrite down where AI appears in your product and what it decides. This document is useful regardless of regulation and takes a morning.
Add clear disclosure where a user would otherwise not know. This is usually a sentence, not a project.
Check your model provider's terms for how disclosure and labelling responsibilities are allocated, and whether you have inherited an obligation you did not know about.
Keep a log of what your system decided and on what basis. You will want this for your customers before you want it for a regulator.
What not to do
Do not commission a compliance programme scaled for high-risk systems if you are not building one. The high-risk obligations do not bite until December 2027 at the earliest, and the classification is narrower than most vendors assume.
Do not treat this as a reason to delay building. The most common effect of regulatory uncertainty on small companies is paralysis, and paralysis is more expensive than compliance in almost every case here.
The next post covers why compliance is better treated as a wedge than a cost.