EU AI Act Article 50: what started applying in August 2026, after the Digital Omnibus

The amendment, and its dates

The AI Omnibus, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It is the first substantive amendment to the AI Act, and it left 2 August 2026 standing as the date of general application.

What moved: stand-alone high-risk systems listed in Annex III, such as systems used in employment, education, credit assessment or critical infrastructure, now apply from 2 December 2027 instead of 2 August 2026. High-risk AI embedded in products already regulated under EU product safety law, Annex I, applies from 2 August 2028. Law firm commentary is consistent on one point: the obligations were postponed, not removed, and the classification framework is unchanged.

What else changed: the AI literacy duty in Article 4 was softened from ensuring a sufficient level of literacy to supporting its development, and two new prohibited practices were added, applying from 2 December 2026. A small mid-cap category was created for companies that are not SMEs but have fewer than 750 employees, with simplified documentation and proportionate penalty caps.

Who Article 50 applies to

Article 50 is not a high-risk rule. It attaches to a situation, so an ordinary chatbot or a content generator is in scope while sitting in the lowest risk tier of the Act. Two roles carry the duties, and most companies are the second one without having thought about it: a provider builds or places the system on the market, a deployer uses it in its own work.

Location is not the test. Article 2 covers providers placing a system on the Union market wherever they are established, deployers established in the Union, and providers and deployers in a third country where the output of the system is used in the Union. A US tool with EU customers, and an agency outside the EU publishing generated content for EU readers, are both in scope. Open-source providers and deployers are not exempt, and the only clear carve-out for an individual is Article 2(10), for a natural person using AI in a purely personal, non-professional activity.

The duties track output that reaches people, so an internal draft nobody outside the company sees is a different case from the same text once it is published. Write that line down per system: it is the first thing an authority asks you to justify.

What started applying on 2 August 2026

Article 50 was not delayed. In plain terms it has five parts:

• 50(1), providers. A system that interacts with people must be built so that people are informed they are dealing with AI, at the latest at the first interaction. Guidance treats AI agents as covered, and expects an agent to disclose both that it is artificial and on whose behalf it acts.
• 50(2), providers. Synthetic audio, image, video and text must be marked in a machine-readable way and be detectable as AI-generated. Assistive standard editing that does not substantially change the input is out of scope. Detection has to work for the people likely to meet the content: tools they can reach, results a person can read, marks other providers can verify.
• 50(3), deployers. People exposed to emotion recognition or biometric categorization must be informed. Data protection law still applies on top.
• 50(4), deployers. Deepfakes must be disclosed, and so must AI-generated text published to inform the public on matters of public interest, unless a person or organization took editorial responsibility after a substantive human review.
• 50(5), everyone. Form and timing: the disclosure comes at the latest at the first interaction or first exposure, it is clear and distinguishable, and it meets accessibility requirements. A machine-readable mark is not a disclosure to a person, so marking under 50(2) does not satisfy 50(4). The Commission's guidelines rule out tiny footer text, faint image labels, a label flashed for a moment in a video and anything buried in terms and conditions.

What does not need a mark or a label

The exemptions are narrower than most teams hope and wider than most teams fear. From the Commission's final guidelines on Article 50, these cases do not trigger the marking duty:

• Standard editing: spell-checking, grammar correction, basic translation, formatting changes, noise removal. The test is whether the system substantially alters the input or its meaning.
• Trivial output: single words or interface labels. Also unaltered recordings, the mere reproduction of existing content, and generated source code or configuration files.
• Ephemeral real-time output, such as a video game, where marking is not technically feasible and people are made aware of the artificial origin another way.
• Clearly fantastical content falls outside the definition of a deepfake, and for evidently artistic, creative, satirical or fictional works the duty shrinks to a disclosure that does not interfere with enjoyment of the work.
• Law enforcement uses authorized by law, across 50(1) to 50(4).

The transition dates worth writing on a wall

• 2 December 2026: systems placed on the market before 2 August 2026 that generate synthetic content have until this date to meet the machine-readable marking duty in Article 50(2). The two new prohibitions start the same day.
• 2 February 2027: per published legal analysis of the Commission's guidelines, the deadline for interoperability of watermark detection, so content can be checked without running each provider's own detector.
• Content published before 2 August 2026 does not have to be labeled retroactively. For public-interest text the publication date governs, so text generated earlier but published after the cut-off is generally in scope.
• 2 August 2027: general-purpose AI models placed on the market before 2 August 2025 must comply, and every member state must have an AI regulatory sandbox running.
• 2 December 2027 and 2 August 2028: the new high-risk dates above. High-risk systems already in use by public authorities get until 2 August 2030.

The Code of Practice tells you what good looks like

The Commission published the final Code of Practice on Transparency of AI-generated Content on 10 June 2026 and adopted its final guidelines on Article 50 on 20 July 2026. Around 190 companies and organizations had signed the Code by the end of July 2026. Neither is binding, but signing is presented as the clearest route to showing good-faith compliance, and regulators will read it as the reference point.

The substance, as summarized by law firms that have read it: marking should use at least two machine-readable techniques, for example cryptographically signed metadata plus imperceptible watermarking, because no single technique currently meets the standard on its own, and providers have to stop users stripping the metadata out. One technique is enough for free-form text, which cannot carry metadata, and for generative systems closed inside a physical product. Very short texts, around 200 tokens, are exempt from watermarking, a threshold the Code expects to fall as watermarking improves.

On the deployer side the Commission has finalized three EU icons, for fully AI-generated content, for AI-modified content, and a basic icon with an interactive second layer, plus audible disclaimers where a visual label is impossible, as in audio-only output. If you publish AI-generated text that search engines and AI answers will quote, this is the part of the Code to read twice.

What the fines are, and who collects them

Article 99 sets three tiers, each taking the higher of the two figures. Prohibited practices under Article 5: up to 35 million euros or 7% of total worldwide annual turnover. The Article 50 transparency obligations, with most other provider and deployer duties: up to 15 million euros or 3% of turnover. Misleading an authority: up to 7.5 million euros or 1%. For SMEs, start-ups and, in the lower tiers, small mid-caps, the lower figure applies instead.

Enforcement sits with national market surveillance authorities, with the AI Office for general-purpose AI models and the European Data Protection Supervisor for EU institutions. The AI Office also gained periodic penalty payments of up to 5% of average daily turnover for continuing infringements. Signing the Code of Practice does not prove compliance by itself, but law firms expect it to count when a penalty is set.

What this means in practice

A short self-check, in the order we work through it on client systems. One: list every place where a person meets your AI, including chat widgets, voice bots, email autoresponders and agents acting on your behalf, and check what each one says about itself at first contact. Two: list every place where your systems generate content that leaves the building, and check that marking comes out of the generating pipeline rather than being added by hand later. Three: for anything published on matters of public interest, document who reviews it and what the review involves, because the editorial responsibility exception depends on it being substantive. Four: keep the evidence.

In our own agentic automation work that means agents introduce themselves and name the company they act for, and in content and visibility work it means an expert reviews and signs off what gets published. Both were good practice before August 2026. They are now also the thing a regulator asks about.