Article 50 is in force. Here is what your chatbot must do.

If you run a customer-facing chatbot, you probably read this summer that the EU AI Act had been pushed back. You are half right. The half you have wrong is the half that already applies to you.

The Digital Omnibus on AI did defer a great deal. It did not defer Article 50. Those transparency obligations took effect on 2 August 2026, and the disclosure duty for systems that talk to people arrived with no grace period at all.

What moved in July, and what did not

Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, amending the AI Act itself. It is a simplification package, not a repeal. The risk tiers, the prohibited practices and the general-purpose AI rules all survive.

That table is the whole story. The deferral was real and substantial, and it landed on the obligations that are expensive and slow: conformity assessment, registration, risk management systems. Transparency was left where it was, because telling someone they are talking to a machine is neither expensive nor slow.

The practical consequence is a gap between what teams believe and what applies. "The AI Act got delayed" became the summary, and a lot of the commentary still in circulation describes a timeline that no longer exists.

The four obligations, in plain terms

Article 50 is four separate duties, and they do not all fall on the same party. Two land on the provider who builds the system. Two land on the deployer who puts it in front of people. If you both build and run your own assistant, you are both.

If your system interacts with people

Article 50(1), on the provider. Systems intended to interact directly with natural persons must be designed so that those people are informed they are interacting with an AI system.

The exemption is narrower than most teams assume. It applies where this is already obvious to an average person who is reasonably well-informed, observant and circumspect. That is a test about the interface, not about your intentions or your audience. "Our users all know it is a bot" is not the standard. A support widget that opens with a friendly first name and no other signal is exactly the case the provision exists for.

If your system generates content

Article 50(2), on the provider. Systems generating synthetic audio, image, video or text must mark their output in a machine-readable format, detectable as artificially generated or manipulated.

The carve-outs are real and worth knowing. They cover standard editing assistance that does not substantially alter the input data, short sequences of numbers or symbols, source code, machine-to-machine outputs, and closed-loop industrial uses. If your model rewrites a sentence a human wrote, that is assistive. If it produces the article, it is not.

If you run emotion recognition or biometric categorisation

Article 50(3), on the deployer. People exposed to the system must be informed that it is operating. Data protection law applies on top of this, not instead of it.

If you publish deepfakes or AI-written text

Article 50(4), on the deployer. Content that is artificially generated or manipulated must be disclosed as such. Text published to inform the public on matters of public interest is treated differently. There, the duty falls away if the content had substantive human review and someone holds editorial responsibility for it. Artistic and satirical work gets a lighter, but not absent, obligation.

The one grace period, and why it is probably not yours

There is a single transitional concession, and it is narrow enough that most teams reading this do not have it.

Providers of systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking requirement in Article 50(2). That is the entire extent of it. It covers the marking mechanism and nothing else.

Check the date you are reading this against that deadline. Marking touches the generation path rather than the interface, so it is rarely a one-afternoon change, and the teams that leave it until November tend to discover that their output pipeline has three exits rather than one.

So: a system launched on or after 2 August 2026 marks from day one. The disclosure duty in Article 50(1) has no grace period regardless of when the system launched. The deployer duties in 50(3) and 50(4) have no grace period either. If you have been treating December as your deadline, check which of the four duties you were actually thinking of.

The two documents the Commission published, and the gap between them

Two instruments now sit between the text of Article 50 and what an auditor will actually look at. Neither shows up in most of the commentary, and the difference between them matters.

The Guidelines on transparency obligations were published in final form on 20 July 2026, replacing the consultation draft from May. They are nonbinding, which is easy to misread as optional. They are the primary interpretive tool national market surveillance authorities will reach for when deciding whether your disclosure was clear enough. Nonbinding describes their legal status, not their practical weight.

The Code of Practice on Transparency of AI-generated Content was published on 10 June 2026 and confirmed as adequate by the Commission and the AI Board in July. Around 190 organisations had signed by the end of that month. Signing gives you one framework recognised across all 27 member states, so you can point to the Code rather than defend a bespoke implementation to each national authority in turn.

Here is the part worth reading twice. The Code covers Article 50(2), (4) and (5). It does not cover Article 50(1).

If you run a customer-facing assistant, 50(1) is your duty. It is the paragraph that says people must be told they are talking to a machine, and it reaches the largest number of ordinary products. Signing the Code is worth doing and it does not touch that obligation. Nor is signing a safe harbour for the paragraphs it does cover: adherence is a reference point for demonstrating compliance, and a national authority can still look at how you actually implemented it.

So sign the Code if you generate content. It is not a substitute for opening your own assistant and reading what the first message says.

How the disclosure has to land

Article 50(5) is the part that turns a policy decision into an engineering one. The information must be given in a clear and distinguishable manner, at the latest at the time of the first interaction, and it must meet accessibility requirements.

Three things follow from that sentence, and each of them is a code change rather than a document change:

• It cannot live in your privacy policy. "At the latest at the time of the first interaction" means in the interaction. A link in a footer is not first contact.
• It has to survive your greeting template. Most assistants open with a templated welcome. Suppose the disclosure is appended by a separate system that fires a moment later, or is dropped when a user arrives mid-flow through a deep link. The obligation is then missed in exactly the case that matters.
• It has to be in the language of the conversation. This is the one that catches multilingual teams. A disclosure in English to a user writing in Portuguese is not clear and distinguishable to that user. If your assistant detects the language and switches, the disclosure has to switch with it. That means it belongs in the same translation path as everything else the assistant says, not hardcoded next to the transport layer.

We build and run a multilingual assistant ourselves, and that last point is the one that took actual work. Nine languages is not one disclosure; it is nine, and they have to be selected by the same logic that selects the reply. Anything else produces a system that is compliant in the language you tested and silently non-compliant in the other eight.

Four ways teams are getting this wrong

Assuming the Omnibus deferred everything. It deferred the high-risk regime. Transparency was untouched, and it is the part that applies to ordinary customer-facing products rather than to a specialised minority of systems.

Treating disclosure as a legal document. A clause in the terms of service satisfies a lawyer and not Article 50(5). The obligation is about the moment of first interaction.

Assuming business users are out of scope. Article 50(1) is about natural persons interacting with the system. A procurement manager using your B2B support bot is a natural person.

Assuming a non-EU company is unaffected. The Act's scope reaches providers placing systems on the EU market irrespective of where they are established. Where you are incorporated is not the question; where your system is used is closer to it.

Getting it wrong is not a nominal risk. Non-compliance with the transparency obligations carries penalties of up to €15 million or 3% of total worldwide annual turnover, whichever is higher.

What to actually do this month

None of this is a large programme of work. It is a short list, and it is checkable in an afternoon:

1. Establish, for each AI feature you ship, whether you are the provider, the deployer, or both. The four duties split along that line.
2. Open your assistant as a new user would, in every language you support, and confirm the disclosure appears in the first message.
3. Do the same through every entry point (deep link, QR code, resumed session, channel handoff), not just the front door.
4. If you generate content, determine whether your marking obligation started in August or starts in December, and stop assuming it is December.
5. If you generate content, read the Code of Practice and decide whether to sign. If you only run an assistant that talks to people, the Code does not cover your duty, and nothing in it will tell you so.
6. Write down the date you checked. This timeline has moved once and the high-risk dates are still ahead of you.

The teams that will struggle in December are not the ones that read the regulation. They are the ones that read the headline.

Common questions

Law and guidance as at 13 September 2026. This is general information, not legal advice.