If you run a customer-facing chatbot, you probably read this summer that the EU AI Act had been pushed back. You are half right. The half you have wrong is the half that already applies to you.
The Digital Omnibus on AI did defer a great deal. It did not defer Article 50. Those transparency obligations took effect on 2 August 2026, and the disclosure duty for systems that talk to people arrived with no grace period at all.
What moved in July, and what did not
Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, amending the AI Act itself. It is a simplification package, not a repeal — the risk tiers, the prohibited practices and the general-purpose AI rules all survive.
| Obligation | Original date | Now |
|---|---|---|
| Article 50 transparency | 2 August 2026 | 2 August 2026 — unchanged |
| High-risk, Annex III standalone systems | 2 August 2026 | 2 December 2027 |
| High-risk, Annex I systems in regulated products | 2 August 2027 | 2 August 2028 |
| AI regulatory sandboxes | 2 August 2026 | 2 August 2027 |
| High-risk systems already used by public authorities | 2 August 2026 | 2 August 2030 |
That table is the whole story. The deferral was real and substantial, and it landed on the obligations that are expensive and slow — conformity assessment, registration, risk management systems. Transparency was left where it was, because telling someone they are talking to a machine is neither expensive nor slow.
The practical consequence is a gap between what teams believe and what applies. "The AI Act got delayed" became the summary, and a lot of the commentary still in circulation describes a timeline that no longer exists.
The four obligations, in plain terms
Article 50 is four separate duties, and they do not all fall on the same party. Two land on the provider who builds the system. Two land on the deployer who puts it in front of people. If you both build and run your own assistant, you are both.
If your system interacts with people
Article 50(1), on the provider. Systems intended to interact directly with natural persons must be designed so that those people are informed they are interacting with an AI system.
The exemption is narrower than most teams assume. It applies where this is already obvious to an average person who is reasonably well-informed, observant and circumspect. That is a test about the interface, not about your intentions or your audience. "Our users all know it is a bot" is not the standard. A support widget that opens with a friendly first name and no other signal is exactly the case the provision exists for.
If your system generates content
Article 50(2), on the provider. Systems generating synthetic audio, image, video or text must mark their output in a machine-readable format, detectable as artificially generated or manipulated.
The carve-outs are real and worth knowing. They cover standard editing assistance that does not substantially alter the input data, short sequences of numbers or symbols, source code, machine-to-machine outputs, and closed-loop industrial uses. If your model rewrites a sentence a human wrote, that is assistive. If it produces the article, it is not.
If you run emotion recognition or biometric categorisation
Article 50(3), on the deployer. People exposed to the system must be informed that it is operating. Data protection law applies on top of this, not instead of it.
If you publish deepfakes or AI-written text
Article 50(4), on the deployer. Content that is artificially generated or manipulated must be disclosed as such. Text published to inform the public on matters of public interest is treated differently. There, the duty falls away if the content had substantive human review and someone holds editorial responsibility for it. Artistic and satirical work gets a lighter, but not absent, obligation.
The one grace period, and why it is probably not yours
There is a single transitional concession, and it is narrow enough that most teams reading this do not have it.
Providers of systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking requirement in Article 50(2). That is the entire extent of it. It covers the marking mechanism and nothing else.
So: a system launched on or after 2 August 2026 marks from day one. The disclosure duty in Article 50(1) has no grace period regardless of when the system launched. The deployer duties in 50(3) and 50(4) have no grace period either. If you have been treating December as your deadline, check which of the four duties you were actually thinking of.
How the disclosure has to land
Article 50(5) is the part that turns a policy decision into an engineering one. The information must be given in a clear and distinguishable manner, at the latest at the time of the first interaction, and it must meet accessibility requirements.
Three things follow from that sentence, and each of them is a code change rather than a document change:
- It cannot live in your privacy policy. "At the latest at the time of the first interaction" means in the interaction. A link in a footer is not first contact.
- It has to survive your greeting template. Most assistants open with a templated welcome. Suppose the disclosure is appended by a separate system that fires a moment later, or is dropped when a user arrives mid-flow through a deep link. The obligation is then missed in exactly the case that matters.
- It has to be in the language of the conversation. This is the one that catches multilingual teams. A disclosure in English to a user writing in Portuguese is not clear and distinguishable to that user. If your assistant detects the language and switches, the disclosure has to switch with it. That means it belongs in the same translation path as everything else the assistant says, not hardcoded next to the transport layer.
We build and run a multilingual assistant ourselves, and that last point is the one that took actual work. Nine languages is not one disclosure; it is nine, and they have to be selected by the same logic that selects the reply. Anything else produces a system that is compliant in the language you tested and silently non-compliant in the other eight.
Four ways teams are getting this wrong
Assuming the Omnibus deferred everything. It deferred the high-risk regime. Transparency was untouched, and it is the part that applies to ordinary customer-facing products rather than to a specialised minority of systems.
Treating disclosure as a legal document. A clause in the terms of service satisfies a lawyer and not Article 50(5). The obligation is about the moment of first interaction.
Assuming business users are out of scope. Article 50(1) is about natural persons interacting with the system. A procurement manager using your B2B support bot is a natural person.
Assuming a non-EU company is unaffected. The Act's scope reaches providers placing systems on the EU market irrespective of where they are established. Where you are incorporated is not the question; where your system is used is closer to it.
Getting it wrong is not a nominal risk. Non-compliance with the transparency obligations carries penalties of up to €15 million or 3% of total worldwide annual turnover, whichever is higher.
What to actually do this month
None of this is a large programme of work. It is a short list, and it is checkable in an afternoon:
- Establish, for each AI feature you ship, whether you are the provider, the deployer, or both. The four duties split along that line.
- Open your assistant as a new user would, in every language you support, and confirm the disclosure appears in the first message.
- Do the same through every entry point — deep link, QR code, resumed session, channel handoff — not just the front door.
- If you generate content, determine whether your marking obligation started in August or starts in December, and stop assuming it is December.
- Write down the date you checked. This timeline has moved once and the high-risk dates are still ahead of you.
The teams that will struggle in December are not the ones that read the regulation. They are the ones that read the headline.
Common questions
Did the Digital Omnibus delay the Article 50 transparency rules?
No. Regulation (EU) 2026/1744 deferred the high-risk regime, not the transparency obligations. Article 50 has applied since 2 August 2026.
Does my chatbot have to tell people it is AI?
Yes, unless that is already obvious to an average person who is reasonably well-informed, observant and circumspect. The test is the interface, not your intent.
Is there a grace period for Article 50?
One, and it is narrow. Machine-readable marking of generated content under Article 50(2) runs to 2 December 2026, and only for systems placed on the market before 2 August 2026.
Does the EU AI Act apply to a company based outside the EU?
It can. The Act reaches providers who place AI systems on the EU market regardless of where they are established, so being a non-EU company is not by itself an answer.
Law and guidance as at 19 August 2026. This is general information, not legal advice.