The EU AI Act Landed Yesterday. Here's What Actually Changed for Builders.
By Joey
Regulation (EU) 2026/1744 — the Digital Omnibus — entered into force on July 27 and moved the EU AI Act’s high-risk system deadline from August 2 to December 2027, giving compliance teams sixteen extra months they’d been lobbying for. What it did NOT move: Article 50’s transparency rules, which became legally enforceable yesterday, and the AI Office’s authority to fine every general-purpose AI model provider — Anthropic, OpenAI, Google — up to €15 million or 3% of global annual turnover, per CNBC’s reporting this morning.
If you tracked the delay and concluded you were fine, you tracked the wrong deadline.
What actually went live on August 2
The EU AI Act has rolled out in phases since February 2025. Here’s the timeline as it stands after the Omnibus, published in the EU Official Journal on July 24 and in force three days later:
| Date | What applies |
|---|---|
| Feb 2, 2025 | Article 5 prohibited AI practices |
| Aug 2, 2025 | GPAI model obligations (Arts. 51–55): documentation, copyright policy, systemic-risk evaluations |
| Aug 2, 2026 | Article 50 transparency; AI Office fining authority over GPAI providers |
| Dec 2, 2026 | Machine-readable marking for pre-2026 systems; new Art. 5 prohibitions (CSAM) |
| Dec 2, 2027 | Annex III high-risk: hiring, credit scoring, biometrics (moved from Aug 2026) |
| Aug 2, 2028 | Annex I high-risk embedded in regulated products (moved from Aug 2027) |
Regulation (EU) 2026/1744 surgically removed the Annex III and Annex I dates from the original text. It left everything else exactly where it was. That’s the entire confusion in one sentence: “the EU delayed the AI Act” is not the same statement as “the EU delayed one chapter of the AI Act.” They’re different claims, and the second one is what actually happened.
The chapter that stayed on schedule is Article 50. And Article 50 is the thing that touches every builder shipping an AI product with EU users.
The four disclosure rules that are now enforceable
The European Commission published binding guidelines on Article 50 on July 20. Four obligations, each with a different trigger and scope — and many teams conflate them, which is how compliance gaps happen.
Chatbot and AI system disclosure (Art. 50(1)). If your system interacts with people in a conversational format — chatbot, AI agent, AI avatar — you must tell users they’re talking to an AI. At the start of the interaction. Clearly. Not buried in your terms of service. Not in footer copy. At the start.
The “obvious from context” exception is far narrower than most builders assume. I’ve reviewed enough AI-interactive UIs to know the gap: having “AI” in your product name, even having a robot in your logo, does not automatically qualify as disclosure. Regulators in France (CNIL) and Germany (BayLDA) have both indicated they’ll require active, session-level disclosure — not passive branding. A system message at conversation start is the safe move. Relying on passive UI signals is not.
Machine-readable watermarks (Art. 50(2)). Providers of AI systems generating synthetic text, images, audio, or video must embed machine-readable markers in outputs. The regulation doesn’t name a specific standard, but the Commission’s July 20 guidelines identify C2PA v2.1 as the de facto baseline — all major GPAI providers have committed to it. One gotcha: if you process or recompose AI-generated output through compositing, editing, or re-rendering, you may break existing markers and take on the watermarking obligation yourself. Systems already on the market before August 2 get until December 2, 2026 to comply with this specific obligation. That’s the only grace period in Article 50.
Emotion and biometric disclosure (Art. 50(3)). If you deploy emotion-recognition or biometric categorization — sentiment analysis on customer calls, age estimation for content gating, attention detection in proctoring tools — you must inform users before exposure. The scope here is broader than most expect: even if the biometric classification is never stored or acted on in a high-risk way, the disclosure obligation still applies.
Deepfake and public-interest text labeling (Art. 50(4) and (5)). AI-generated or manipulated content resembling real people, places, or events must carry a human-perceivable label — not just a machine-readable marker. AI-generated text on public-interest topics published without substantive human editorial review requires the same. “Substantive” is defined: spell-check doesn’t count.
Fines for Article 50 violations go up to €15 million or 3% of worldwide annual turnover. National regulators and the AI Office can now investigate and act on complaints.
What the GPAI enforcement powers mean if you build on frontier models
The GPAI technical obligations — training documentation, copyright compliance, systemic-risk evaluations for models above a compute threshold — have been in force since August 2025. What the Omnibus left on the original clock was Article 101: the Commission’s power to fine GPAI providers. That power went live yesterday.
From now on, the EU AI Office can compel model documentation under Article 91, run technical evaluations under Article 92, order risk-mitigation measures under Article 93, restrict EU market access, and fine providers up to €15 million or 3% of annual global turnover. Elisabetta Righini, partner at Sidley Austin, told CNBC this morning: “A U.S. address does not put a lab outside the EU regulator’s reach. Non-EU providers must also appoint an EU-based authorised representative as the regulator’s point of contact.”
She also flagged something that rarely gets attention in the coverage: “GPAI liability isn’t limited to substantive breaches — refusing an information request, giving misleading answers, or blocking a model evaluation is fineable on its own.”
OpenAI’s VP for EMEA policy said the company “collaborated closely with the European Commission and the wider ecosystem on implementing the AI Act, including its Codes of Practice, and will continue working together.” That’s the right posture for a provider operating in the EU. But it also marks the beginning of a regulatory relationship that will define how EU-accessible foundation models get developed and updated for years.
The practical implication: the model layer under your product is now a regulated entity in Europe. If Anthropic or OpenAI receives a market restriction or a model recall in the EU, your EU users lose access. That’s a dependency risk worth modelling in how you architect your integrations — especially if you’re building anything customer-facing for European markets.
The compliance team that tracked the high-risk delay missed the deadline that actually landed.
Frequently asked questions
Does Article 50 apply to my internal enterprise chatbot? Probably not — the obligation covers systems that interact “directly with natural persons” and the Commission’s guidelines explicitly carve out machine-to-machine APIs and internal automation tools with no direct human contact. But if EU employees interact with it conversationally, document why it falls outside scope before a regulator asks. “We think it’s probably fine” is not a compliance position.
We’re a US company with EU users. Are we actually exposed? Yes. The EU AI Act uses the same extraterritorial model as GDPR — it applies based on where your users are, not where you’re incorporated. Any company placing AI systems in the EU market, regardless of where it’s based, is in scope. The CNBC piece this morning makes clear the EU AI Office intends to enforce against non-EU providers on exactly the same basis it enforces against European ones.
The machine-readable marking requirement — is C2PA actually mandatory? Not by name. The regulation requires markers that are “effective, reliable, robust, and interoperable.” The Commission’s July 20 guidelines identify C2PA v2.1 as the current standard meeting those criteria, and all major GPAI providers have committed to it. The practical answer: implement C2PA unless you have a documented alternative standard and the technical evidence to prove equivalence. The burden of proof is on you, not the regulator.