AI Act, Article 50: what applies on 2 August 2026
Tun KelteschPublished
Tomorrow, 2 August 2026, Article 50 of Regulation (EU) 2024/1689 starts to apply. It requires telling people when they are talking to a machine, and when what they are looking at was made by one. If your site has a chatbot, this reaches you.
The Digital Omnibus postponed a large part of the AI Act. It did not touch Article 50.
What applies on 2 August 2026
Article 50 in full, with no deferral.
Article 113 sets the Regulation's general application date at 2 August 2026, with three listed exceptions: Chapters I and II since 2 February 2025, a set of provisions since 2 August 2025, and Article 6(1) deferred. Chapter IV, which contains only Article 50, appears in none of those exceptions. It falls under the general rule.
What the Digital Omnibus changed, and what it did not
It deferred high risk. Not transparency.
Regulation (EU) 2026/1744 of 8 July 2026 was published in the Official Journal on 24 July and entered into force on 27 July. It moves the obligations for Annex III high-risk systems to 2 December 2027, and those for Annex I to 2 August 2028.
On Article 50 it changes exactly one thing: the Commission loses the power to adopt implementing acts approving the codes of practice referred to in Article 50(7). The obligations themselves are unchanged, and so is their start date.
That is where a good deal of the June commentary went wrong, reading "AI Act delayed" where the text said "high-risk obligations delayed".
Provider or deployer: the distinction everything hangs on
You are almost certainly a deployer, not a provider.
The provider develops the AI system and places it on the market. The deployer uses it under its own authority. An SME wiring an existing model into its website is a deployer. OpenAI, Anthropic and Mistral are providers.
This is not an academic split: the paragraphs of Article 50 address different parties.
- Article 50(1) and 50(2) bind the provider.
- Article 50(3) and 50(4) bind the deployer.
So the machine-readable marking of synthetic content under Article 50(2) is not your obligation when you generate an image with a third-party tool. It belongs to whoever makes the tool. Yours, where the output is a deepfake, is the Article 50(4) duty to disclose it.
The obligations, one at a time
Article 50(1) — say it is an AI. The provider designs systems intended to interact directly with natural persons so that those persons are informed they are interacting with an AI system, "unless this is obvious". The support chatbot introducing itself as "Julie" with nothing further is the textbook case.
Article 50(2) — mark synthetic content. AI-generated audio, image, video or text outputs must be marked in a machine-readable format and detectable as artificially generated or manipulated. Watermark, C2PA metadata, cryptographic signature: the Regulation prescribes no technique.
Article 50(3) — emotion recognition and biometric categorisation. The deployer informs the persons exposed of the system's operation. Rare in an SME, unless you have deployed in-store attention analysis or video screening of job applicants.
Article 50(4) — deepfakes and text on matters of public interest. A deployer generating or manipulating an image, audio or video that constitutes a deepfake must disclose it. The same applies to AI-generated text published to inform the public on matters of public interest, absent human editorial control. The Regulation provides a lighter regime for evidently artistic or satirical work.
Article 50(5) — when. The information is given clearly and distinguishably, at the latest at the time of the first interaction or exposure. Not in the terms of service, not in the footer.
For an SME running a chatbot and publishing generated visuals, the real work is two things: a visible notice from the chatbot's first message, and disclosure of deepfakes if you produce them. The rest does not reach you.
Who enforces this in Luxembourg
Formally, as of today: nobody.
Bill 8476, filed on 23 December 2024, designates the national authorities for applying the AI Act. It has not been voted. It is still in committee.
What it proposes:
- The CNPD as default market surveillance authority and single point of contact (CNPD announcement).
- ALIA, the audiovisual authority, for oversight of Articles 50(2) and 50(4): synthetic content marking and deepfake disclosure exactly.
- The CSSF for finance, the Commissariat aux Assurances for insurance, ILNAS and ILR for their remits.
A directly applicable European obligation does not need a national law to exist. It needs a national designation to be enforced. On 1 August 2026 Luxembourg has the first without the second.
What you are exposed to
Up to EUR 15 000 000 or 3% of total worldwide annual turnover, whichever is higher (Article 99(4)).
For SMEs and start-ups, Article 99(6) inverts the rule: the lower of the two applies. On turnover of EUR 500 000, the theoretical ceiling drops from 15 million to 15 000.
The theoretical ceiling is not the real exposure, which depends on a supervisory authority Luxembourg has not yet designated.
Timeline
| Date | What applies |
|---|---|
| 1 August 2024 | Regulation (EU) 2024/1689 enters into force |
| 2 February 2025 | Chapters I and II: definitions, prohibited practices, AI literacy |
| 2 August 2025 | General-purpose AI models, governance, confidentiality, penalties (except Article 101) |
| 2 August 2026 | Article 50: transparency obligations |
| 2 December 2027 | High risk, Annex III — deferred by Regulation (EU) 2026/1744 |
| 2 August 2028 | High risk, Annex I — deferred by Regulation (EU) 2026/1744 |
What is still unclear
The Commission adopted its guidelines on transparency obligations on 20 July 2026, under two weeks before the obligations start applying. They are not binding. They interpret.
The code of practice on transparency of AI-generated content is voluntary. Declining to sign it is not an infringement; compliance then has to be shown by other means of equivalent effect. What "equivalent" covers has not been settled.
Four grey areas remain, from where I sit as an engineer:
- "Unless this is obvious" in Article 50(1) is undefined. Is a chatbot named "AI Assistant" obvious enough to skip the notice? Nobody has a firm answer.
- The Article 50(4) boundary between text "of public interest" and everything else. Is a blog post about tax of public interest? A product description is not; between the two there is no drawn line.
- Marking interoperability. Article 50(2) requires a machine-readable format without mandating a standard. C2PA dominates in practice, but no provider is obliged to use it, and nothing guarantees a mark survives a resize or a screenshot.
- Marking text. Marking an image machine-readably is a solved problem. Marking text is not: no text-watermarking method reliably survives a rewrite. Article 50(2) covers text all the same.
Status of bill 8476, checked 1 August 2026: still in committee, not voted.
Frequently asked questions
Does my chatbot need a notice? Yes, if a user could believe they are talking to a person. The obligation formally sits with the system's provider under Article 50(1), but in practice you control the interface, so you place the notice.
Do I have to mark AI-generated images on my site? The machine-readable marking under Article 50(2) belongs to whoever makes the tool that generated the image. Your obligation, under Article 50(4), is triggered only by deepfakes.
Has the AI Act been delayed? High risk yes, transparency no. Regulation (EU) 2026/1744 moves Annex III to December 2027 and Annex I to August 2028, leaving Article 50 alone.
What happens if I do nothing on 2 August? Nothing immediate. The obligation exists, but Luxembourg has no designated authority to enforce it yet. The risk is deferred, not absent.
Am I a provider or a deployer? A deployer, if you use a model someone else developed. A provider, if you develop the system and place it on the market under your own name.
An engineer's implementation read, not legal advice. No lawyer reviewed this text.
Every date, article number and figure above comes from the Regulation text and the Official Journal, linked inline. If you want a specific point checked before you decide anything, write to me.