AI Act, Article 50: what actually lands on August 2

Since the Digital Omnibus deal (provisional agreement in early May 2026, adopted by Parliament on June 16 and the Council on June 29), a certain tune has been going around: the AI Act got “unravelled”, the deadlines moved, we have time. That’s true for one part of the text and false for the part that affects the most people.

What moved: high-risk

The Digital Omnibus pushes the obligations for Annex III high-risk systems (HR, scoring, biometrics…) from August 2, 2026 to December 2027 — roughly sixteen months. Annex I regulated products move from 2027 to 2028. Risk management, technical documentation, human oversight, conformity assessment: all of that bought time. Memories of the GDPR timeline resurface.

If you’re building a system classified as high-risk, that’s a real reprieve. For almost everyone else, it’s not the point.

What still lands on August 2: transparency (Article 50)

Article 50 was not postponed. It applies on August 2, 2026, Digital Omnibus or not. Four concrete things — and for each one, who carries it matters as much as what:

50(1) — say it’s an AI (provider obligation). Any system that interacts with a human (chatbot, voice assistant, support agent) must be designed to disclose it from the first interaction. The exception is narrow: only when it’s obvious to a reasonably well-informed person. If you embed a third party’s chatbot, it’s on them to have built it in — and on you to check that they did.

50(2) — mark generative outputs (provider obligation). Content generated or manipulated by AI (text, image, audio, video) must be marked in a machine-readable format (watermark, metadata, cryptographic provenance). A nuance that matters and gets misreported: new systems must mark from August 2; the December 2, 2026 extension is a grace period for systems already in service, not a general postponement — and it covers the provider-side marking, not the deployer-side disclosure duties.

50(4) — disclose published content (deployer obligation — so probably yours). If you publish a deepfake (generated or manipulated image, audio, video), you have to say so. If you publish AI-generated text to inform the public, you have to say so too — unless the text went through human editorial review with assumed responsibility. For an SMB pushing AI-assisted content (blog, docs, newsletters), it’s the most directly applicable obligation in the whole article — and the least discussed.

Article 4 — training (providers and deployers). Not new, but it’s the blind spot: since February 2, 2025, both must ensure a sufficient level of AI literacy among the people operating these systems — enablement , in the literal sense. Plenty of SMBs ticked “we use AI” without ever training anyone, while shadow AI thrived in browser tabs. It’s already an obligation, not a best practice.

The real work isn’t technical, it’s contractual

The question that blocks in practice: are you a provider or a deployer? An SMB integrating a third-party model is almost always a deployer — but the moment you fine-tune, rebrand, or put it on the market under your own name, the line moves. And the obligations aren’t the same: the 50(2) marking sits with the provider, the 50(4) disclosure with the deployer. Your vendor watermarking its outputs doesn’t excuse you from saying your published content is generated — two distinct obligations, carried by two distinct actors. Conversely, if they don’t mark, it’s their breach, not yours — but it’s your product carrying unmarked content, and your reputation with it.

And if you “only” use ChatGPT or Claude internally? Article 4 (training) applies anyway, and 50(4) kicks in the moment generated content goes out to the public. High-risk, on the other hand, doesn’t concern you unless you’re the provider of an Annex III system.

Concretely: contracts signed before August 2 should already spell out who carries what in the chain — who marks, who discloses, who answers in an audit. That gets settled in writing, not in code.

”Runway, not reprieve”

A calendar detail worth watching: as long as the Digital Omnibus is not published in the Official Journal, the August 2 deadline remains legally binding — the revised version has no legal force before publication (expected before July 30, 2026). In other words: counting on the postponement means betting on a text that hasn’t been enacted yet. A bad bet for an obligation whose breach costs up to €15M or 3% of worldwide turnover (€7.5M or 1% for misleading information to authorities).

To do before August 2 (short checklist)

• Inventory the systems that interact with humans → check that the provider built in the 50(1) disclosure (yours if you’re the provider).
• Inventory what generates content → check the machine-readable marking (50(2)) on the vendor side, and who answers for it in the chain.
• Inventory what you publish that’s AI-generated → plan the 50(4) disclosure, or document the human editorial review that exempts you for text.
• Settle provider/deployer in writing with every vendor, before the deadline.
• Train — Article 4 already applies; it’s the easiest to prove and the most often forgotten.
• Reconcile with GDPR (the two overlap on personal data).

It’s not the mountain the words “AI Act” conjure up. For an SMB, Article 50 comes down to a few clear decisions — as long as you don’t make them on the evening of August 1.

The high-risk postponement made everyone forget the rest. That’s usually how you miss a deadline: by watching the one next to it.

(I’m a dev, not a lawyer: this dispatch describes what I understand of the text and its timeline at publication time — not legal advice. To settle your own case, see someone whose job it is.)