EU AI Act Transparency Rules Are Live: What Changes on Your Website

On 2 August 2026 the transparency obligations in Article 50 of the EU AI Act became applicable. Unlike the high-risk provisions, which were pushed back, this tranche arrived on schedule.

It matters to far more companies than the phrase "AI regulation" suggests. You do not need to be building models. If you put a chatbot on your support page, generate product descriptions with a language model, or use an AI tool to produce imagery for your campaigns, Article 50 is now part of your compliance surface.

Here is what applies, what does not, and what it looks like as work.

The Revised Timeline, Because It Moved

There was real confusion during 2026 about which AI Act deadlines survived. The Digital Omnibus on AI, proposed on 19 November 2025 and agreed during 2026, deferred parts of the regime. The current picture:

2 February 2025: prohibitions on unacceptable practices, including social scoring, subliminal manipulation and certain biometric identification. Already in force, unchanged.
2 August 2025: obligations for general-purpose AI model providers. In force.
2 August 2026: Article 50 transparency obligations. In force now.
2 December 2026: a prohibition on nudification applications, plus the marking and labelling requirements for AI-generated content, with a four month grace period for generative systems already on the market before 2 August 2026.
2 December 2027: compliance deadline for stand-alone high-risk systems under Annex III, deferred from 2 August 2026.
2 August 2028: compliance deadline for high-risk AI embedded in regulated products.

The deferral applies to the high-risk tier. If you assumed the whole Act slipped, you missed the part that hits ordinary product teams hardest.

What Article 50 Requires

Four obligations, aimed at different situations.

1. Tell people when they are talking to a machine

If an AI system is intended to interact directly with people, it has to be designed so that those people are informed they are interacting with AI, unless that is obvious to a reasonably well-informed and observant person.

This covers support chatbots, voice assistants, AI-driven phone systems and conversational sales agents. The obligation sits with the provider at design time, but if you deploy one on your site under your own branding, you are the one whose users need to be informed.

The bar for "obvious" is lower than most people assume. A widget called "AI Assistant" with a robot icon probably clears it. A chat window that opens with "Hi, I'm Anna from support, how can I help?" and never says otherwise does not.

2. Mark synthetic content in a machine-readable way

Providers of AI systems that generate synthetic audio, image, video or text have to mark the outputs in a machine-readable format so they are detectable as artificially generated or manipulated. The marking has to be effective, interoperable, robust and reliable as far as is technically feasible.

In practice this points at content credentials and provenance metadata, C2PA being the most developed approach, and at watermarking for models that support it. The detailed marking and labelling requirements come into effect on 2 December 2026.

If you use a commercial model provider, most of this obligation is theirs. Your exposure is in what your pipeline does to the output afterwards. Stripping metadata during image processing, re-encoding, or CDN transformation can remove exactly the marking the law asks you to preserve. That is a real risk in an ordinary asset pipeline and worth checking.

3. Disclose deepfakes and AI-generated public interest text

Deployers of systems generating or manipulating image, audio or video content that constitutes a deepfake have to disclose that it is artificially generated or manipulated. There is an exception for evidently artistic, creative, satirical or fictional work, where the disclosure can be lighter and must not spoil the work.

Separately, deployers publishing AI-generated or AI-assisted text on matters of public interest have to disclose it, unless the content went through human review and a natural person or organisation holds editorial responsibility.

That second exception is important for marketing teams. AI-assisted copy that a human editor reviewed and signed off on generally does not need a label. What you need is a record that the review happened. A workflow state, an approval log, a named owner.

4. Emotion recognition and biometric categorisation

Deployers of emotion recognition or biometric categorisation systems have to inform the people exposed to them and handle personal data in line with GDPR. This is narrower, but if your product does sentiment analysis on video calls or infers attributes from images, look at it carefully.

How the Information Has to Be Presented

Article 50 says the information must be provided in a clear and distinguishable manner at the latest at the time of the first interaction or exposure, and must conform to applicable accessibility requirements.

That last clause connects directly to the European Accessibility Act. A disclosure that only appears as a tooltip on hover, or as low contrast grey text, or as an image without alt text, fails twice over.

Practical implications:

The disclosure appears before or at first interaction, not in the terms of service.
It is readable text in the accessible DOM, not baked into an image.
It survives keyboard navigation and screen reader access.
It is translated. On a multilingual site, an English-only AI disclosure is not clear to a Polish user.

What This Looks Like as Tickets

For most teams the actual work is small, which is a good reason not to put it off.

Chat and conversational interfaces. Add a persistent, visible statement in the widget header and in the opening message. Make sure it is present in every language you serve. If you hand off to a human, say so at the handoff, because that transition is exactly when a user's assumption changes.

Content pipelines. Audit where AI-generated assets enter your system and what happens to their metadata. If your image processing strips provenance data, either preserve it or re-apply it. Keep a provenance field on the asset record.

Editorial workflow. If you publish AI-assisted content on anything resembling public interest topics, add a review step with a named approver and store the approval. This is your exemption, and an exemption you cannot evidence is not an exemption.

Component work. Build a small disclosure component and use it consistently rather than writing the label ad hoc in five places. It also means one place to change when guidance evolves.

Inventory. Keep a list of every AI system in the product: what it is, who provides it, what it generates, who is the provider and who is the deployer, and which Article 50 obligations attach. When a regulator or a customer asks, this is the answer.

Who Is a Provider and Who Is a Deployer

The Act splits obligations between providers, who develop and place a system on the market, and deployers, who use it under their own authority.

Most companies are deployers. That is the lighter role, but there is a trap: if you substantially modify a system, put your own name or trademark on it, or change its intended purpose, you can become a provider and inherit the heavier obligations.

Wrapping a commercial model in your own product, giving it a persona and shipping it under your brand is a fact pattern worth having your counsel look at, because the answer depends on details that only your team knows.

What Is Not in Scope

Worth stating clearly, because scope creep in internal compliance projects wastes real time.

Article 50 does not require you to label every use of machine learning. A recommendation engine that ranks products is not generating synthetic content and is not interacting as a conversational agent. Spam filtering, fraud scoring, search ranking and demand forecasting sit outside these particular transparency rules, though they may raise GDPR questions about automated decision-making.

It also does not make you a high-risk system just because you use AI. High-risk classification comes from Annex I and Annex III, tied to specific use cases such as employment, credit, education, essential services and safety components. If you are in one of those, your deadline is 2 December 2027 or 2 August 2028, and that is a much bigger programme.

Enforcement Reality

Penalties under the AI Act are significant, up to 15 million euros or 3 percent of global annual turnover for many infringements. National market surveillance authorities are still building capacity, and the first enforcement year is unlikely to be aggressive against small deployers acting in good faith.

That said, transparency obligations are the easiest thing in the entire Act for anyone to check from the outside. A regulator, a journalist or a competitor can open your site and see whether the chatbot discloses. There is no discovery process required.

Cheap to comply with, trivially visible when you have not. That is the wrong combination to gamble on.

Where This Fits

The AI Act is one strand in a much wider build-out of EU digital rules. If you are mapping the whole surface, our 2026 EU digital compliance guide covers what applies when, and the GDPR engineering guide covers the data protection layer that AI systems sit on top of.

We build AI features into products for companies operating in Europe, which means we deal with the disclosure, provenance and audit trail questions as part of normal delivery rather than as a separate compliance exercise. If you want a review of where AI appears in your product and what Article 50 asks of it, write to office@c9group.dev.

We are engineers, not lawyers. Classification questions, particularly the provider versus deployer line, belong with your counsel. We make sure the system matches the answer.