The EU AI Act's Transparency Rules Landed On Time. The High-Risk Regime Slipped 16 Months.

Two EU AI Act dates now sit in the calendar and they moved in opposite directions.

On 2 August 2026 the transparency obligations in Article 50 became enforceable. The Commission adopted the final guidelines on 20 July 2026 — 51 pages of interpretation — and then let the deadline arrive on schedule with no soft-landing period for anything generated from that day onward. Shortly before, the “AI Omnibus” was finalised and pushed the high-risk regime back by sixteen months. Stand-alone Annex III high-risk systems are now due 2 December 2027. High-risk AI embedded in Annex I regulated products moves to 2 August 2028.

If you built a compliance calendar in 2025, it is now wrong in both directions. The thing most teams treated as the soft obligation is live. The thing they were sprinting toward has a year and a half of slack. The tempting read is to stand down the high-risk workstream and staple a disclosure banner onto the chatbot. That read is wrong, and the reason is engineering, not law.

What actually turned on#

Article 50 covers four categories, and the split between them matters because the obligation attaches to different parties.

Direct interaction with an AI system. If a person is talking to a chatbot or avatar, they have to be told, unless it is obvious from context. This is a provider-side obligation and it is the one most organisations already meet by accident. It is also the one that gets missed at the edges: the appointment-rescheduling agent inside a Hospital Management System patient portal, the fee-query assistant bolted onto a School ERP parent app, the voice IVR that now routes with an LLM instead of a decision tree. Those are all disclosure cases, and none of them typically live in the same repo as the flagship AI product that legal has been reviewing.

AI-generated or manipulated content. Providers of generative systems must mark synthetic output in a machine-readable form that allows it to be detected as artificially generated. This is the obligation with real build cost, and the rest of this post is mostly about it.

Emotion recognition and biometric categorisation. Deployers must inform the people exposed to it. Note the interaction with the February 2025 prohibitions — emotion recognition in workplaces and education is banned outright, so if you are reaching for Article 50 here, first check you are not in Article 5 territory.

Deepfakes and public-interest text published without human editorial review. Deployer-side. Content that resembles real persons, places, or events must be disclosed as artificially generated, as must AI-written text published to inform the public on matters of public interest where no human reviewed it. That last clause quietly catches a lot of automated newsroom, investor-relations, and public-sector communications tooling.

Penalties run to EUR 15 million or 3% of worldwide annual turnover, whichever is higher, with a ceiling of EUR 750,000 for EU institutions and bodies and proportional reduction for SMEs and small mid-caps. Enforcement is split three ways: national market surveillance authorities for most of the market, the European AI Office where it supervises the system, and the EDPS for EU institutions. Three enforcers with overlapping remits is not a bug that gets fixed in year one — it is the operating environment. We covered how the national side is shaping up in our Germany AI Act enforcement deep dive.

”Machine-readable marking” is a build ticket, not a legal memo#

Here is where the compliance-as-documentation habit breaks. Article 50(2) does not ask you to describe your marking approach in a policy document. It asks the output itself to carry a mark that a downstream system can detect. That is a change to the generation path.

The Commission published a standardised set of visual indicators for labelling AI-generated content, plus a voluntary Code of Practice on marking and labelling that it has assessed as adequate. The icons solve the human-facing half. They do nothing for the machine-readable half, and the guidelines deliberately do not mandate a single technical format. In practice the field has converged on three layers, and you need more than one because each fails differently:

Provenance metadata. C2PA-style signed manifests attached at generation, recording what model produced the asset and under what settings. Strong, verifiable, cryptographically anchored — and stripped by the first social platform that re-encodes your image.

Watermarking. Signal embedded in the pixels, audio samples, or token distribution. Survives re-encoding far better than metadata. Weaker under adversarial pressure, lossier for short text, and a genuine quality tradeoff for audio.

Fingerprinting and logging. A hash of the output written to your own store at generation time, so you can answer “did we produce this?” even when every external mark is gone. This is the one nobody budgets for and the one that actually holds up in an incident.

Note what all three have in common: they attach at generation time. A post-hoc classifier that scans outbound content and labels what looks synthetic is not compliance, it is a guess with a false-negative rate. If the mark is applied by a filter sitting after your API gateway, it is applied after every internal consumer has already handled unmarked content — batch jobs, retry queues, the RAG pipeline that caches generations, the analytics sink. Put the marking inside the generation call and treat unmarked output as a failed request.

The hard part is not adding the mark. The hard part is that it has to survive the world. Transcoding, re-hosting, screenshotting, copy-paste out of a chat window into a document, a PDF export, an email client that rewrites images. Every one of those is a lossy channel, and the marking strategy you ship has to degrade gracefully across all of them rather than depend on the one that happens to work in your test harness. Budget for the pipeline audit — where content enters, where it is transformed, where it leaves — because that inventory is the deliverable, and most organisations doing serious AI implementation discover they have four or five generation paths rather than one.

One relief in the final guidelines: the trigger is the date of generation. Content produced before 2 August 2026 does not need retroactive marking. You do not have to go back through the archive.

The deferral that is narrower than it looks#

The Omnibus moved the high-risk dates, added regulatory exemptions for smaller companies, postponed the sandbox establishment deadline to 2 August 2027, and added an Article 5 prohibition on generating non-consensual intimate content and child sexual abuse material — with a transitional period ending 2 December 2026, and a scope that reaches systems where such generation is a reasonably foreseeable and reproducible outcome without significant technical modification. That is a capability-level test, not an intent test. If your image stack can be trivially steered there, the prohibition is your problem.

And there is a second 2 December 2026 date that gets lost in the coverage. Generative systems placed on the market before 2 August 2026 got a four-month grace period on the Article 50(2) machine-readable marking obligation, expiring 2 December 2026. Almost every model in production today was placed on the market before 2 August 2026. So the practical deadline for most teams is not 2027 — it is four months from now.

Build the high-risk controls anyway#

The argument for continuing the deferred workstream is not regulatory hedging. It is that the artifacts are the same ones you need to run the system.

Eval logs, model and dataset lineage, human-in-the-loop decision records, post-market monitoring, incident channels — that list reads like a conformity assessment checklist and it also reads like the answer to “why did the model behave differently last Tuesday?” A team that cannot reconstruct which model version, which prompt template, and which retrieved documents produced a given output cannot debug its own product, regardless of what the Official Journal says. Well-built Data Platforms already carry most of this: lineage through the warehouse, versioned feature and document stores, evaluation results as first-class tables rather than notebook output. The compliance layer is a view over infrastructure you should own anyway.

The same logic applies to Operational Automation. The moment an automated workflow starts generating outbound content or making consequential decisions without a human in the path, the marking, logging, and review-record requirements land on it. Retrofitting that into an automation stack that was built to be fire-and-forget is expensive. Building it in while the pipeline is still small is not.

Sixteen months of slack is enough time to do this deliberately instead of in a panic. It is also exactly enough time for the work to be quietly descoped and then rediscovered in mid-2027. For more on how the enforcement architecture came together, see our earlier piece on EU AI Act enforcement in 2026.

---

Transparency is a build requirement now, and the December deadline is closer than the one everyone is talking about. Talk to us about auditing your generation paths and wiring marking, provenance, and eval logging into the pipeline rather than around it.