Article 50 transparency obligations went live on 2 August 2026 and apply to anyone whose AI output reaches EU users, regardless of where you're based. You must disclose AI chatbots, mark synthetic content, and label deepfakes. The Digital Omnibus delayed high-risk rules to 2027 but did not delay Article 50. Fines reach €15 million or 3% of global turnover.
A lot of people read the headlines about the EU delaying its AI rules and quietly moved compliance down their to-do list. That was a costly misread. The Digital Omnibus package pushed the high-risk system deadline out to December 2027, but it deliberately left Article 50 transparency obligations on the original timeline, meaning they became enforceable on 2 August 2026 and are live right now.
The Cloud Security Alliance put it bluntly in its July 2026 research note: organisations that extended the "delay" assumption to transparency obligations are now out of compliance rather than merely behind schedule. This guide covers what Article 50 actually asks of creators and small businesses, who it applies to, and what to do about it.
**Note:** This is general information, not legal advice. Consult qualified counsel for your specific compliance decisions.
Does the EU AI Act Actually Apply to You?
Probably, and this catches people out. The AI Act has extraterritorial scope: it applies to providers, deployers, importers and distributors who place AI systems on the EU market, or whose AI outputs are used within the European Union.
That last clause is the wide one. If you're a creator in India, the US, or anywhere else, and your AI-generated content is viewed by people in the EU, the regulation can reach you. Where your company is registered doesn't determine whether the rules apply.
For most independent creators and small businesses, this isn't about building AI systems. It's about using them, and the obligations that come with putting AI-generated output in front of an EU audience.
Are You a "Provider" or a "Deployer"?
The AI Act splits obligations between these two roles, and the distinction decides what you're actually responsible for.
A provider develops an AI system and places it on the market under its own name. If you're building and selling an AI tool, that's you. Most creators and small businesses are not providers.
A deployer uses an AI system under its own authority. A creator generating video with a commercial AI tool, a small business running an AI chatbot on its website, an agency producing AI images for clients, all deployers. Deployer obligations under Article 50 are narrower than provider obligations, but they're real, and they include labelling deepfakes and disclosing AI-generated public-interest text.
What Exactly Does Article 50 Require?
Article 50 covers four distinct situations, and you only need to worry about the ones you actually touch.
First, AI systems that interact directly with people, chatbots and voice assistants, must be designed so users are explicitly informed they're dealing with an AI, unless it's obvious from context.
Second, providers of generative AI must mark synthetic output in a machine-readable format so it can be detected as artificially generated. This is the technical watermarking and metadata obligation, and it sits mostly on the tool builders rather than on you.
Third, deployers of emotion-recognition or biometric categorisation systems must inform the people exposed to them.
Fourth, and most relevant to creators: deployers who generate or manipulate deepfake content must disclose that it's artificially generated, and those publishing AI-generated text on matters of public interest must disclose it too, unless the content went through human editorial review with someone holding editorial responsibility.
Didn't the Digital Omnibus Delay All of This?
No, and this is the single most expensive misunderstanding circulating right now. Regulation (EU) 2026/1744, the Digital Omnibus on AI, is in force and it did move deadlines, but selectively.
What moved: the Annex III high-risk system deadline shifted to 2 December 2027, and Annex I product-embedded systems to 2 August 2028.
What did not move: Article 50 transparency obligations, general-purpose AI model obligations, and the Article 5 prohibited-practices regime all stayed on their original timelines. Article 50 was specifically left out of the deferral.
If your compliance planning treated "the EU delayed the AI Act" as a blanket statement, that assumption has a real cost attached. The transparency duties have been enforceable since August.
What's the Grace Period, and What's Already Overdue?
There is one narrow grace period, and it's easy to over-apply. AI systems already placed on the market before 2 August 2026 get until 2 December 2026 to meet the machine-readable marking requirement under Article 50(2) specifically. Nothing else in Article 50 carries that extension.
Content generated before 2 August 2026 does not need to be labelled retroactively, though the Commission encourages doing so where practical.
Everything else, chatbot disclosure, deepfake labelling, public-interest text disclosure, has applied since 2 August 2026 with no grace period at all.
Should You Sign the Code of Practice?
The AI Office published a voluntary Code of Practice on Transparency of AI-Generated Content, focused on the marking and labelling obligations. It includes a standard icon set for labelling AI-generated content, and several major AI providers have already signed.
Signing carries a practical benefit: signatories get a degree of presumption of conformity and a more favourable enforcement posture. Non-signatories face closer scrutiny and have to demonstrate compliance through alternative means.
For most independent creators this is less relevant, it's aimed primarily at providers rather than individual deployers. But if you're building or distributing an AI tool, it's worth evaluating seriously rather than ignoring as optional paperwork.
What Are the Actual Penalties?
Non-compliance with Article 50 can trigger fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher. Enforcement falls mainly to national market surveillance authorities in each member state rather than a single central EU regulator.
Realistically, a solo creator is not the first enforcement target, regulators tend to start with platforms and large providers. But "unlikely to be first" is not the same as "exempt," and the practical compliance steps below cost very little to implement.
What Should a Creator or Small Business Actually Do?
Start by mapping where AI actually shows up in what you publish, generated images, AI voiceovers, synthetic video, AI-written copy, chatbots on your site. Most people underestimate this list on the first pass.
Label AI-generated visual and audio content clearly and visibly wherever it reaches an audience. Use the platform's own AI disclosure toggle where one exists, since that handles part of the machine-readable requirement for you.
If you run a customer-facing chatbot, make sure it states plainly that it's an AI at the start of the interaction, rather than relying on users to infer it.
If you publish AI-generated text on matters of public interest, news, politics, health, disclose it, unless a named human has genuinely reviewed it and taken editorial responsibility. That editorial-review exception is real, but it requires an actual person accountable for the content, not a token glance.
What Deadlines Are Still Ahead?
Two December 2026 brings the machine-readable marking deadline for pre-existing systems, plus a set of new prohibited-practice provisions.
Two December 2027 is the Annex III high-risk system deadline, the one the Omnibus moved. If you use AI in hiring, credit scoring, education assessment or similar, this is the date that matters to you.
Two August 2028 covers Annex I product-embedded AI systems.
Quick Verdict
For most creators and small businesses, EU AI Act compliance in 2026 comes down to one habit: disclose AI clearly, everywhere it reaches an audience. That covers the bulk of what Article 50 asks of deployers. The bigger risk right now isn't the rules themselves, it's the widespread belief that the Digital Omnibus delayed them, which it did not for transparency obligations.
Frequently Asked Questions
Does the EU AI Act apply to me if I'm not based in the EU?
Yes, potentially. The regulation applies to anyone placing AI systems on the EU market or whose AI outputs are used within the EU, regardless of where the business is registered.
Did the Digital Omnibus delay the EU AI Act?
Only partly. It moved the Annex III high-risk deadline to December 2027 and Annex I to August 2028, but Article 50 transparency obligations, GPAI obligations and prohibited practices all stayed on their original timelines.
When did Article 50 take effect?
2 August 2026. A limited grace period until 2 December 2026 applies only to the machine-readable marking requirement for systems already on the market before that date.
Do I need to label AI content I published before August 2026?
No, retroactive labelling isn't required, though the European Commission encourages it where practical.
What are the fines for non-compliance with Article 50?
Up to €15 million or 3% of worldwide annual turnover, whichever is higher, enforced primarily by national market surveillance authorities.
