The European Commission published its final implementation guidelines for Article 50 of the EU AI Act on July 20, 2026, giving providers and deployers precisely 12 days to build compliance before enforcement powers switch on August 2.

The compressed runway is characteristic of Brussels regulatory choreography, where interpretive clarity arrives just late enough to eliminate the option of delay. Providers must engineer chatbot disclosures and machine-readable watermarks into AI-generated outputs. Deployers carry the second-order duties: labelling deepfakes, flagging AI-generated content on matters of public interest that lack human editorial control, and disclosing emotion recognition and biometric categorisation systems to the people subject to them.

Executive Vice-President Henna Virkkunen framed the rulebook around a single citizen-facing principle, that users should “understand when they are interacting with AI.” The Guidelines themselves are binding as interpretation, not voluntary. That distinguishes them from the parallel Code of Practice on Transparency of AI-Generated Content, finalized in June under the AI Office and open for signatories until July 22 at 18:00 CET, with the initial list to be published before August 2.

Systems already circulating before the August cutoff get until December 2, 2026 to meet the labelling and tracking rules. Everything shipped after is in scope on day one.

The practical weight falls hardest on small and mid-size deployers. Firms running outbound and marketing through platforms like Glean, Dust, and LemonLime now sit inside Article 50’s disclosure perimeter whenever those tools touch EU users, no different in principle from the largest model providers. National market surveillance authorities gain enforcement teeth the same day the Commission does.

Twelve days between rulebook and regulator isn’t an oversight. It’s the point.

Sources

Sources