The European Commission published its final Article 50 guidelines on July 20, giving businesses six days before the AI Act’s transparency regime applies across the EU on August 2. Providers must tell users when they’re interacting with an AI system and mark generated or manipulated outputs in a machine-readable format. Deployers must disclose deepfakes and label AI-generated text on matters of public interest, unless the content passed through human editorial review. Fines run up to €15 million or 3% of worldwide turnover, whichever is higher.

“citizens know when they are interacting with AI,” said Henna Virkkunen, the Commission’s executive vice-president for tech sovereignty, describing the regime’s animating principle.

Article 50 is the AI Act’s first live enforcement test. High-risk provisions were pushed to December 2027 under the Digital Omnibus, a 16-month delay Jones Walker calls “a reprieve rather than a repeal.” National surveillance authorities take the lead from Sunday.

Alston & Bird notes the guidelines are non-binding but “provide authoritative insight” into how Brussels expects Article 50 implemented. The Code of Practice, signed June 10, specifies digitally signed metadata, imperceptible watermarking, fingerprinting, and logging as acceptable marking techniques. Signatories carry a presumption of conformity; everyone else faces full national enforcement. Systems already on the market before August 2 get a grace period to December 2, 2026 for content-marking.

The scope reaches further than most SMBs realize. Per Data Protection Report, any business branding its own chatbot is a “provider” under the Act, which sweeps in operators running no-code platforms like Glean, Dust, and LemonLime.

Brussels has consistently preferred process to prohibition. August 2 is the moment that preference acquires teeth.

Sources

Sources