AI Act Transparency Guidelines Land Before 2 August Deadline

The European Commission adopted the final version of its AI Act transparency guidelines on 20 July 2026, thirteen days before the Article 50 transparency obligations start to apply on 2 August 2026. If your company runs a chatbot, generates images, audio or video with AI, or publishes AI-written content to people in the EU, the disclosure duties arrive on 2 August. The Digital Omnibus delayed the high-risk regime by more than a year. It did not touch these.

That gap is where most of the confusion sits right now. Boards heard “the AI Act has been delayed” and quietly stood their programmes down. Article 50 is not a high-risk obligation. It is a horizontal transparency layer that applies regardless of risk classification, and it was left exactly where it was.

Article 50 Splits Into Four Duties, Landing on Two Different Actors

Article 50 is not one disclosure rule. It is four, and they attach to providers and deployers separately, which is where over-compliance and under-compliance both start.

Providers carry two duties under the Commission’s guidelines. Systems that interact directly with people must tell those people they are dealing with an AI, at the latest at the first interaction. Systems that generate synthetic audio, image, video or text must mark that output in a machine-readable format so it is detectable as artificially generated. Deployers carry the other two. They must tell people when they are exposed to emotion recognition or biometric categorisation, and they must disclose deepfakes and AI-generated text published on matters of public interest. A visible “virtual assistant” notice or a short spoken line at the start of a call will usually satisfy the interaction duty. Burying it in the terms of service will not.

The Deadline the Digital Omnibus Left Alone

The broad Article 50 duties apply from 2 August 2026, and the Digital Omnibus did not move them. What the Omnibus moved was the high-risk regime: standalone Annex III systems shift to 2 December 2027, and product-embedded Annex I systems to 2 August 2028.

This is the sentence worth forwarding to whoever paused your compliance work in May. The delay everyone read about is real, and it is large, and it has nothing to do with the disclosure duties landing next week. Whether any of your systems is separately classed as high-risk is a different question, and our AI Act Risk Classifier answers that one. Article 50 does not ask it. It asks only whether a person is being exposed to AI without knowing it.

Legacy Generative Systems Get to 2 December 2026

There is one carve-out inside Article 50, and it is narrow. Generative systems already on the market before 2 August 2026 get until 2 December 2026 to meet the machine-readable marking duty under Article 50(2). Systems placed on the market from 2 August onward must comply straight away.

That four-month grace period comes from the Digital Omnibus, which published in the Official Journal on 24 July 2026 as Regulation (EU) 2026/1744 and entered into force on 27 July. The December date is now law and you can rely on it. In our assessment the care belongs on the other half of the rule, because the grace period turns on when a system went on the market rather than on what it does. If a vendor points at December, the question back is which side of 2 August 2026 their system landed on. The Commission originally proposed six months here and the final text settled on four.

The Exemptions Are Real, and They Are Narrower Than They Look

The guidelines carve out genuine exceptions, but they are specific. Standard editing does not trigger the marking duty: fixing grammar, changing format, resizing an image, or technical processing such as medical image reconstruction. Obviously artistic, satirical or fictional work gets a lighter labelling requirement, and the label must not spoil the display of the work.

The exemption that will matter most to communications and PR teams is editorial review. AI-generated text on matters of public interest does not need a label if it went through human review and a named person or organisation takes editorial responsibility for it. There is also no retroactive labelling, and the cut-off works in two different ways. For deepfakes and other synthetic image, audio and video, the relevant date is the date of generation, so anything made before 2 August 2026 is clear. For public-interest text, the relevant date is the date of publication, so text drafted in July but published on 2 August or later still needs its label.

A Breach Can Cost €15 Million or 3% of Worldwide Turnover

Non-compliance with Article 50 sits in the Article 99(4) penalty band: up to €15 million or 3% of total worldwide annual turnover, whichever is higher. That is a lower ceiling than the €35 million reserved for prohibited practices, and still large enough to concentrate a board’s attention.

Enforcement runs through national market surveillance authorities, with the AI Office stepping in where it has exclusive competence and the European Data Protection Supervisor covering EU institutions. Which authority you answer to, and how strict it is, depends on your member state, and designation is still uneven across the Union. The guidelines are non-binding, and only the Court of Justice can give an authoritative reading. In practice, the authorities will follow them. You can size your own exposure across the penalty bands with our AI Act Fines Calculator.

There is a quieter absurdity worth naming. Providers must mark generated content in a machine-readable format from 2 August, yet the technical standards for judging whether a given marking method is good enough are still being written, partly through the very Code of Practice meant to demonstrate compliance. The Commission also missed its own 2 February 2026 deadline for high-risk classification guidance under Article 6. For Article 50 it managed thirteen days of runway.

The Code of Practice Is the Shortcut, Not the Rule

The Code of Practice on Transparency of AI-Generated Content, published on 10 June 2026, is voluntary. Signing it is the cleanest way to prove compliance, not a substitute for the obligation.

The Commission and the AI Board have assessed the Code as an adequate tool. Providers and deployers who sign it can rely on its measures across all member states, which is worth real money in avoided argument. Those who go their own way keep the burden of proving their methods are equivalently effective, and that gets judged individually by each market surveillance authority. The Code covers the marking and labelling duties under Article 50(2), (4) and (5), and the EU has released a set of icons deployers can use.

What Providers and Deployers Face Before 2 August

For providers, the work is technical: build the interaction notice into any system that talks to people, and implement machine-readable marking on any system that generates content. For deployers, the work is procedural: identify every deepfake, every emotion-recognition or biometric-categorisation tool, and every public-interest text your organisation publishes with AI, then attach the disclosure or the editorial-responsibility trail.

The step under everyone’s control, and the one that does not depend on the final standards, is the inventory. Most organisations do not fail Article 50 by hiding their AI. They fail it because no one has mapped where AI actually touches customers, staff or the public. Build that map first, decide who owns technical marking and who owns user notification, then close the gaps against the penalty exposure you are carrying.