AI Act Transparency Requirements Apply From 2 August 2026. The Bigger Exposure Has Been Live Since February 2025.

The AI Act transparency requirements in Article 50 apply from 2 August 2026. That is the date in every compliance calendar, and it is not the date most companies should be worried about. Article 4 and Article 5 of Regulation (EU) 2024/1689 have applied since 2 February 2025, they reach every AI system a company builds or uses rather than a labelled subset, and Article 5 carries the heaviest penalty tier in the regulation at 35 million euro or 7% of worldwide turnover. Article 50 gives you until 2 August 2026. Articles 4 and 5 stopped giving you time on 2 February 2025.

Article 50 is the deadline that survived the Omnibus intact. Where it sits against the dates that moved is in the AI Act compliance timeline.

The Transparency Duties Split Between Provider and Deployer, and the Split Decides Who Pays

Article 50 sets four disclosure duties. Two belong to the provider who builds or places the system on the market, and two belong to the deployer who puts it in front of people.

An AI policy that says only that the company will label its AI outputs has covered two of the four duties.

On the provider side, Article 50(1) requires that systems intended to interact directly with natural persons are designed so the person knows they are dealing with an AI system, unless that is obvious to someone “reasonably well-informed, observant and circumspect”. Article 50(2) requires that outputs of systems generating synthetic audio, image, video or text are marked in a machine-readable format and detectable as artificially generated. That duty is not confined to general-purpose models. A voice cloner, an image generator and a translation tool with a generative back end all sit inside it, with a carve-out for assistive editing that does not substantially alter the content or its semantics.

On the deployer side, Article 50(3) requires anyone operating an emotion recognition or biometric categorisation system to inform the people exposed to it. Article 50(4) requires deployers who generate or manipulate deepfake image, audio or video content to disclose it, with a lighter regime for evidently artistic, creative, satirical or fictional work, and an exception for AI-generated text published in the public interest where a human has reviewed it and someone holds editorial responsibility. Article 50(5) fixes the timing for all of it. Disclosure has to be clear, distinguishable, and made no later than the first interaction or exposure.

If you licence a model and deploy it, the marking and chatbot duties travel with your supplier. The emotion recognition and deepfake duties stay with you, and no procurement clause moves them.

Systems on the Market Before 2 August 2026 Get Until 2 December 2026. New Ones Mark From Day One.

The Digital Omnibus on AI pushes the machine-readable marking duty in Article 50(2) to 2 December 2026, but only for generative systems already placed on the market before 2 August 2026. Systems launched on or after 2 August 2026 get no transition at all.

Ship in July and you bought four months. Ship in September and you mark from the first output. The extension is shorter than the six months the Commission originally proposed, and it is narrower than most summaries suggest, because it touches Article 50(2) alone. The chatbot duty in 50(1), the emotion recognition duty in 50(3) and the deepfake duty in 50(4) all apply from 2 August 2026 with no grandfathering.

The relief runs to whoever was already selling. A provider with a generative product on the market in July 2026 got four months to build machine-readable marking into it. A competitor launching the same product in September builds it in before the first customer sees an output.

Which raises the question nobody has answered. A model released in 2025 and materially retrained in 2026 is either the same system placed on the market before the cutoff, or a new one that marks from day one, and the difference is four months of engineering. Ask your supplier which position they are taking and get it in writing, because it is their classification that lands on your outputs.

The Omnibus Is Now Law. Regulation (EU) 2026/1744 Was Published on 24 July 2026 and Applies From 27 July.

Every postponed date in this article is binding. The Digital Omnibus on AI was published in the Official Journal on 24 July 2026 as Regulation (EU) 2026/1744 and entered into force on 27 July 2026, the third day after publication rather than the usual twenty, because the general application date it amends falls on 2 August and the legislator moved “as a matter of urgency” to beat it.

It came down to the wire. The Commission proposed it on 19 November 2025, political agreement came on 6 and 7 May 2026, Parliament approved it on 16 June 2026 by 423 votes to 57 with 174 abstentions, and the Council gave final approval on 29 June 2026. The final act was signed on 8 July 2026, and it reached the Official Journal on 24 July, nine days before the deadline it existed to move. A regulation whose whole purpose was to shift 2 August 2026 needed to be in force by 2 August 2026 to do it, and it made that date with a compressed entry-into-force clause and little else to spare. We keep the dates that survived the redraft in the EU compliance deadline tracker.

The rest of what the Omnibus does is now in force with it. Standalone Annex III high-risk obligations move to 2 December 2027 and embedded Annex I systems to 2 August 2028, and the final text dropped the standards-readiness trigger the Commission had proposed, so those are fixed calendar dates that cannot slip again without fresh legislation. A new Article 5 prohibition on AI systems generating non-consensual intimate imagery and child sexual abuse material applies from 2 December 2026. The published text carries its own article numbering after legal-linguistic revision, so check the citation against the consolidated regulation before quoting a sub-paragraph in a filing.

Article 4 and Article 5 Have Applied Since 2 February 2025 and Sit in the 35 Million Euro Tier

Article 4 (AI literacy) and Article 5 (prohibited practices) have applied since 2 February 2025, per Article 113. Breaches of Article 5 attract fines of up to 35,000,000 euro or 7% of total worldwide annual turnover for the preceding financial year, whichever is higher, per Article 99(3). Penalty powers under Chapter XII have been available to national authorities since 2 August 2025.

This is where a 200-person company is most exposed, and it has nothing to do with labelling chatbots. Article 4 applies to providers and deployers alike, covers staff and “other persons dealing with the operation and use of AI systems on their behalf”, which pulls in contractors, and attaches to every AI system rather than to high-risk ones. The Commission’s AI literacy FAQ is the working reference. The Omnibus softened the wording to supporting and facilitating literacy rather than guaranteeing a level, which helps.

The reason to care is not the fine. A company that never bought business licences has staff pasting draft contracts and customer records into free consumer accounts, and the resulting exposure is a GDPR problem that an Article 4 training record would have prevented. The AI Act asks whether you trained your people. Your data protection authority asks where the personal data went, and those two questions have the same root cause.

Article 5 lists eight prohibitions. Most of them describe practices an ordinary employer will not encounter. Untargeted facial scraping, predictive policing by profiling alone, social scoring, real-time remote biometric identification for law enforcement. Two reach into ordinary corporate systems. Article 5(1)(f) bans emotion recognition in the workplace and in education, and Article 5(1)(g) bans biometric categorisation used to infer race, political opinion, religious belief or sexual orientation.

A sentiment analysis feature bolted onto an HR platform has been prohibited since 2 February 2025, and it sits in the same fine bracket as social scoring.

Article 50 Breaches Sit in the 15 Million Euro Tier, and SMEs Are Capped at the Lower Figure

Transparency failures fall under Article 99(4), which sets fines of up to 15,000,000 euro or 3% of total worldwide annual turnover, whichever is higher. Supplying false, incomplete or misleading information to authorities falls under Article 99(5), at 7,500,000 euro or 1%.

Two numbers in wide circulation are wrong. Several published summaries print 1.5% for the information tier and 6% for the prohibited practices tier. The regulation says 1% and 7%. If your risk register was built from a secondary source, those are the two cells to check.

Article 99(6) then inverts the structure for small and medium enterprises, including start-ups, for whom each fine is capped at whichever of the amount or the percentage is lower. A start-up with 2 million euro of turnover faces a theoretical maximum of 140,000 euro under Article 99(3), not 35 million. In our assessment that is the provision that decides whether the number in your board pack survives contact with anyone who has read the Act.

The Commission’s Draft Article 50 Guidelines Run to Around 40 Pages and Bind Nobody

The Commission published draft guidelines on Article 50 through the AI Office on 8 May 2026, running to roughly 40 pages, with a consultation that closed on 3 June 2026. They are interpretive. They do not bind a court, and only the Court of Justice gives an authoritative reading of the Act.

They do settle one question worth money. Content generated and put into the information ecosystem before 2 August 2026 does not have to be marked or labelled retrospectively, so the marking duty runs forward from the application date rather than reaching back across everything a system produced. Beyond that, guidelines are the best available signal of how the AI Office reads the marking and disclosure duties, and they are the document a supervisory authority will have read. Our read is that following them is a defensible position and departing from them is one you should be able to explain in writing. Neither is a safe harbour. A separate Code of Practice on marking AI-generated content is where the technical detail behind Article 50(2) is being settled, on the same non-binding footing.

Article 50 Applies Whatever Your Risk Classification

Article 50 attaches to what a system does, not to where it sits in the risk pyramid. A minimal-risk customer chatbot and a high-risk recruitment tool both fall under it if they interact with people or generate synthetic content.

The inverse is true and worth stating before anyone starts writing policy. If you neither provide nor deploy a system that interacts directly with natural persons, generates synthetic audio, image, video or text, recognises emotion, categorises people biometrically or produces deepfakes, Article 50 does not reach you. Article 4 still does, because it applies to any use of any AI system.

One classification duty survived the Omnibus intact. Under Article 6(4), a provider who concludes that an Annex III system is not high-risk must document that assessment before placing the system on the market, and under Article 49(2) must register itself and the system in the public EU database anyway. The Commission proposed deleting this. Council and Parliament refused, and it stands with only the submitted information trimmed. Deciding you are not high-risk is still paperwork, filed publicly, and our read is that the drafters wanted exactly that friction. The AI Act Risk Classifier runs the Annex I and Annex III tests that put a system on one side of that line or the other.

The Work That Does Not Depend on a Deadline

Nothing in the transparency regime rewards waiting. The duties in force today, and the inventory work underneath them, are the same work whether the next high-risk date is fourteen months away or two.

Start with the population. List every AI system you build, deploy or procure, and flag the ones that interact directly with people or generate synthetic audio, image, video or text. That flagged set is your Article 50 exposure, and the risk classifier sorts the remainder against Annex I and Annex III.

The Article 5 sweep is narrower and more urgent than a full inventory. HR, recruitment, workplace monitoring, training platforms. Emotion recognition in those settings has been prohibited since 2 February 2025 and carries the 7% tier.

The Article 4 record is the third piece, and it has to cover the period from 2 February 2025 to be worth anything when an authority asks for it. The shadow AI audit belongs in the same exercise, because unlicensed consumer accounts are where the untrained staff and the leaked contracts meet.

Launch dates decide the marking question. Anything generative placed on the market on or after 2 August 2026 marks its output from day one. Anything already on the market has until 2 December 2026.

Contracts close the loop. Articles 50(1) and 50(2) sit with the provider. Articles 50(3) and 50(4) sit with the deployer, and that is you.