Article 50 of the EU AI Act — the transparency chapter — has applied since 2 August 2026. The Annex III high-risk obligations were deferred to 2 December 2027 by the Digital Omnibus, and product-embedded Annex I systems to 2 August 2028. If you ship a chatbot, a generative feature, a voice agent or anything that emits synthetic media to EU users — wherever you are incorporated — the live work is disclosure UI and output metadata, not a governance programme.

This is engineering guidance, not legal advice. Each section gives the obligation, what you build, and how you test it.

What EU AI Act obligations are in force in 2026, and what moved to 2027?

Two things matter. First, Article 50 was left out of the deferral — Goodwin titled its August 2026 alert "Not Delayed, Not Deferred" because many teams assumed the Omnibus bought them time it did not. Second, the only relief inside Article 50 is a four-month runway on the provider marking duty under 50(2), expiring 2 December 2026 and covering only generative systems on the market before 2 August 2026 (Morgan Lewis, Gibson Dunn). Deployer duties got no transition.

Enforcement is uneven: as of March 2026 only 8 of 27 member states had notified the Commission of a single point of contact, against an August 2025 deadline (European Parliamentary Research Service). That is not breathing room: Article 50 compliance is visible in a screenshot, so procurement questionnaires check it long before a market surveillance authority does.

How do you disclose that a user is interacting with an AI system?

The obligation (Art. 50(1), 50(5)). Providers of systems that interact directly with people must inform them they are dealing with an AI system, unless that is obvious. Disclosure must land at or before first interaction, be clearly distinguishable, and be accessible.

What you build.

• A persistent, non-dismissible disclosure inside the chat surface — not a cookie banner, not the ToS. The widget header or opening assistant turn works; a modal the user clicks past fails on every returning session.
• For voice agents, a spoken disclosure in the opening turn, in the call's language. A follow-up email is not equivalent.
• Coverage on every entry point: web widget, mobile SDK, embedded iframe, WhatsApp/SMS, partner white-label. Entry points added after launch are the most common gap.
• Accessible markup, because 50(5) requires it: real DOM node, programmatic association with the conversation region, sufficient contrast. Same surface as our

How you test it. One Playwright assertion per channel: the disclosure node is visible before the first user-input event fires. Snapshot every locale, then repeat with a warm session — where modal-only implementations break.

How do you label AI-generated content under Article 50?

The obligation (Art. 50(2)). Providers of generative systems must mark synthetic audio, image, video and text in a machine-readable format detectable as artificially generated. Assistive editing (grammar correction, filters) is out of scope.

The Commission's Code of Practice on Transparency of AI-generated Content, published 10 June 2026 with roughly 190 signatories by late July (European Commission), is voluntary but documents which state of the art you followed. It names no standard, so C2PA is the de facto answer, not the mandated one.

What you build.

1. Provenance at the generation boundary. Sign a C2PA-style manifest where your inference gateway returns bytes — not in the upload path, not in the CMS. Downstream consumers inherit it, which makes this a gateway problem, not a rewrite (API-first AI integration playbook).
2. A strip-resistant fallback. Metadata dies to screenshots; pair the manifest with an invisible watermark so detection survives re-encoding.
3. Text marking. The weakest surface. Baseline: emit a marker in the delivery envelope (HTTP header, JSON field, document metadata) and log the generation event. Statistical text watermarking is not settled — do not build as if it is.
4. A detection endpoint. A hash-plus-manifest lookup keyed on generation ID, so support can answer "did we generate this?"

How you test it. Round-trip a fixture asset through your real delivery pipeline — CDN transform, thumbnails, mobile compression — and assert the manifest still validates. Most teams pass in staging and fail in production because one resize step drops metadata. Make it a CI check.

What do deepfake and emotion-recognition disclosures require in code?

Deepfakes (Art. 50(4)). Deployers publishing AI-generated or manipulated image, audio or video resembling real people, places or events must disclose it; artistic or evidently fictional works get a reduced disclosure. In build terms: a visible label in the asset's own surface — an overlay or caption — not alt text or metadata alone. Model it as a CMS content-type flag that renders the label automatically, using the EU icon set, so an editor cannot forget it.

Public-interest AI text (Art. 50(4)). Disclose AI-written text published to inform the public on matters of public interest, unless a human took editorial responsibility through substantive review. Build the exemption as auditable state: a reviewedBy field with identity and timestamp gating publication.

Emotion recognition and biometric categorisation (Art. 50(3)). Deployers must inform exposed individuals before processing. Check Article 5 first: workplace and education use is prohibited, not merely disclosable. Outside the ban — sentiment scoring on support calls — you need a notice in the interaction flow before inference runs, plus an event log proving it fired.

Does the EU AI Act apply to US companies?

Yes, in most cases. Article 2 applies the Regulation to providers placing AI systems on the Union market irrespective of establishment, and to providers and deployers outside the EU where the output produced by the system is used in the Union. Delaware incorporation is not a defence.

Run this decision path:

1. Can a person in the EU reach the feature? If you do not geo-block, assume yes.
2. Does it interact directly with people or generate synthetic content? If yes, 50(1) and/or 50(2) apply to you as provider.
3. Are you deploying someone else's model into an EU-facing surface? Deployer duties under 50(3) and 50(4) still land on you; a model API does not transfer them.
4. Is the output consumed in the EU? Reports, images or summaries generated in the US and read in Frankfurt pull you into scope.

The only exits are enforced geo-blocking and purely personal use. Neither describes a B2B SaaS product.

What high-risk work should you start now, before December 2027?

Four obligations have long lead times because they change your architecture, not your paperwork:

• Automatic logging (Art. 12). High-risk systems must record events. Retrofitting immutable, queryable inference logs — input, model version, config, timestamp, output, human override — into a system with only application logs is a quarter of work. Design the schema now.
• Data governance (Art. 10). Dataset lineage, bias examination, representativeness records. If you cannot answer "which data version produced this model version?", that is an engineering gap, not a documentation gap.
• Evaluation records (Art. 15). Accuracy, robustness and cybersecurity evidence means versioned eval suites with retained results, not a spreadsheet from launch week — our AI agent testing and QA strategy guide covers the harness.
• Human oversight (Art. 14). UI for a person to intervene, override or stop the system — long design cycles that cannot be bolted on in the final sprint.

What can wait: conformity assessment paperwork, the quality management system, CE marking, and anything downstream of harmonised standards, which are still not finalised. CEN-CENELEC deliverables have slipped repeatedly, and documenting against an unpublished standard is wasted effort. Build the capability now; write the documents when the standard lands.

What does an EU AI Act remediation backlog look like?

Lift this straight into your tracker:

• Inventory every EU-reachable surface that interacts with users or emits model output; classify your role on each as provider, deployer, or both.
• Ship persistent AI-interaction disclosure on every entry point, in every locale, for returning sessions.
• Make disclosure text accessible: real DOM node, programmatic label, contrast.
• Sign C2PA-style manifests at the inference gateway for image, audio and video; add invisible watermarking as the strip-resistant fallback.
• Emit machine-readable markers for generated text; log every generation event.
• CI test: provenance survives the production media pipeline (resize, transcode, CDN transform).
• Auto-render visible deepfake labels from a CMS content-type flag; gate public-interest AI text on an auditable human-review field.
• Pre-processing notice plus audit event for emotion-recognition features; check the Art. 5 prohibitions first.
• 2 December 2026: provider marking grace period ends for generative systems on the market before 2 August 2026.
• Start the Art. 12 inference-log schema and Art. 10 dataset lineage if Annex III is plausible.
• Publish a transparency page listing systems, roles and marking methods.

On a mid-size product this is two to four sprints, dominated by the provenance pipeline — budget it alongside the other AI build-and-run costs.

FAQ

Was the EU AI Act delayed?

Partly. The Digital Omnibus deferred Annex III high-risk obligations to 2 December 2027 and Annex I systems to 2 August 2028. Article 50 and the Article 5 prohibitions are in force now.

What is the deadline for marking AI-generated content?

2 August 2026 for systems placed on the market from that date. Systems already on the market before then have until 2 December 2026 to meet the Article 50(2) machine-readable marking duty. Deployer duties under 50(4) got no grace period.

Do I have to use C2PA to comply with Article 50?

No. The AI Act and the Code of Practice describe outcomes — effective, interoperable, robust marking — without naming a standard. C2PA plus an invisible watermark is the most defensible option today, not a legal requirement.

Does a disclosure in our terms of service satisfy Article 50(1)?

No. Article 50(5) requires disclosure at or before first interaction, clearly presented. A ToS clause, cookie banner or one-time onboarding modal all fail for returning users. Put it in the interaction surface.

Are we the provider or the deployer if we build on OpenAI or Anthropic?

Usually both. You are a deployer of the model and a provider of the system built on it, so the 50(1) disclosure and 50(2) marking duties for your output land on you, not your vendor.

What happens if we miss Article 50?

Fines reach €15 million or 3% of worldwide turnover, whichever is higher. The nearer-term pressure is commercial: procurement questionnaires ask for this evidence, and the artefacts are visible in your product.

Need this shipped rather than summarised?

We do this remediation work: scoping which surfaces are in scope, retrofitting disclosure and C2PA provenance into production products, and standing up the inference logging and eval records the December 2027 window needs. If you need the sprint plan, get in touch.