If you run a chatbot, publish AI-generated content, or use AI tools that touch anyone in the EU, a new legal obligation quietly kicked in on August 2, 2026 — and most companies outside Europe still don’t know it applies to them.
What Actually Changed on August 2
Article 50 of the EU AI Act moved from “law on paper” to “enforced rule,” and the European Commission’s AI Office began enforcement the same day. The obligation is straightforward to state and much harder to implement cleanly: AI systems have to tell people they’re dealing with a machine, and AI-generated content — images, audio, video, text — has to be labeled as such. The European Commission adopted its final guidelines on July 20, just under two weeks before enforcement began, and confirmed a voluntary Code of Practice on Transparency of AI-Generated Content as an adequate path to compliance.
Four separate scenarios are covered, each with its own disclosure duty: interactive AI systems (chatbots) must disclose they’re AI, not human. Synthetic content has to be marked as AI-generated. Emotion-recognition and biometric-categorization systems have to inform anyone exposed to them. And deepfakes — AI-edited or AI-generated images, video, or audio — require disclosure that the content has been artificially generated or manipulated.
Who’s Actually On the Hook
This is the detail most non-EU companies are underestimating: the rules apply to any provider or deployer whose AI systems serve EU users, regardless of where the company is headquartered. A business doesn’t need to build AI to have obligations under Article 50 — simply operating a chatbot on a website, publishing AI-generated marketing content, or using a coding assistant in certain contexts can trigger disclosure duties. The obligations split between two roles: providers (companies that build and place an AI system on the market) and deployers (companies that use that system under their own authority) — and both can carry separate responsibilities for the same piece of AI.
The US has no equivalent federal law yet, though a handful of states regulate AI and deepfakes individually. For any American company with EU users or customers, this is genuinely new legal exposure, not a theoretical one.
The Penalty Number That Should Get Attention
Non-compliance carries fines up to €15 million (roughly $16 million) or 3% of total worldwide annual turnover, whichever is higher — with a lower threshold specifically for SMEs and startups. “Whichever is higher” is the detail that matters for large companies: 3% of global revenue scales the penalty to company size, meaning this isn’t a fixed cost a large tech company can shrug off as a rounding error the way smaller flat fines sometimes get treated.
Not Everything Is Live Yet — There’s a Real Grace Period
It’s worth being precise here, because the rollout isn’t a single hard cutover. The disclosure duty for chatbots and deepfakes applies now, as of August 2. But the machine-readable marking requirement — the invisible, technical layer that lets platforms automatically detect AI-generated content at scale — has a transitional period until December 2, 2026, specifically for generative AI systems that were already on the market before August 2. That’s a meaningful distinction: a visible label (“this is AI-generated”) is required now; the invisible, automatically-detectable watermarking infrastructure gets a few extra months to be built out properly.
Content generated before August 2 doesn’t need retroactive labeling either — the date of generation is what determines the obligation, not the date someone views it.
Two Kinds of Labels, and Only One Is Solved
The transparency requirement actually splits into two distinct technical problems, and only one of them has a clear answer right now. Visible labeling — a chatbot stating outright that it’s AI, or a video carrying an on-screen disclosure — is relatively simple to implement and is the piece companies are expected to have in place already. Invisible labeling — a machine-readable marker embedded directly in a file so platforms and detection tools can identify AI origin automatically, even if a human viewer never sees an explicit label — is the harder, still-being-standardized piece, which is exactly why it got the extended December deadline. The Commission’s guidelines recommend combining formats: plain-language visible notices, audio cues for voice interfaces, and persistent visual indicators, particularly stringent when children or other vulnerable groups are involved.
One detail worth flagging for any company using multiple AI tools or platforms: automated AI labels applied by a platform don’t relieve the underlying operator of its own separate disclosure obligation. If a company uses a third-party AI tool that already labels its output, that doesn’t automatically satisfy the company’s own duty to disclose — platform-level labels can complement an operator’s disclosure, but they can’t substitute for it.
Why This Rule Exists in the First Place
Strip away the compliance mechanics, and the underlying goal is fairly simple: for years, researchers and regulators have pushed for clear labeling so people can recognize when they’re interacting with an AI system rather than a human being, and when the content in front of them was AI-generated or manipulated rather than authentic. As deepfakes and AI-written content have become harder to distinguish from the real thing by eye, the EU’s bet is that a legal disclosure requirement — backed by real financial penalties — does more to preserve that distinction than relying on voluntary good practice alone.
What Companies Should Actually Be Doing Right Now
Legal guidance circulating since the Commission’s July 20 guidelines converges on a similar checklist: identify which AI systems a company provides or deploys, and clarify under whose authority they operate — including situations involving contractors or third-party agencies. Map every AI-driven interaction and content type against the four Article 50 categories (chatbots, synthetic content, emotion/biometric systems, deepfakes). Implement disclosure and labeling procedures, and formally decide whether to sign the voluntary Code of Practice, since signatories get a degree of presumption of conformity and a more favorable enforcement posture, while non-signatories face closer scrutiny and a heavier burden to demonstrate compliance through other means.
The Bigger Picture
What makes Article 50 worth watching beyond its immediate compliance burden is what it signals about where AI regulation is heading globally. This is one of the first major, enforced transparency mandates with real financial teeth attached — not guidance, not a voluntary framework, but a binding legal requirement with fines scaled to global revenue. The EU has a track record of its regulations becoming a de facto global baseline (GDPR being the clearest precedent), because it’s often simpler for multinational companies to apply one compliance standard everywhere than to maintain separate systems for EU versus non-EU users.
If that pattern holds here, the practical effect of Article 50 may end up extending well past the EU’s borders — not because other jurisdictions adopted equivalent laws, but because companies built their AI disclosure practices to the EU’s standard by default, and then simply left them in place everywhere else too.