What happened today
The AI Act — Regulation (EU) 2024/1689 — became applicable on 2 August 2026, with a few exceptions, and the Commission's 31 July statement named this day as the start of enforcement of the rules and the new transparency requirements. Obligations for general-purpose models and the governance rules have been in force for a year, since 2 August 2025; what changed today is enforcement and transparency.
Enforcement runs through national authorities, so the practical detail differs by country: Hungary brought two sections of its implementing act into force on this same day, while Spain's own governance bill is still going through parliament. Either way, the obligations in the Regulation apply to you from today — they do not wait for national law.
Which role are you in? Everything follows from this
Article 50 places duties on two different actors, and the vast majority of small businesses fall into only one of them. Get this wrong and you will chase an obligation that isn't yours — while missing the one that is.
Did YOU build or place on the market
the AI system that makes the content?
│
├── YES -> you are the PROVIDER.
│ Machine-readable marking
│ is on you as well.
│
└── NO, I just use a finished tool
(image, text, audio, chatbot)
│
└── you are the DEPLOYER.
The VISIBLE disclosure
is on you; the machine-
readable marking is NOT.
Anyone making a banner with an off-the-shelf image generator, text with an off-the-shelf model, or a customer-service chatbot on an existing platform is a deployer. Machine-readable marking — the invisible watermark, the metadata — has to be built in by the provider who offers the tool. Your job is what the reader can see.
The four obligations, one by one
| What the Regulation requires | Who it applies to | What it means in practice |
|---|---|---|
| Article 50(1) — people must know they are talking to an AI | provider (in how the system is designed) | A chatbot or voice assistant has to make clear at the start of the interaction that it is not a human. Exception: where this is obvious from the circumstances. |
| Article 50(2) — outputs must be marked in a machine-readable format | provider | An invisible watermark or metadata that is "effective, interoperable, robust and reliable". Exception: assistive editing functions, and where the system does not substantially alter the input. |
| Article 50(4), first limb — deep fakes must be disclosed | deployer | If image, audio or video content is an artificially generated or manipulated deep fake, that has to be disclosed. For artistic, creative or satirical work it is enough to disclose its existence, in a way that does not spoil the enjoyment of the work. |
| Article 50(4), second limb — AI-generated text on public-interest matters must be disclosed | deployer | This covers only text published for the purpose of informing the public on matters of public interest. Exception: where the text underwent human editorial review and a person or organisation holds editorial responsibility for it. |
The gap between paragraphs 2 and 4 is the most important sentence in this article: invisible, machine-level marking is not the deployer's obligation. If your image generator puts no watermark in the file, that is not your breach — but the visible disclosure is still yours, even when the tool marked nothing at all.
The part most people get wrong: marketing copy
The text-disclosure limb is narrow: the Regulation attaches it to text published for the purpose of informing the public on matters of public interest. A product description, a newsletter, a social post about your own service is not that — commercial communication is not public-interest information. So the Regulation does not require you to add a note under every piece of AI-written marketing copy.
Two things do fall in scope, though. One is the chatbot: under Article 50(1) the customer has to be told at the first interaction that they are talking to a machine, and it is worth being careful with the "obvious" exception — if the interface shows a human name and a photo, that suggests the opposite. The other is deep fakes: if you generate or manipulate image, audio or video content depicting a real person or a real event, that falls under paragraph 4 regardless of whether the purpose is marketing.
This is not legal advice, and in borderline cases — whether an industry analysis counts as "informing the public on matters of public interest", say — it is worth having a lawyer read it. The direction, however, is plain from the text.
The transition period, and what it does not cover
There is a transitional window: for systems already on the market it runs until 2 December 2026. Two misreadings attach to it, and both can be expensive:
- It is not a general postponement. The transition covers machine-readable marking and systems already placed on the market — not the idea that you need not disclose a deep fake until December.
- There is no retroactive labelling. Content you published earlier does not have to be marked after the fact.
In the same month, on 2 December 2026, a new prohibition takes effect as well: generating non-consensual intimate imagery and child sexual abuse material with AI. That is not a transparency question but a prohibited practice.
If you want practical guidance for disclosure, the two most useful sources are the Commission's final guidelines on Article 50 and the code of practice published on 10 June 2026, which treats provider and deployer duties in separate sections and is reviewed every two years. Spain's supervisory agency has also issued its own Spanish-language question-and-answer set on it, including points on how a label should be designed.
What the fine is — and why SMEs get a different rule
A breach of Article 50 falls into the band in Article 99(4): EUR 15 000 000 or 3% of total worldwide annual turnover, whichever is higher. Member States convert and apply these bands through their own implementing rules, so the figure you will actually see quoted in your country comes from national law — in Hungary, for instance, the band matching Article 50 works out at 5.7 billion forints.
And here is the detail that drops out of almost every summary, even though it applies to the vast majority of readers of this blog: under Article 99(6), for SMEs including start-ups the ceiling is the lower of the two. Not the higher of EUR 15 million and 3%, but the lower. For a company with a few hundred thousand euros of turnover that is a different order of magnitude — not a reason to relax, but a reason not to size up your real exposure from a headline.
Supervision sits with national authorities. In Hungary the market surveillance authority operates, by its own description, "as an organisational unit of the Ministry of Science and Technology", and it accepts complaints and public-interest reports. In Spain the same role belongs to AESIA, the supervisory agency that published the Article 50 guidance mentioned above.
What to do now
Four steps, a few hours in total:
- List every place where AI-made content reaches the public. Website, social channels, newsletter, customer service, video, audio. Internal material that never leaves the company is not in scope. (More: AI governance & EU AI Act.)
- Look at the first message your chatbot sends. If it does not say the customer is talking to an AI, this is the fastest obligation to fix: one sentence at the start of the conversation.
- Separate deep fakes from everything else. Generated or manipulated image, audio or video depicting a real person or event → disclose. Illustration, abstract graphics, product visuals → not caught by the deep-fake limb.
- Check what your tool marks on its own. Machine-readable marking is the provider's job, but it pays to know what is in the file: that is covered in detail by Watermarks and Provenance, a separate post. For video, platform rules pile on top of the EU duties, and Labelling AI Video walks through those.
Common misconceptions
- "Every AI-written text has to be labelled." No. The text limb applies to public-interest information, and even there an exception applies where a human holds editorial responsibility.
- "The watermark is our job." Machine-readable marking belongs to the provider. Yours is the visible disclosure — the two get blurred together constantly.
- "We have until December." The transition period covers systems already on the market and machine-readable marking, not the disclosure of a deep fake.
- "The fine is EUR 15 million, so we're finished." For an SME the Regulation sets the ceiling at the lower of the two figures, and imposing a fine is a matter of assessment in the first place.
- "This only applies to AI companies." Article 50(4) places its duty expressly on the user of the system. If you publish AI-made content you are in scope, even if you never wrote a line of code.
What to take away
From today the question is not whether you may use AI to make content, but whether you disclose it where you have to. In small-business practice that is three things: the chatbot says it is a machine; generated material depicting a real person or event carries the disclosure; and marketing copy does not fall under the text-disclosure duty. Machine-readable marking is the providers' task — but it is worth knowing what the tool you use puts into the file.