On August 2, 2026, the EU's AI Act transparency rules took effect, and on the same day the European Commission's AI Office, together with national authorities, began active enforcement. This isn't a draft or a recommendation - it's a requirement that applies to any company whose AI system talks to people in the EU, regardless of where the company itself is registered.
But, as often happens with major regulation, the headline ("AI must admit it's AI") hides a far more complicated and contested picture once you dig deeper.
What's actually mandatory now
Article 50 of the AI Act outlines four scenarios where transparency is now law, not just good developer practice:
Direct interaction with a human (Article 50(1)). Chatbots, voice assistants, and AI agents must disclose that the user is interacting with AI - unless it's already obvious to a "reasonably well-informed, observant and circumspect" person. An important technical detail from the Commission's final guidelines: AI agents fall explicitly under this article, and if a provider can't reliably predict whether the agent will end up interacting with a human (rather than another system), it should be designed to disclose its AI nature by default in every such case - meaning the "obviousness" exception can't be used as a blanket excuse.
Deepfakes (Article 50(4)). Any image, video, or audio generated or edited by AI to look like real content must carry a label.
AI-generated content on public-interest topics. Text generated by AI on matters of public interest requires disclosure - unless a human editor genuinely reviewed and edited it before publication.
Emotion recognition and biometric categorization. Systems that determine a person's emotional state or categorize people by biometric traits also fall under mandatory disclosure.
A technical detail that's easy to underestimate
The most interesting wording is in the marking requirements themselves: the technical solutions used must be "effective, interoperable, robust and reliable," accounting for the current state of technology. In plain terms: a label that disappears the moment an image gets re-encoded or screenshotted doesn't meet the bar. That significantly raises the technical threshold compared to just slapping "AI-generated" text under an image.
Disclosure overall must be "clear and distinguishable" - buried in terms-of-service text or a faint, flashing fine-print label doesn't count. The information has to appear no later than the moment of the user's first interaction with the system.
Two different deadlines that trip up even lawyers
Here's a detail most simplified summaries of this law skip: not all parts of Article 50 took effect simultaneously on August 2.
The obligations under Article 50(1) and 50(4) - disclosing direct AI interaction and labeling deepfakes - apply from August 2, 2026, to all in-scope systems regardless of when they were first placed on the market. But the technical piece - machine-readable marking under Article 50(2) - got a transitional period until December 2, 2026 for generative AI systems already on the market before August 2, under the so-called AI Omnibus.
On July 8-9, 2026, the European Commission and the AI Board formally recognized the Code of Practice on Transparency of AI-Generated Content as an "adequate" mechanism for demonstrating compliance with Articles 50(2), (4), and (5) - currently the only EU-wide practical compliance tool assessed as sufficient. Companies that sign the Code get a more predictable enforcement posture - the Commission stated that for signatories, oversight will focus on monitoring adherence to the code rather than case-by-case investigations.
The bigger picture: while one part of the law tightens, another quietly loosens
Here's where the story gets genuinely interesting - and it's the part headlines like "Europe made AI admit it's AI" leave out almost entirely.
In parallel with Article 50 taking effect, Europe has spent the past several months running a much broader deregulation effort - the so-called "Digital Omnibus" and "AI Omnibus," introduced by the Commission in November 2025 under the banner of "simplifying" regulatory burden. And the key point: rules specifically for high-risk AI systems - the ones that pose real threats to people's health, safety, or fundamental rights - got pushed back by this same package to December 2, 2027, and to August 2, 2028, for high-risk systems embedded in regulated products.
In other words, the requirement that "a chatbot must say it's a chatbot" landed exactly on schedule. The far more consequential, far harder-to-implement rules covering systems that could actually cause real harm to people got delayed for years.
That process came with serious lobbying pressure. An analysis by Corporate Europe Observatory and LobbyControl found that Google, Microsoft, and Meta significantly increased their meetings with far-right groups in the European Parliament ahead of this package moving forward - groups that backed the Commission's deregulation plans. Amazon alone spent €7 million on lobbying in a single year. More than 45 executives from top companies signed an open letter to the EU, organized by the lobby group EU AI Champions Initiative (roughly 110 member companies), calling for the AI Act's implementation to be delayed by another two years.
Digital rights organizations reacted sharply. Liberties called the delay of high-risk system rules "a delay to fundamental rights protections." Daniel Leufer of Access Now, reacting on LinkedIn, called one of the amendments "the biggest, most ridiculous loophole in the AI Act that will let unscrupulous providers unilaterally exempt themselves from the AI Act's obligations without oversight" - referring to the ability of AI companies to self-assess whether their system is high-risk, with no public oversight of that self-assessment.
A particularly pointed detail from Liberties: deepfakes are still classified under the AI Act as "limited risk," despite being one of the primary vehicles of disinformation and a genuine threat to democratic processes - even though the already-in-force August 2 labeling requirement specifically applies to them.
What this means if you're building AI products
If your product has an AI chatbot, image or text generation, or any form of direct user interaction with a model - and any of your users are in the EU - it's worth running through a short checklist instead of assuming "nobody's asked."
- Does the chatbot clearly and immediately disclose that it's AI? Not buried in a footer or a long Terms of Service, but right in the interaction itself, at the point of the first message.
- Does AI-generated visual content carry a label that survives re-encoding or a screenshot? A plain text caption under an image doesn't satisfy this requirement - it needs technical, machine-readable marking.
- Does the product include an AI agent that communicates without direct human oversight at every step? The guidelines confirm agents fall under the same disclosure requirement - and if it's unpredictable whether the agent ends up talking to a human, the default should be to disclose its AI nature every time.
- Is it worth signing the voluntary Code of Practice? If the product actively serves an EU audience, signing gives you a documented compliance position and shifts enforcement focus from investigating specific incidents toward monitoring code adherence - a less stressful scenario than waiting for a surprise audit.
The December 2, 2026 deadline for machine-readable marking of generative systems already on the market before August 2 isn't as far off as it looks. If your product falls into that category, it's worth planning the technical implementation now rather than a month before the deadline.