On 2 August 2026 two parts of the EU AI Act became live that the Digital Omnibus did not postpone: the AI Office's power to enforce obligations on general-purpose AI (GPAI) model providers, and the Article 50 transparency duties. A Wilson Sonsini summary describes the date as the start of the enforcement phase. If you ship software that calls a model or generates synthetic content, this date matters more than the deferred high-risk deadlines.
What's affected
Binding, per the summary:
- The GPAI obligations, the enforcement powers and Article 50 are statutory.
- The Commission, acting through the AI Office, can request information and documentation, obtain model access for evaluation, require corrective or risk-mitigation measures and, in serious cases, ask that a model be restricted, withdrawn or recalled.
- GPAI fines can reach the higher of 15 million euros or 3 percent of worldwide annual turnover. The summary gives no fine amounts for Article 50 breaches.
- The AI Office calls "technical compliance dialogues" its preferred first tool, with formal powers available if those do not resolve its concerns.
Article 50 duties that now apply:
- Telling people when they interact with an AI system, unless it is obvious.
- Machine-readable marking of synthetic audio, image, video or text output.
- Disclosing deepfakes, and AI-generated text published to inform the public on matters of public interest.
- Informing people exposed to emotion-recognition or biometric-categorization systems.
Timing for GPAI models: obligations have applied since 2 August 2025 for models placed on the market on or after that date, with enforcement powers only from 2026. Models placed on the market before 2 August 2025 generally have until 2 August 2027.
Voluntary, per the same summary: the Code of Practice on Transparency of AI-Generated Content, which the Commission endorsed as an adequate means of supporting the marking and labeling duties. Companies that do not adhere can use other measures but must be able to explain and document how those comply with Article 50. The summary calls the Commission's Article 50 guidelines final but does not state their legal status, so read them as interpretation, not law.
The Omnibus interplay
Regulation (EU) 2026/1744 does not change any of the above. It defers Annex III high-risk requirements to 2 December 2027 and Annex I products to 2 August 2028. It gives one concession: systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the Article 50(2) marking requirement. No other Article 50 duty gets that extension.
How to check if you're exposed
Start by finding where models enter your product:
grep -rIlE "openai|anthropic|google-generativeai|vertexai|boto3.*bedrock|langchain" \
--include=package.json --include=requirements.txt --include=pyproject.toml .
For each hit, answer four questions:
- Does the feature let a person believe they are talking to a human? If not obvious, it needs a notice.
- Does it generate audio, image, video or text that leaves your product? If so it needs machine-readable marking.
- When was it first placed on the market? Before 2 August 2026 earns the marking grace period, nothing else.
- Are you a GPAI model provider, or only a deployer of someone else's model? Provider duties differ from downstream ones.
What to do now
- Add a clear notice to chat and agent interfaces where the AI nature is not obvious.
- Choose a marking method for generated content, and test that the mark survives export, copy and common edits.
- Record the date each generative feature went live and write the deadline next to it.
- Decide whether to adhere to the voluntary code. If you do not, write the alternative measures down now, since you must be able to explain them.
- Ask your model suppliers which GPAI obligations they meet and in what documents.
How suppliers can prepare
- Keep an inventory of models and AI components in each product, with versions and suppliers, so you can answer regulator and customer questions quickly.
- Document the supplier chain. A product built on a third-party GPAI model should hold that provider's documentation alongside its own.
- Treat 2 December 2026 as a hard date for existing generative features. It is the end of the only grace period.
- Test deepfake and public-interest text disclosures where your product publishes content.
- Keep a compliance dialogue file: a dated record of what you were asked and what you answered.
Why it matters
Most AI Act coverage this summer was about delay. The two things that did not delay are the ones aimed at what ships to users today: honest labeling and enforceable duties on model providers. They are also the ones a small software team can actually act on this quarter.
The mix of binding law and a voluntary code is the useful detail. You can meet Article 50 without signing the code, but then the proof is yours to produce. A signed code is a shortcut to an argument, not a shield.
This post is a summary, not legal advice.
Try it yourself
Click through it at your own pace, or open it full screen.
Then run the grep above on one repository and write a one-line status for each AI feature it finds: notice, marking, date.
Quick check
Which Article 50 duty has a grace period, and until when?
Machine-readable marking under Article 50(2), until 2 December 2026, and only for systems placed on the market before 2 August 2026.
Is the Code of Practice on Transparency of AI-Generated Content mandatory?
No. It is voluntary. Companies that skip it must be able to document how their own measures comply with Article 50.
What can the AI Office do to a GPAI provider from 2 August 2026?
Request information, obtain model access for evaluation, require corrective measures and, in serious cases, ask for a model to be restricted, withdrawn or recalled. Fines can reach the higher of 15 million euros or 3 percent of worldwide turnover.
