Since 2 August 2026, the AI Office can investigate and enforce rules on general-purpose AI model providers and prohibited practices, and Article 50 transparency duties apply to businesses that deploy or provide AI features. For a 20-person vendor the hard part is not reading the Act. It is knowing which of the many documents around it carry legal weight, so you do not spend a quarter on a voluntary code while missing a binding article.
This is a reading guide, not legal advice. Confirm decisions against the Official Journal text.
What's affected
The sorting below uses the Wilson Sonsini summary of the August 2026 enforcement phase and the AI Act Explorer's page on Regulation (EU) 2026/1744, the Digital Omnibus on AI, dated 8 July 2026 and in force from 27 July 2026.
| Item | Status | What it means for a small vendor |
|---|---|---|
| Regulation (EU) 2024/1689, the AI Act | Binding law | Duties and fines apply as written |
| Regulation (EU) 2026/1744, the Omnibus | Binding law | Moves high-risk dates and adds SME relief |
| Article 50 transparency duties | Binding, applying from 2 August 2026 | Disclose AI interaction, mark synthetic output, disclose deepfakes |
| Article 50(2) machine-readable marking, for systems on the market before 2 August 2026 | Binding, with grace to 2 December 2026 | Only for systems already on the market |
| Commission guidelines on transparency obligations | Guidance, published in final form | Shows how the Commission reads Article 50. Not law |
| Code of Practice on transparency of AI-generated content | Voluntary | Endorsed as an adequate route to compliance, but you may use other measures |
| Simplified technical documentation for SMEs | An option in the text | You may simplify Annex IV elements. The Commission will set the form |
How to check if you're exposed
Classify each AI feature in one pass:
- Does the user talk directly to an AI system? Article 50(1) applies to the provider: design it so people are told, unless it is obvious to a reasonably well-informed person.
- Does it generate synthetic audio, image, video or text? Article 50(2) applies to the provider: outputs must be marked in a machine-readable format and detectable as artificial. Assistive editing that does not substantially alter input is exempt.
- Do you use AI to create or manipulate deepfakes, or publish AI text on matters of public interest? Article 50(4) binds the deployer: disclose it, unless a human editor with responsibility has reviewed the text.
- Does any feature fall in an Annex III use case, such as employment or credit? Those high-risk duties now apply from 2 December 2027. Annex I regulated products follow on 2 August 2028.
Write the answer for each feature in a table. It becomes the first page of your compliance file.
What to do now
- Treat Article 50 as live. Add the AI disclosure to chat interfaces and decide how you will mark generated content.
- If a generative feature shipped before 2 August 2026, put 2 December 2026 on the roadmap for machine-readable marking.
- Read the transparency code of practice, and decide whether to adhere. If you do not, document how your alternative measures meet Article 50. The Commission says non-adherents should be able to explain that.
- Keep an inventory of AI features, models and data sources. It supports every other step.
- Use the SME provisions the text gives you. Fines for SMEs are capped at the lower of the percentage or the fixed amount (Article 99(6)). Documentation may be simplified, and the Omnibus says the AI literacy duty no longer requires a specific literacy level.
- Do not wait for the Commission's pending SME forms and guidelines before starting. They simplify the paperwork, and they do not change the dates.
Why it matters
The fine ceilings explain why the classification matters. Article 99 sets up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, EUR 15 million or 3% for most other operator duties including Article 50, and EUR 7.5 million or 1% for supplying incorrect information to authorities. For SMEs the lower figure of each pair applies.
Guidance and codes are different. They do not carry fines of their own, but they tell you how the regulator is likely to read the binding text. A sensible order is: satisfy the binding article first, then use guidelines to interpret it, then use a voluntary code if it saves you effort.
Try it yourself
List your AI features, mark which Article 50 paragraph each one touches, and note the date it applies to you.
Click through it at your own pace, or open it full screen.
Quick check
Is the Code of Practice on AI-generated content mandatory?
No. It is voluntary. The Commission has endorsed it as an adequate way to support compliance, but a vendor can use alternative measures and should document how they meet Article 50.
Which fine cap applies to an SME?
Article 99(6): for SMEs, including start-ups, each fine is up to the percentage or the amount, whichever is lower.
