Since 2 August 2026, the Article 50 transparency obligations of the EU AI Act apply: chatbots and voice agents must tell people they are interacting with an AI, and AI-generated content must be marked. The AI Omnibus, Regulation (EU) 2026/1744, deferred Annex III high-risk obligations to 2 December 2027.
Key takeaways
The EU AI Act now requires transparency from every company that uses AI with customers, whatever its size.
- Since 2 August 2026, the Article 50 transparency obligations apply to providers and deployers of AI systems that interact with people or generate content, with no exemption by company size.
- The AI Omnibus, Regulation (EU) 2026/1744, deferred the high-risk obligations: Annex III to 2 December 2027 and Annex I to 2 August 2028. It postponed deadlines, it did not remove requirements.
- Generative AI systems already on the market before 2 August 2026 have until 2 December 2026 to mark their outputs as AI-generated (Article 50(2)).
- Penalties reach up to 7% of worldwide annual turnover for prohibited practices and up to 3% for breaching Article 50. In Spain, AESIA is the designated contact point, but the law that would give it supervisory powers lapsed on 6 October 2026.
- The operational conclusion: if you run a chatbot, a voice agent, content generation or any system that talks to customers, you have work outstanding now, even if you operate no high-risk systems.
What exactly applies since 2 August 2026
Article 50 of the AI Act applies to every company whose AI talks to people or generates content. It is the part of the regulation that touches the most companies, precisely because it does not depend on the system's risk level. It sets three concrete duties:
1. Disclosing AI interaction. When a person interacts with an AI system (a chatbot, an assistant on your site, a voice agent on the phone) they must know, unless it is obvious. Article 50(5) requires the information to be given "in a clear and distinguishable manner" at the latest at the first interaction, not as a notice buried in small print or hidden in the privacy policy.
2. Labelling synthetic content. Providers of systems that generate audio, images, video or text must mark the outputs "in a machine-readable format" (Article 50(2)). Deployers must disclose deep fakes and AI-generated text published to inform the public on matters of public interest (Article 50(4)).
3. Disclosure in specific cases, such as emotion recognition or biometric categorisation systems, where their use is permitted (Article 50(3)).
The European Commission published its Guidelines on transparency obligations on 20 July 2026 and a voluntary Code of Practice on marking and labelling AI-generated content on 10 June 2026.
What did NOT change on 2 August: technical documentation, risk management and conformity assessment obligations for high-risk systems did not come into force. Those were deferred. Conflating the two leads to two opposite mistakes, both expensive: believing nothing needs doing, or believing everything must be done now.
The real timeline, in order
The AI Act applies in stages from February 2025 to August 2028, after the Omnibus deferral.
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited practices (manipulation, social scoring, emotion recognition at work and in education) and AI literacy |
| 2 August 2025 | General-purpose AI model (GPAI) obligations |
| 2 August 2026 | Article 50 transparency for all organisations |
| 2 December 2026 | Article 50(2) marking for generative systems placed on the market before 2 August 2026, and the two prohibited practices added by the Omnibus (sexual deep fakes made without consent and child sexual abuse material) |
| 2 December 2027 | Annex III high-risk systems (biometrics, critical infrastructure, education, employment, essential services such as credit and insurance, law enforcement, migration, justice) |
| 2 August 2028 | Annex I high-risk systems (regulated products such as machinery or medical devices) |
The 2027 and 2028 deferrals come from Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July 2026 and in force since 27 July 2026, which responded to the absence of harmonised standards and to pressure on companies' capacity to adapt.
Our view on what to do with that headroom: it is not a reprieve to do nothing, it is a reprieve to do it properly. The systems being built now will still be running in December 2027. Designing traceability and human oversight today costs a fraction of rebuilding them on a live system, exactly the argument we make in AI in recruitment, where the deferral has the greatest impact.
Key regulatory data
The key AI Act data point is that Article 50 has applied to all organisations since 2 August 2026.
- The Article 50 transparency obligations apply from 2 August 2026 under Article 113 of Regulation (EU) 2024/1689, with no exemption by company size.
- Regulation (EU) 2026/1744 deferred high-risk obligations for Annex III to 2 December 2027 and for Annex I to 2 August 2028.
- Under Article 99, prohibited practices can be fined up to 7% of total worldwide annual turnover, and breaches of other obligations, including Article 50, up to 3%.
- AESIA, the Spanish Agency for the Supervision of Artificial Intelligence, was created by Royal Decree 729/2023. The European Commission lists it as Spain's single point of contact with the national designation "still pending final adoption" (Commission, September 2026): the bill that named it market surveillance authority lapsed when Parliament was dissolved on 6 October 2026.
- 49% of Spanish companies identify regulation and governance as one of the main barriers to adopting generative AI (Deloitte, 2026).
- Among Spanish companies with 10 or more employees that have considered AI but do not use it, 52.9% cite a lack of clarity about the legal consequences (first quarter of 2025, INE).
What to review now
Companies using AI with customers or employees should review seven points, starting with an inventory of systems.
- Inventory of AI systems. What you have deployed, who uses it, for what purpose and what data it processes. Without this inventory you cannot do anything else, and it is the first thing any review will ask for.
- AI disclosure at every touchpoint. Web chatbot, in-app assistant, phone voice agent, automated email or WhatsApp replies. Clear and at the start of the interaction, not at the end.
- Labelling of generated content. Published images, video, audio and synthetic text. With machine-readable marking where technically feasible.
- Risk classification per system. Determine which fall under Annex III (HR, credit, insurance, education, essential services). Even though their deadline is December 2027, knowing which they are changes your design decisions today.
- Review of prohibited practices. Emotion recognition in the workplace and in education has been prohibited since February 2025. If a tool in your stack does it, that is a current problem, not a future one.
- Vendor clauses. As the company deploying the system, you are responsible for its use. Require technical documentation, data processing information and exportable traceability from your vendors.
- Traceability and logging. A record of what the system did and why. It is the cross-cutting requirement of the whole regulation, and the hardest to add retroactively.
Common use cases
The AI Act projects we see most often are voice agent disclosure, content labelling and system inventories.
Case 1: AI disclosure on a phone voice agent.
- Problem: a voice agent handles calls without stating it is an automated system.
- Solution: an explicit message at the start of the conversation, in natural language rather than as a legal announcement, plus a log that disclosure occurred on each call.
- Stack: opening script change + traceability of the disclosure.
- Result: Article 50 compliance without degrading the experience. In practice, disclosing does not reduce the resolution rate.
Case 2: Labelling generated content in marketing.
- Problem: AI-generated images and text published without marking.
- Solution: a publishing flow that embeds provenance metadata and visible labelling where appropriate, integrated into the CMS.
- Stack: provenance metadata + editorial policy + validation in the publishing flow.
- Result: labelling stops depending on someone remembering.
Case 3: Inventory and risk classification.
- Problem: the company does not know how many AI systems it has deployed, between corporate tools and SaaS contracted by individual departments.
- Solution: a cross-company inventory, risk-level classification and a roadmap of applicable obligations and dates.
- Stack: inventory + classification matrix + obligations calendar.
- Result: the usual finding is the same: there are more AI systems in use than anyone had on record.
Common mistakes (and how to avoid them)
The most common AI Act mistake is believing the Omnibus suspended the whole regulation.
Mistake: believing the Omnibus suspends the AI Act. → Reality: it deferred the high-risk timeline, not Article 50 transparency, which has applied since 2 August 2026, nor the prohibited practices, which have applied since February 2025.
Mistake: assuming this only affects large companies. → Reality: Article 50 does not distinguish by size. If you have a chatbot on your site, it applies to you.
Mistake: putting the AI disclosure in the privacy policy. → Reality: the rule requires clear information at the moment of interaction. A footer link does not comply.
Mistake: assuming your SaaS vendor carries your liability. → Reality: as the company deploying the system, you answer for its use. Vendor liability and yours coexist, they do not substitute for each other.
Mistake: waiting until 2027 to design traceability. → Reality: the systems you build today will still be running then. Adding traceability and human oversight to a live system costs far more than designing them in, and forces a service interruption.
Mistake: treating compliance as a document. → Reality: most obligations are system properties (traceability, effective human oversight, data governance), not paragraphs in a report. They are implemented in the software or they do not exist.
Realistic timelines and effort
Transparency notices, the urgent part, take 1 to 3 weeks; the AI system inventory takes 2 to 4.
- AI system inventory and risk classification: 2-4 weeks in a mid-sized company. The timeline is set by tracking down SaaS contracted directly by each department.
- Rolling out transparency notices across all touchpoints: 1-3 weeks. The urgent part and, technically, the simplest.
- Synthetic content labelling integrated into the publishing flow: 2-4 weeks.
- Traceability and human oversight in systems that require it: 6-12 weeks if the system is already live; practically no added lead time if designed in from the start.
- Where the hidden effort sits: in the inventory. There are almost always AI tools contracted by marketing, HR or support that nobody had registered as AI systems.
Metrics to track: inventory coverage (share of systems identified and classified), share of touchpoints with disclosure implemented, share of generated content labelled, traceability coverage in high-risk systems, and the status of contractual clauses with vendors. None of these is exotic, and all can be in place within a month.
Frequently asked questions
What came into force on 2 August 2026 under the AI Act?
The Article 50 transparency obligations for all organisations: clearly disclosing when a person interacts with an AI system and labelling artificially generated or manipulated content, in machine-readable form where technically feasible. Generative systems already on the market before that date have until 2 December 2026 to mark their outputs.
Does the Omnibus Regulation cancel the AI Act obligations?
No. Regulation (EU) 2026/1744 deferred Annex III high-risk obligations to 2 December 2027 and Annex I to 2 August 2028. Article 50 transparency obligations and the prohibited practices remain fully in force.
Do I have to disclose that my chatbot is an AI?
Yes. Since 2 August 2026 you must clearly disclose when a person interacts with an AI system. The notice must be visible at the moment of interaction, not a link in the privacy policy or a mention in the footer.
Does this apply to SMEs or only to large companies?
Article 50 does not distinguish by company size. If your organisation deploys an AI system that interacts with people (a chatbot, an assistant, a voice agent) the transparency obligation applies equally.
Which systems count as high risk?
Annex III covers eight areas: biometrics, critical infrastructure, education, employment and HR, access to essential private and public services (including credit scoring, life and health insurance and emergency patient triage), law enforcement, migration and border control, and the administration of justice and democratic processes. Their obligations apply from 2 December 2027. Medical devices are regulated products under Annex I, from 2 August 2028.
What are the penalties for breaching the AI Act?
Prohibited practices can be fined up to 7% of the company's worldwide annual turnover. Breaches of other obligations, including the Article 50 transparency duties, can reach up to 3%.
Who supervises AI Act compliance in Spain?
AESIA, the Spanish Agency for the Supervision of Artificial Intelligence, is Spain's single point of contact under the AI Act. The bill that would formally designate it as market surveillance authority lapsed when Parliament was dissolved on 6 October 2026, so its final designation is still pending.
Does AI-generated text have to be labelled?
Artificially generated or manipulated content must be marked, with nuances depending on the content type and purpose. For images, audio and video the obligation is clearer; for text it applies in specific cases, particularly when published to inform the public on matters of public interest.
Do you know how many AI systems your company has deployed?
NAXIA starts AI Act projects with an inventory: there are usually more AI systems in use than on record. We build AI systems with compliance inside the design, not on top of it: transparency notices at every touchpoint, labelling of generated content, traceability of every decision and effective human oversight where the rules require it.
If you want to know which obligations apply to you today and which arrive in 2027, talk to us. No commitment, no 40-slide decks.
Or explore our implementation process first.
NAXIA is a Spanish artificial intelligence and automation agency for companies of all sizes: it designs, deploys and maintains AI agents, voice agents and automations integrated with each client's systems. Founded in 2024 and based in Pamplona (Navarre), it works with companies across Spain and has delivered more than 20 projects.