On 2 August 2026 the AI Act’s transparency duties go live — and unlike the high-risk rules, they were not postponed by the Digital Omnibus. Concretely: chatbots must identify themselves as AI, AI-generated images, audio and video need machine-readable marking, and deepfakes must be disclosed. For most companies this is settled with one sentence in the chat window and one look at the tools in use — you just need to know which of the four duties applies to you.
The usual framing: technology, not legal advice. Edge cases belong with a professional.
The four duties in Article 50
Article 50 distributes the duties depending on whether you provide an AI system or merely deploy one (full text at EUR-Lex):
| Duty | Who it hits | What to do |
|---|---|---|
| Chatbot disclosure | Deployers of AI that interacts with people | State that an AI is answering — unless it’s obvious |
| Machine-readable marking | Providers of systems that generate content | Watermarks/metadata in image, audio, video, text |
| Deepfake disclosure | Deployers publishing deceptively real media | Visibly label the content as artificially generated |
| Notice for emotion recognition / biometric categorisation | Deployers of such systems | Actively inform the people affected |
For SMEs, almost only the first and third rows matter. The machine-readable marking is the providers’ job — OpenAI, Google and friends, not you as a user of their tools. And hardly any normal business runs emotion recognition; in the workplace it has been banned since February 2025 anyway.
The website chatbot: the most common gap
If a chatbot handles your customer service or website enquiries, from August it needs a clear note that an AI is answering. The law prescribes no wording — “I’m the digital assistant of …” in the greeting does the job. The exemption for the obvious helps less than you’d think: what’s obvious to you as the operator isn’t obvious to an averagely informed person. The note costs one line.
The same logic covers AI on the phone: a voice AI answering calls has to identify itself before anyone believes they’re talking to a human.
What about AI text in blogs and marketing?
This is where most of the uncertainty sits. The disclosure duty for published text targets content that informs the public on matters of public interest, and it lapses when a human has editorially reviewed the content and carries responsibility for it. A company blog whose posts someone reads, checks and approves stays out of scope — regardless of how much AI helped with the draft. If, on the other hand, you mass-publish generated text unread, labelling is not your biggest problem.
For images, the line runs at deception: an illustrative, recognisably artificial picture in a blog post is not a deepfake. A photorealistic image faking a real event or a real person is one — and must be labelled as artificially generated.
What to do before August
The exercise is the same as for the other AI Act duties, just smaller: walk through where AI is visible to the outside. Chatbot on the website, voice assistant on the phone, generated images in marketing, videos with synthetic voices. For every hit, the fix is a notice or a label — none of it needs a project budget. If you combine the walkthrough with the data-class matrix from your GDPR work, both jobs are done in one session. And for transition cases: systems already on the market have a grace period for machine-readable marking until 2 December 2026 (details at Gibson Dunn).
Not sure which of your AI applications needs a notice from August? Get in touch — the walkthrough is a short session, not a consulting week. If needed, it’s also available as part of a broader assessment.