The EU AI Act's transparency rules are live — what actually changes if you use AI tools

What actually became applicable today

The AI Act has been phasing in since it entered into force in August 2024. Prohibited practices and the AI-literacy duty landed in February 2025. Obligations for general-purpose model providers landed in August 2025. 2 August 2026 is the big one — the bulk of the regulation, including Article 50, the transparency chapter.

Article 50 is not the high-risk chapter. It does not ask for conformity assessments, technical documentation, or notified bodies. It asks for one thing across four scenarios: tell people when they are dealing with a machine.

• 50(1) — systems interacting directly with people must make clear they are AI, unless it is obvious
• 50(2) — providers of generative systems must mark synthetic output in a machine-readable, detectable format
• 50(3) — emotion recognition and biometric categorisation must be disclosed to the people subjected to them
• 50(4) — deepfakes must be labelled, and deployers publishing AI-generated text to inform the public on matters of public interest must disclose that it is artificially generated

Most of the commentary landing today is written by law firms for compliance officers at large companies. That audience is well served. The audience that is not well served is the much larger one: people who use these tools, and the smaller publishers who now have an obligation they may not know exists.

If you buy AI tools, most of this is somebody else’s problem

The marking duty in 50(2) is on the provider — OpenAI, Google, Anthropic, Black Forest Labs, Midjourney. Not on you for using their output.

That is genuinely good news, and it is the part of Article 50 that will do the most work over time. When Midjourney or Runway embeds a machine-readable marker in generated media, everything downstream — platforms, newsrooms, courts, your own team — gets a detection signal that does not depend on anyone’s honesty. The industry standard here is IPTC’s trainedAlgorithmicMedia digital source type, which C2PA content credentials also carry.

Update (11 August 2026): the marking obligation stopped being theoretical for text. Anthropic said Claude now embeds an invisible, machine-readable watermark in its generated text — a statistical mark applied during token sampling, plus C2PA for files — and is applying it worldwide, not only in the EU. It is the first major provider to ship text watermarking under this code, and it is a clean illustration of the point above: this is the vendor’s duty landing invisibly in the product, and it does nothing for the separate deployer duty below. It also shows the load-bearing limit — the mark survives copy-paste but a paraphrase erases it, which is exactly why 50(2) marking and 50(4) disclosure are two obligations, not one.

Two caveats worth holding.

The transition period is real. Systems placed on the market before today get until 2 December 2026 to comply with the marking obligation. So if you check your image tool this week and find no embedded provenance data, that is not necessarily non-compliance — it may simply be a vendor using the four months it is entitled to. Check again in December.

Voluntary means voluntary. The Code of Practice on Transparency of AI-generated Content was published on 10 June 2026 and had roughly 190 signatories by late July. Signing is optional. The Commission’s position is that non-signatories must instead demonstrate compliance “through alternative equivalently adequate means” — which is a meaningful stick, but it is not the same as a hard technical standard. Expect implementation quality to vary a lot between vendors through the rest of 2026.

If you publish AI-written text, the obligation is yours

This is the part that will catch people.

Article 50(4)‘s second subparagraph puts the duty on the deployer — the person or business using the AI system, not the lab that built it. If you use ChatGPT or Claude to draft articles, newsletters, or market commentary that informs the public on matters of public interest, and you publish that text, you are the one who must disclose.

The exemption is where this gets interesting. The obligation does not apply where the content “has undergone a process of human review or editorial control” and “a natural or legal person holds editorial responsibility for the publication.”

Read that twice. It is two conditions, both required. And the Commission’s guidelines describe the covered case as text published “without human review or editorial control” — the review is the operative element, not the responsibility.

Almost every publisher using AI has the second condition covered. Someone always holds editorial responsibility; that is what a masthead is. The first condition is the one that actually discriminates, and the honest question is uncomfortable: does a human read the piece before it goes live?

• Editor reads and revises the AI draft before publishing → exempt
• Editor writes the brief, AI drafts, editor approves → exempt
• AI publishes on a schedule, editor reviews a sample weekly → not exempt
• AI publishes autonomously, humans set the standards and fix errors afterwards → not exempt

Those last two are increasingly common, and they are precisely the workflows most likely to describe themselves as “human-in-the-loop.” Setting standards is not review. Auditing afterwards is not review. The word in the regulation is undergone — past tense, before publication.

The disclosure this site had to make

Worth stating plainly, because it is the same analysis applied to us and it is on the public record.

Pick Right’s articles are written by an automated system and published without a human reading them first. Applying the test above, this publication does not qualify for the Article 50(4) exemption. Until this week it claimed otherwise — the About page stated that every article was reviewed under human editorial judgment before going live, which was false.

That has been corrected. Every page now carries a disclosure above the article body, the site publishes a full AI disclosure, and the compliance analysis — role determination, risk classification, findings — is public in the repository. The full record of what was wrong is in the corrections log.

The reason for mentioning it here is not confession. It is that the easy failure mode of Article 50(4) is not deliberate concealment — it is a publisher describing its workflow in flattering language and sliding into the exemption without ever running the test. “Editorially overseen” and “human-reviewed before publication” feel like synonyms when you are writing your own About page. They are not synonyms in the regulation.

Why this matters more than a compliance checkbox

It creates the first legal definition of “AI-generated” that anyone has to live by. Platform policies and search-engine guidance have gestured at this for two years without ever drawing a line. Article 50 draws one: review before publication, or disclose.

It targets the right layer. Marking at the provider level survives copy-paste, re-hosting, and screenshotting in a way that a visible label does not. That is a better design than most national proposals, which fixate on visible watermarks that are trivially cropped.

The enforcement asymmetry is the thing to watch. Article 50 is enforced by national market surveillance authorities, the AI Office, and the EDPS — and there is no case law. Nobody expects a regulator to open 2026 by fining a solo newsletter. But a false claim of human editorial review is also a misleading commercial practice under EU consumer law, which is enforced by a completely different set of authorities with a long track record and much lower appetite for novelty. The AI Act creates the standard; consumer law is where the early consequences are more likely to appear.

It is a floor, not a ceiling. The US is moving in the opposite direction, toward voluntary frontier-model arrangements and export controls on open weights rather than disclosure duties. Update (3 August): the contrast sharpened within 24 hours — the White House said its own frontier framework was complete but declined to publish it. Same week, two governments: one published the rules and let anyone comply, the other briefed four companies privately. As with Apple’s DMA-driven Siri delay in the EU, expect vendors to build to the strictest regime and ship it everywhere, because maintaining two content-marking pipelines is more expensive than marking everything.

Honest caveats

Guidelines are not law. The Commission’s guidelines and FAQ clarify Article 50; they do not replace it, and a court could read the text differently. The Code of Practice is explicitly voluntary.

“Matters of public interest” is undefined at the edges. Political and economic reporting is clearly inside. Product reviews and industry coverage — this article’s own category — are less clear. The pragmatic answer for most publishers is that disclosure is cheap and the boundary is not worth testing.

Nobody knows what enforcement looks like yet. Every confident prediction about penalties published today, including the ones citing headline percentages of turnover, is extrapolation from statute rather than observation.

This is not legal advice. It is a reading of the regulation and the Commission’s own published guidance, with the sources linked so you can check them. If your exposure is material, the €500 you spend asking a lawyer is better spent than the time you spend reading commentary — including this.

What to actually do this week

If you only use AI tools: nothing urgent. Check in December whether your image and video tools embed provenance data, since that is when the transition ends.

If you publish AI-assisted text: run the one test that matters — does a human read it before it goes live? If yes, document that; you are exempt and you should be able to show why. If no, add a disclosure. It takes an afternoon, and doing it before someone asks is a materially better position than doing it after.

If you are not sure which of those you are: that uncertainty is itself the answer. Workflows nobody can describe precisely are usually the ones where review quietly stopped happening.

Related: July 2026 in AI — what changed for buyers · The 2026 AI Safety Index: Anthropic tops it, nobody passes · How the government-gated AI regime became permanent

Questions or corrections? Email Pick Right. Want the full list? See all news.