Article 50 kept its date, and it lands on the chat window
The EU deferred high-risk AI obligations weeks before August 2, 2026, but the transparency duties arrived on schedule. For banks, insurers, hospitals and agencies serving Europeans, the work sits in interface design, content pipelines and publishing sign-off.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
August 2, 2026 was the date on which most of the EU AI Act was due to apply. Weeks earlier, the EU finished the AI part of its digital omnibus. Regulation (EU) 2026/1744 was published in the Official Journal on July 24 and entered into force on July 27. It moved obligations for standalone high-risk systems to December 2, 2027, and for AI in regulated products to August 2, 2028. It left the transparency duties in Article 50 on their original date. From August 2, providers of systems that interact with people had to make clear that users are dealing with AI. Deployers had to disclose deepfakes and certain AI-generated text. The only relief was for machine-readable marking of synthetic content by systems already on the market, which has until December 2, 2026. The Commission’s power to fine providers of general-purpose AI models also took effect.
Earlier in this series we argued that, for EU consumer lenders, the binding credit-scoring constraints sat outside the AI Act, in data protection law and the Consumer Credit Directive. The omnibus confirmed that the Act’s high-risk regime would wait until late 2027. It did not touch the part of the Act that customers and citizens actually see. Article 50 is short, and it is easy to dismiss as a labeling rule. In practice it reaches every chat assistant, voice bot, generated image and drafted notice that a regulated organization puts in front of people in the EU. Breaches sit in a penalty tier of up to €15 million or 3 percent of worldwide turnover.
Article 50 sets three distinct duties, and each lands on a different team. Providers must design interactive systems so people know they are dealing with AI. Providers of generative systems must mark synthetic output in a machine-readable way. Deployers must disclose certain uses and outputs to the people affected. Each needs its own owner and its own evidence. Organizations should confirm with counsel which apply to them, especially where they serve EU customers from outside the EU.
Telling people they are dealing with AI
The first duty falls on providers of systems intended to interact directly with people. Unless it is obvious from context, the person must be told no later than the first interaction. For a bank or insurer, the first question is who the provider is. A firm that buys a vendor’s assistant and deploys it unchanged is usually a deployer. A firm that builds its own assistant on a general-purpose model and puts it into service under its own name is likely the provider of that system. Many digital teams have done exactly that.
The duty then becomes a design requirement with test cases. The disclosure has to appear at the first turn in every channel: web chat, app, messaging platforms and voice. Voice is where gaps tend to hide. An intelligent call routing system that answers in natural speech is an AI interaction, and the greeting script has to say so. A hand-off rule matters too. When a human agent takes over, or an AI drafts replies a human sends, the customer should not be misled about which is which. Product owners should add these checks to release testing so a redesign cannot quietly drop the notice.
Marking what the system generates
The second duty applies to providers of systems that generate synthetic audio, images, video or text. Their outputs must be marked in a machine-readable format and be detectable as AI-generated, where technically feasible. Systems already on the market before August 2 have until December 2, 2026 to comply. In July the Commission and the AI Board judged a voluntary code of practice on marking and labeling adequate, which gives providers a recognized route.
Most regulated organizations will meet this duty through their vendors. The procurement task is to confirm that image, voice and text generation tools used in marketing, customer communications and claims handling apply marking, and that internal pipelines do not strip it. Re-encoding a video, flattening an image or pasting generated text into a document template can remove metadata. A simple control is to sample published assets each quarter and check that marking survived. Where an organization fine-tunes or wraps a model and offers the result to customers, it may be a provider in its own right and should plan accordingly.
Disclosing what deployers use and publish
The third set of duties falls on deployers, which covers almost every bank, insurer, hospital and agency using AI. Three uses matter. People exposed to emotion recognition or biometric categorization must be informed. Contact-center analytics that infer caller sentiment or emotion are the usual case. Emotion recognition in the workplace has been prohibited since February 2025, so the same tools pointed at staff need separate review. Deepfakes, meaning generated or manipulated images, audio or video resembling real people, places or events, must be disclosed. A synthetic spokesperson in a bank video or a cloned executive voice on a hold message both qualify.
AI-generated text published to inform the public on matters of public interest must also be disclosed. The exception is text that has undergone human review or editorial control, with someone holding editorial responsibility. That exception suits agencies and health systems well, provided the review is real and recorded. A public notice on benefit changes, or a hospital’s public health update, drafted with AI and approved by a named communications lead, can rely on it. The control is a sign-off record that names the reviewer, not a general policy statement.
Each of these duties is cheap to meet early and costly to retrofit after a complaint. Interface notices, marking checks and editorial sign-off logs are ordinary product and communications controls. The difference after August 2 is that a regulator can ask to see them.
With hindsight
By October 2026, the deferral is settled law and the next dates are close. December 2, 2026 brings the marking deadline for generative systems already on the market, along with two new prohibitions added by the omnibus, on non-consensual intimate imagery and child sexual abuse material. The Commission consulted on draft Article 50 guidelines in May and June, and final guidance should be tracked as it appears. We have not seen public enforcement under Article 50, and national authorities’ priorities are not yet clear. That uncertainty argues for evidence rather than waiting. The duties that arrived in August are visible to any customer or journalist who opens a chat window, so gaps are easy to find from outside. Organizations that split the three duties by owner can show what they do. Those that read the high-risk delay as a general pause have catching up to do before the December dates.