The EU AI Act Applies From Today. Here's What Actually Changes in Your Stack

What starts applying today, 2 August 2026, is disclosure — not the high-risk regime everyone spent a year bracing for. The Digital Omnibus on AI, adopted by the European Parliament on 16 June 2026 and the Council on 29 June, pushed standalone high-risk obligations to 2 December 2027 and embedded-product ones to 2 August 2028. What it left on today’s date is Article 50: tell people when they’re talking to a machine, and mark what the machine made.

For a solo operator or a lean team, that’s the whole story. You are almost certainly not shipping a high-risk system. You are almost certainly publishing synthetic audio, synthetic video, or AI-drafted text — which means the part that survived the delay is the part aimed at you.

This is an operator’s read of a stack, not legal advice. If the EU is a real market for you, get a lawyer to look at your specific setup.

What moved and what didn’t

Obligation	Original date	Now
Article 50 transparency (providers + deployers)	2 Aug 2026	2 Aug 2026 — unchanged
Machine-readable marking, systems already on market	2 Aug 2026	2 Dec 2026 (grace period)
Standalone high-risk systems (Annex III)	2 Aug 2026	2 Dec 2027
High-risk AI inside regulated products (Annex I)	2 Aug 2027	2 Aug 2028

Half the search results you’ll hit today still describe 2 August 2026 as the high-risk deadline. They were written before the Omnibus and nobody went back to fix them. Check the date on anything you read about this, including this page.

The three duties that touch a working stack

1. If people talk to it, say it’s AI. Article 50(1) puts this on providers of the system, with an exemption when it’s obvious to a reasonably well-informed person. The practical read for an operator: a support bot, a booking agent, or a lead-qualifying chat needs to say what it is at the first turn. A tool you clearly labelled “AI assistant” already clears the bar. A chat widget that answers in a human name does not.

2. If you publish a synthetic face or voice, disclose it. Article 50(4) puts this on the deployer — you — for artificially generated or manipulated image, audio, and video. If you run an avatar in HeyGen or a cloned voice from ElevenLabs, that’s the clause with your name on it. Artistic, creative, and satirical work gets a lighter version: disclose that generated content exists, without breaking the piece.

Providers carry a separate duty under 50(2) to mark synthetic output in a machine-readable format. Systems already on the market before today get until 2 December 2026 to comply. That one is your vendor’s job — but it’s worth asking your video and voice vendors where their marking stands, because the answer tells you how seriously they take the rest of it.

3. If AI drafts text you publish as public-interest information, disclose it — unless a human actually edited it. Article 50(4) again. The exemption is real and it is the whole ballgame: text that went through human editorial review, with someone holding responsibility for it, doesn’t need the label. Which is a legal way of saying what we already say here — the operator signs the work. If nobody read it before it shipped, it isn’t your writing, and the law now agrees.

Disclosures have to be clear, distinguishable, and delivered at the first interaction. A line in your terms of service is not a disclosure.

The operator move: one line per seat

Don’t build a compliance project. Build a column.

Open your stack map. For every tool that produces something a person outside your business will see or hear, write one line: who discloses, where it appears, and at what moment. Most seats will say “n/a — internal.” A handful will say something like “avatar video → on-screen label in the first three seconds.” That column is the deliverable. It takes an hour and it doubles as your FTC answer, your platform-policy answer, and your client’s answer.

Then wire it where the work happens. Disclosure that depends on remembering is disclosure that fails on the busy week. Put it in the template, not the checklist: the caption preset that already carries the label, the n8n or Lindy step that refuses to publish without it, the export that can’t render without the badge. Give the agent a leash.

Where the real exposure sits

Not in the fines. In the fact that most operators can’t answer “what does your stack publish, and who says so?” — and today that question has a legal edge on it as well as a trust one. The tools that touch the public are a short list. You just have to have written it down.

Clarity is infrastructure. This is the week it starts paying rent.

---

Sources: the Digital Omnibus on AI as analysed by Freshfields and Gibson Dunn, and the text of Article 50. Verified 2 August 2026.