The EU's "tell people it's AI" rule is live. The only grace period ends 2 December.
Article 50 of the EU AI Act is already live, and the one grace period in it is narrower than most summaries make it sound.
Article 50 of the EU AI Act became generally applicable on 2 August 2026, and national authorities can enforce it now. It applies whatever your risk classification is, which is the part small teams tend to miss: you do not need to be a "high-risk" system to be covered. The Digital Omnibus that entered into force in July did not change the substance of these duties, according to the law-firm write-ups I read (Goodwin, and Ropes & Gray).
What it asks for, going by the text of the article itself. If your system interacts directly with people, they have to be told they are dealing with an AI, unless that is already obvious to a reasonably informed, observant person. If your system generates synthetic audio, image, video or text, the output has to be marked in a machine-readable way so it can be detected as AI-made. Deployers who publish deepfakes must disclose them, and deployers of emotion recognition or biometric categorisation must inform the people exposed to it. The information has to be clear and given no later than the first interaction.
The grace period. Generative systems that were already on the market before 2 August get until 2 December 2026, but only for the marking and detection duty. Both firms say the same thing: it does not cover the chatbot disclosure, and anything placed on the market on or after 2 August gets no grace at all. So if you launched a new generative feature this autumn, the clock is not running for you.
The numbers. The fine ceiling for Article 50 breaches is up to 15 million euros or 3% of worldwide turnover, whichever is higher, with some proportionality for small companies. That figure comes from the law firms' summaries rather than from me reading the penalty article, so check it before you quote it. The Commission published its transparency guidelines on 20 July and finalised a Code of Practice on AI-generated content marking on 10 June, and signing up to it is one way to show compliance.
What I would do this month, as a builder and not a lawyer. First, list every place your product talks to a user or produces text, images or audio, and ask for each one whether a reasonable person could think a human wrote it. Second, put the disclosure in the interface itself, at the start, rather than in terms of service. Third, if you generate content, find out what marking your model provider already applies, because as a deployer you may be inheriting that and not building it. Fourth, write down your reasoning for anything you decided was obvious, since the exemption turns on that judgement.
For Murror this one is easy to state. People write to it on hard days, and they should never have to wonder whether something that sounds warm is a person. Telling them plainly is not a compliance chore, it is part of earning the right to be in that conversation. It is also the same direction as California's companion-chatbot law I wrote about last week, so one honest disclosure design can cover both.
If you ship anything conversational or generative to EU users, where does your AI disclosure live today, and would a first-time user see it before their first message?
Replies
For anyone shipping generated video (we are, launching this week), the marking duty is the part to read twice. Every Holina output carries an invisible watermark that survives a re-encode, so the marking holds up once clips hit social. Good callout that anything launched after 2 August gets no grace period.
@holina_factory Thanks, and good luck with the launch this week. I'd add one thing for anyone reading: the marking duty is about being detectable by machines, so it is worth testing that a watermark actually survives the platforms your clips end up on, not just a re-encode in your own pipeline. I can't speak to how any specific tool performs, so check the claims on your own outputs.
The disclosure duty is the part teams will miss. The December grace period only covers marking generated content. Telling people they are talking to an AI has applied since August. For me that is a product design question before it is a legal one: where in the flow does the disclosure sit so people actually notice it? Has anyone seen a pattern that works without adding one more banner nobody reads?
@niklausgerber Fair point, it is a design problem first. The test I would use is not "is there a banner" but "could someone finish their first session and still be unsure what they were talking to?" If yes, the disclosure failed however visible it was. I would put it in the first moment of the conversation itself, in plain words, rather than in a separate notice. I have not seen a pattern that is clearly proven to work, so I would also like to hear what others have tried.
@monatruong_murror I like that test. It measures whether people understood, which is what the rule is actually after. For me the first line of the conversation is the right place too, in plain words and in the user's language. I would add one thing: say it again when the stakes change, for example right before the assistant gives advice someone might act on. Curious what others have seen work.