Review transparency duties alongside the amended AI Act dates
The 2026 amendments changed high-risk application dates without moving all transparency duties. Review Article 50 by system function, organisational role and applicable exceptions, alongside the intended-use classification.
Trace the interfaces between applications and records before changing a system.
A changed AI Act application date should trigger a review of the provisions affected. It does not establish that every obligation has moved. Separate the high-risk requirements from transparency duties and identify the dates that apply to each system.
The report is accurate. The Digital Omnibus on AI entered into force on 27 July 2026 and pushed the obligations for stand-alone high-risk systems to 2 December 2027, and for systems embedded as safety components in products already covered by EU product-safety law to 2 August 2028. The Commission’s own timeline now reads that way.
Article 50 has applied since 2 August 2026, subject to applicable exceptions and transitional arrangements. It addresses specified interactions and synthetic-content uses. Review it separately from high-risk classification rather than treating the changed high-risk dates as a general postponement.
Two different questions, two different dates
High-risk classification depends on the relevant Article 6 route, intended use and applicable conditions. Annex III covers specified areas, including employment and access to essential services. Assess the actual deployment before concluding that an assistant is outside those categories. The amended dates concern obligations, rather than postponing the need to understand the classification.
The Commission’s Article 50 text sets distinct provider and deployer duties. These cover direct interaction notices, machine-readable marking of synthetic content, information about emotion recognition or biometric categorisation, and disclosure of specified deepfakes and public-interest text. Each duty has its own scope and exceptions.
Use and context remain relevant. Direct-interaction notices have an exception where the AI interaction is obvious in the specified circumstances. The marking duty includes an assistive standard-editing exception. Public-interest text disclosure includes an exception for human review or editorial control with editorial responsibility. These qualifications need assessment rather than blanket application to every assistant.
- Layer 01 The model Provider duty — synthetic output marked in a machine-readable form.
- Layer 02 Orchestration Check how transformations preserve required marking through the output path.
- Layer 03 The interface Provider duty — the person is told at first interaction that they are talking to an AI system.
- Layer 04 The publication surface Deployer duty — deepfakes and public-interest text disclosed.
The word “provider” is doing more work than teams expect
Both build-time duties fall on the provider, and it is easy to read that word and picture the model vendor. The Act’s own definitions do not work that way. A provider is a body that develops an AI system, or has one developed, and “places it on the market or puts the AI system into service under its own name or trademark”. Putting into service is defined as supply for first use to a deployer “or for own use”. Both definitions sit in Article 3.
An organisation developing or commissioning a system and putting it into service under its own name may be its provider, including for own use. Buying a model does not by itself settle responsibility for the assembled system. Assess the facts against the definitions and document the role.
Where a marking duty applies, review the full output path. Rewriting, templating, redaction and export can change or remove metadata. Establish which technical marking method is used, what survives each transformation and what reaches the recipient. Interface disclosure and machine-readable marking serve different requirements.
The Commission publishes Article 50 guidelines and a Code of Practice on Transparency of AI-generated Content. Review their current status and scope alongside the legal text when specifying notices and output marking. A voluntary code is an assessment aid, with applicability to be considered for the actual service.
What to survey, and in what order
There is one date in the near term worth establishing for yourself. Analysis of the amending regulation by White and Case reads the transitional arrangement as giving generative systems placed on the market before 2 August 2026 until 2 December 2026 to meet the machine-readable marking duty, with systems placed on the market on or after that date expected to meet it from the start. If that reading holds for your estate, the systems already carrying traffic are the ones with a date inside this calendar year, and they are also the ones hardest to change.
None of this is a large programme. It is a survey of what is already running and a decision about where in the path one property is applied. The ceiling for transparency breaches is set out in Article 99, which sets a maximum ceiling of EUR 15 000 000 or 3 % of an undertaking’s total worldwide annual turnover for the listed obligations. The higher calculation generally applies to undertakings, while small and medium-sized enterprises, including start-ups, and small mid-cap enterprises use the lower calculation for this tier. These are maximum ceilings, not expected penalties, and national rules determine their application to public authorities. The nearer operational risk is that the interface team, the platform team and the model vendor each assume one of the others owns marking, and none of them does.
What this does not tell you
This is not legal advice and it is not a classification of your estate. Whether a particular system falls inside Article 50, whether your organisation is its provider or its deployer, and what else in your position the Omnibus changed are questions for your counsel, decided against the text of the Act rather than against this article. The Omnibus text itself is Regulation (EU) 2026/1744, and it is the thing to read.
An architecture review can establish where a required notice or marking property is applied, how it survives transformations and who owns its operation. That evidence supports legal assessment without itself conferring compliance or certification.
The assistant-platform owner should review the live inventory with legal and governance colleagues. Record the relevant roles, provisions, exceptions, application dates and technical gaps. Assign responsibility for each output path before assuming the wider programme can wait.