By ByteBot
The EU AI Act stopped being theoretical on August 2, 2026. That day, the European Commission’s AI Office gained formal powers to investigate AI companies, demand access to models, and issue fines reaching 3% of global annual revenue. Anthropic and OpenAI are already named in early scrutiny reports. If your product reaches European users and includes any AI feature — a chatbot, a content generator, a recommendation engine — you have legal obligations today. Most development teams haven’t acted.
Here is what you actually need to do, in order of urgency.
Your Chatbot Needs to Say It’s an AI (Article 50)
Article 50 is the rule that affects the widest range of products, and it is active now. Any AI system that interacts directly with people — chatbots, AI agents, voice assistants, automated support tools — must tell users they are talking to an AI at the start of the interaction. Not in the terms of service. Not in a help article. At the beginning of the conversation, in wording that is “clear and distinguishable.”
This obligation lands on both the provider (the company that built the AI system) and the deployer (the company that integrated it into their product). If you built the chatbot SDK, you’re responsible for making disclosure technically possible. If you’re the SaaS team that embedded it, you’re responsible for the actual user-facing notice. Neither party gets to pass the obligation to the other.
The European Commission published implementation guidelines on July 20, 2026, and they are unambiguous: a footnote reference does not satisfy Article 50. The disclosure must be prominent and immediate. If you have not added this to your product already, that is the action to take this week.
Machine-Readable Watermarking: The Engineering Work Ahead
Article 50 also requires that AI-generated content — images, video, audio, and text published on matters of public interest — carry machine-readable provenance data. The standard gaining the most traction is C2PA (Coalition for Content Provenance and Authenticity), already deployed by Adobe Firefly, OpenAI DALL-E 3, and Google Imagen. Anthropic began shipping C2PA metadata with Claude outputs and invisible text watermarks on August 2.
The watermarking requirement is technically demanding. The marks must survive common processing steps: compression, cropping, format conversion. Single-layer approaches — just metadata, or just a visible label — do not satisfy the regulation. You need embedded provenance data plus an imperceptible pixel-level or content-level watermark.
There is some breathing room here. AI systems already on the market before August 2, 2026 have until December 2, 2026 to implement machine-readable marking. Systems deployed after August 2 must comply from launch. If you ship a new AI feature before December, plan for C2PA implementation from day one.
What Is Flat-Out Banned (Article 5)
Regulation is not the only thing that kicked in on August 2. The prohibitions under Article 5 are categorical bans — not compliance obligations, but legal prohibitions on entire categories of systems. Violations carry penalties up to €35 million or 7% of global annual turnover, whichever is higher.
The banned list includes:
- Social scoring systems that use behavioral data to make decisions affecting people’s life outcomes
- Real-time biometric surveillance in publicly accessible spaces (narrow law enforcement exceptions do not apply to commercial software)
- Emotion recognition systems used in workplace or educational contexts
- Untargeted scraping of facial images to build recognition databases
- Biometric categorization systems that infer race, political opinion, religious belief, or sexual orientation
If any of these appear in your product roadmap or existing feature set, the time to stop is now. The EU AI Office’s preferred first step is a “technical compliance dialogue,” but that dialogue happens after they have identified a potential violation. Per the official Article 50 text, these prohibitions are not conditional — they apply regardless of safeguards you put around the system.
If You Are Building Foundation Models (GPAI Obligations)
Developers shipping general-purpose AI (GPAI) models — including fine-tuned releases and open-weight models distributed in the EU — face a separate enforcement track under Chapter V. The AI Office can now request technical documentation, access models for evaluation, and require corrective action.
There are two obligation tiers. The baseline tier (Article 53) covers technical documentation, training data transparency, and copyright compliance. The systemic risk tier (Article 55), which applies to models trained above roughly 10²⁵ FLOPs, adds adversarial testing, incident reporting, and cybersecurity requirements.
Timeline note: GPAI models available before August 2, 2025 have until August 2, 2027 to comply. Models released after that date have been in scope since launch. If you released or updated a model in the past year without documentation in place, you are likely out of compliance.
If You Are a Small Team: No Exemption, But Real Proportionality
The AI Act does not contain a size exemption. If your product reaches EU users, you are in scope regardless of team size. What differs for smaller organizations is penalty structure: larger enterprises pay the higher of the fixed fine or the revenue percentage; SMEs pay the lower. That is meaningful for a ten-person startup but is not a compliance strategy.
The more practical support for small teams is the regulatory sandbox program. Every EU member state was required to have at least one AI regulatory sandbox operational by August 2, 2026. These allow companies to test products in a supervised environment and get compliance guidance before a full market launch — a genuinely useful resource if you are building an AI product targeting EU markets and have not started compliance work yet.
What to Do Before December 2, 2026
The next hard deadline is December 2, 2026, when the machine-readable marking grace period expires for existing systems. Between now and then, the EU AI Office will be running compliance dialogues and building enforcement precedent. Starting those conversations now — while the preference is still for dialogue over fines — is a better strategy than waiting to be contacted.
For most development teams, the immediate priority list is short: add the Article 50 chatbot disclosure, plan the C2PA watermarking implementation, and audit your product for Article 5 red lines. The regulation is not demanding perfection in August. It is demanding visible effort and a clear compliance trajectory.
The window for “we didn’t know” is closed. The window for “we’re working on it” is still open — but not indefinitely.
