Regulation (EU) 2026/1744, the Digital Omnibus on AI, has been in force since 27 July 2026. It postpones the obligations for high-risk systems to 2 December 2027 (Annex III) and 2 August 2028 (Annex I) but leaves the transparency obligations of Article 50 unchanged, and these have applied since 2 August 2026: a chatbot that talks to people must already say it is an AI. An extension until 2 December 2026 covers only machine-readable marking by generative systems already on the market. To know what falls to you, decide for each AI system you use or offer whether you are a provider or a deployer.
What the omnibus changes
The European Parliament approved the text on 16 June 2026 and the Council on 29 June; it was signed on 8 July and published on 24 July.
| Date | What takes effect |
|---|---|
| 2 August 2026 | Article 50: transparency for chatbots, generated content and text; oversight begins |
| 2 December 2026 | Extension ends for providers of generative systems already on the market; new Article 5 bans take effect |
| 2 December 2027 | High risk, Annex III systems |
| 2 August 2028 | High risk, Annex I systems |
- Annex III covers areas such as biometrics, education, employment and access to essential services, credit for example; Annex I covers systems tied to products already regulated by EU law. Before the omnibus the dates were 2 August 2026 and 2 August 2027.
- Article 4 on AI literacy now asks providers and deployers for measures that support their staff's skills, instead of ensuring, to the best of their ability, a sufficient level. The Commission and the Member States must help companies, in particular SMEs.
- The new ban covers AI systems that generate realistic images, video or audio of an identifiable person's intimate parts or sexual acts without explicit consent, and child sexual abuse material. For providers it applies when this is the system's purpose or a foreseeable result without adequate safeguards.
Anyone who breaches Article 50 risks a fine of up to EUR 15 million or 3% of worldwide annual turnover for the preceding financial year, whichever is higher. For SMEs, and after the omnibus for small mid-cap enterprises, the lower of the two applies. Member States set the penalties. Since 2 August the Commission and national authorities can enforce the Regulation; Article 50 is policed mainly by national authorities, on their own initiative or on a complaint from anyone with grounds to believe there has been a breach.
Chatbots and text: who is responsible for what
A provider develops an AI system, or has one developed, and puts it into service under its own name or trademark; a deployer uses it in a professional activity (Article 3). In our view, if the assistant on your site carries your name, you are the provider, even if another company's model sits behind it; if you use someone else's tool under their brand, they are. Cases in between have to be judged one by one.
The chatbot notice falls to the provider (Article 50(1)): the system must be designed so that people know from the first interaction that they are talking to an AI, unless that is obvious. The Commission reads the exception narrowly, and an agent that writes or books on someone's behalf must also say whom it represents. The December extension does not cover this notice.
Machine-readable marking of generated content (Article 50(2)) is another provider obligation; providers can rely on the marking of someone else's model but must be able to show that it works. The code of practice on transparency of AI-generated content, published on 10 June 2026 and judged adequate by the Commission and the AI Board, is voluntary. For audio, images, video and text inside a file (PDF, Word, HTML) it asks for digitally signed metadata plus an imperceptible watermark; for the free-form text of a website or chat, which cannot carry metadata, the watermark alone is enough, required above 200 tokens. About 190 organisations had signed it by the end of July.
Anyone who uses AI to write has a second obligation, Article 50(4): AI-generated or rewritten text published to inform the public on matters of public interest must be labelled. For the Commission these include, among others, politics, public administration, justice, public health, the environment, consumer safety and economic or scientific developments open to public debate. The guidelines leave out advertising copy and product descriptions, unless they make claims on topics such as health, consumer safety or sustainability. Text published before 2 August 2026 does not have to be labelled afterwards.
The duty falls away if the text has had human review or editorial control and someone answers for the publication. For the guidelines a review is an examination of substance, with fact-checking, by competent people: grammar corrections, an editorial policy on paper or an automated check are not enough. They also ask for the name and contact details of the person responsible to be made public.
What to do now
- List the AI systems you use or offer and note for each whether you are a provider or a deployer: the obligations depend on it.
- Check that every chatbot says it is an AI from the first message, on the site and in apps: it has applied since 2 August 2026.
- Name who answers for the texts you publish, make their name and contact details public, and have texts on matters of public interest reviewed on substance.
- Ask your providers how they mark content, whether they have signed the code and what their terms of use say about metadata; for systems already on the market the deadline is 2 December 2026.
- Run a short internal course on using AI and keep a record of who attends: Article 4 does not say which measures are needed.
- Note the uses that could fall under Annex III, such as recruitment or credit: the deadline is 2 December 2027, but it is better to map them now.
What we check in a chatbot project
Our AI automation and chatbot service covers conversational assistants and document processing inside a company's workflows, with control over costs and answer quality: Article 50 concerns exactly these assistants. If you ask us for a check, we start from four points and write them down in the analysis, before any code: the opening message that declares the AI; who is provider and who is deployer; who reviews the texts the assistant produces for the site and answers for them; what the model supplier's terms of use say about marking. The result is a document that people who are not technical can read. We do not give legal advice: if the provider role or the public interest of a text is in doubt, a lawyer is needed.
What we do not know yet
- It is unclear how reliable text watermarks will be: the code admits they may be less reliable and allows providers to limit detection to verified experts for a period, so you may not be able to check a marked text yourself.
- The guidelines are not binding: the final interpretation belongs to the Court of Justice of the EU and the Commission will revise them as experience builds, so doubtful cases remain open.
- For Italy the Commission lists the Agenzia per la cybersicurezza nazionale as single point of contact, but the official sources do not say which authority will handle Article 50 cases, and they report no penalties applied so far.
If you want us to look at your assistant or your text workflow together, get in touch: we work on AI automation and chatbots.
Sources
- EUR-Lex: Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI)
- EUR-Lex: Regulation (EU) 2024/1689 (Artificial Intelligence Act)
- EUR-Lex: Procedure 2025/0359/COD: Digital Omnibus on AI
- European Commission: Guidelines on transparency obligations for providers and deployers of AI systems
- European Commission: Transparency obligations under Article 50 of the AI Act
- European Commission: Code of Practice on Transparency of AI-generated Content
- European Commission: Commission starts enforcing AI Act rules and new transparency requirements on 2 August
- European Commission: Market Surveillance Authorities under the AI Act
