Synthetic Content Must Be Machine-Marked: The AI Act's Transparency Obligations Took Effect on August 2
Article 50 of the EU AI Act became legally enforceable on August 2, 2026. At the same time, the Digital Omnibus on AI (Regulation (EU) 2026/1744), in force since July 27, 2026, has pushed the heaviest deadlines for high-risk systems to December 2, 2027 and August 2, 2028. For companies outside the EU that assumed the deferral meant a pause, the reality is different: transparency obligations are live now, along with a compressed timeline toward the high-risk requirements landing in 2027 and 2028.
What Already Applies
The AI Act (Regulation (EU) 2024/1689) enters into force in phases, and several of them are already behind us. According to a practitioner's guide published in the National Law Review, the prohibitions on certain AI practices and the AI literacy requirements have been enforceable since February 2025. The obligations for providers of general-purpose AI models (GPAI) have applied since August 2025. And as of August 2, 2026, Article 50 — the transparency requirements — became legally enforceable.
The dates do not only apply to companies with an office in the EU. The regulation follows the use of the system, not the actor's geography: actors outside the Union that put AI systems into service in the EU, or that supply systems and content used there, fall within scope. For a US or Asian software vendor with EU customers, this means the transparency obligations are, in practice, a product requirement specification today — regardless of whether their own legal team has been following the timeline.
Alongside this sits the systemic-risk framework for GPAI models. According to the guide, systemic risk is presumed where the training compute exceeds 10²⁵ floating-point operations (FLOPs) (Art. 51(2)), but the Commission may also designate models as systemically risky based on capabilities or impact. The threshold is therefore not a guaranteed safe zone: models under 10²⁵ FLOPs can in principle still be caught by the Commission's discretion. For GPAI providers outside the EU, this means the model portfolio should be mapped against both the compute threshold and the designation mechanism.
What Article 50 Concretely Requires
The transparency obligations in Article 50 rest on one principle: users and the public must know when they are encountering AI. The National Law Review guide summarizes the practical requirements as follows: chatbots must disclose that the user is dealing with AI; synthetic audio, image, video and text must be marked in a machine-readable way; and deepfakes, as well as certain AI-generated text on matters of public interest, must be labeled as such.
For companies outside the EU, this means concrete product changes, not just policy documents. A customer service chatbot must declare that it is a machine — a change that touches interfaces, user journeys and customer communications. Synthetic content distributed in the EU must carry machine-readable markings. The latter is technical work that touches content pipelines, metadata and distribution channels: the marking must survive export, storage and publication, and it must be readable by machines, not just visible to humans. Such changes cannot be switched on overnight, and they require coordination between product teams, content production and IT.
The deepfake marking and the labeling requirement for AI-generated text in the public interest hit media organizations, communications departments and platforms that distribute content in the EU particularly hard. Here too, scope is tied to distribution within the Union, not to where the newsroom sits.
The Digital Omnibus: Deferral, Not Exemption
The most significant change in 2026 was the Digital Omnibus on AI (Regulation (EU) 2026/1744), in force since July 27, 2026. According to the guide, it mainly pushed the high-risk deadlines back and simplified certain procedures; the regulation's core requirements are unchanged. The original deadlines of August 2026 and August 2027 have thus been moved — not removed, and not watered down in substance.
The heaviest obligations for high-risk AI systems now apply from December 2, 2027 for the use cases in Annex III, and from August 2, 2028 for AI embedded in products regulated under Annex I. The guide is clear about what the deferral means: the postponement gives organizations in scope more runway — not an exemption.
Readers waiting for a pause should therefore read the numbers differently. As of November 2026, there are roughly twelve months until the first high-risk deadline and under two years until the second. The work to be done in that window — classifying which of one's own systems fall under Annex III or Annex I, obtaining vendor documentation, establishing risk management and reviewing data practices — typically takes longer than that in larger organizations. A practical starting point is therefore to use the time now for classification and gap analysis, so that the heavier workstreams (risk management, documentation, data review) can begin with a genuine head start before the deadlines approach.
Signals from Enforcement
How far has the Commission gotten with enforcement? A note on note.com from NoSuprises_AI claims that on September 1, the Commission announced that, as part of its enforcement of the AI Act, it has sent its first requests for information to more than 30 operators. This should be read with caution: the note's author states having relied on summaries of search results and not having read the primary pages, and AIMag has not independently verified the claim. It is thus doubly indirect and is presented here only as a signal about the direction of enforcement work, not as documented fact.
The signal is nonetheless relevant for planning: if the Commission has in fact moved from framework to individual inquiries, it suggests enforcement is underway in practice, not just on paper. Companies waiting for "it will take time before anyone looks at this" should expect that requests for information may arrive earlier than full-scale enforcement.
Open Questions
Several things remain unresolved in the public source material. The statutory dates and the Omnibus details above rest on legal commentary (National Law Review), not on primary sources such as the Official Journal of the European Union; companies that need to commit should verify the dates against the regulation texts themselves. The same applies to the details of the Article 50 requirements, which are reported here through the guide's summary.
Another open question is the enforcement posture toward non-EU companies. So far, the available material contains no documented cases showing how the Commission prioritizes between actors inside and outside the Union — and the reported RFI round (if confirmed) says nothing about which types of operators were contacted.
The most important practical question, however, is independent of these uncertainties: Article 50 is enforceable now, and the deadlines for the high-risk requirements in December 2027 and August 2028 are enough time to plan — but barely enough to start planning later.
Sources
- National Law Review, "EU AI Act Readiness: A Practitioner's Guide for Corporate Leaders": https://natlawreview.com/article/eu-ai-act-readiness-practitioners-guide-corporate-leaders
- NoSuprises_AI, note.com note on enforcement: https://note.com/nosuprises_ai/n/n67c7b19188bf?hl=en