AI Act transparency obligations: what to do from 2 August 2026

First things first: provider or deployer?

The provider makes the system available, the deployer uses it in their own activity. The distinction matters because the Article 50 duties are split between the two: paragraphs 1 and 2 fall on the provider, paragraphs 3 and 4 on the deployer.

The line is not always clean. If you integrate someone else's system into your product and ship it under your own name or trademark, or you change its intended purpose, you can end up as the provider without having trained anything.

The chatbot has to be disclosed

This is Article 50(1). Whoever provides a system that interacts directly with people must make sure they know they are talking to an AI. The information is due at the latest at the first interaction, clearly and distinguishably, meeting accessibility requirements.

Burying the notice in the footer or inside the terms of service does not count. There is an exception where the artificial nature is obvious to a reasonably well-informed person, but the Commission guidance warns against leaning on it: what is obvious to whoever built the bot is not obvious to someone landing from a search.

Generated content has to be marked

This is Article 50(2), and it falls on the provider of the generative system. The marking it asks for is readable by machines, not by eyes: metadata, watermarks, provenance mechanisms. It has to be effective, interoperable, robust and reliable, as far as technically feasible.

No single technique meets all four criteria today, so in practice several layers get combined. Purely assistive editing functions and systems that do not substantially alter the input data stay outside: a spell checker does not trigger the duty.

For systems already placed on the market before 2 August 2026 the deadline is not that one: it is 2 December 2026, thanks to the Digital Omnibus.

Deepfakes have to be disclosed

Article 50(4), first sentence, a duty for whoever publishes. A deepfake is generated or manipulated content resembling real people, objects, places or events closely enough to appear authentic. Clearly fantastical content falls outside the definition: a dragon flying over Milan is not a deepfake.

For artistic, creative, satirical or fictional works a lighter form of disclosure is allowed. Lighter does not mean absent: the duty stands, what changes is how you meet it, so that it does not wreck the experience of the work.

Public-interest text has to be disclosed

Article 50(4) again, second sentence. It covers text generated or manipulated with AI and published to inform the public on matters of public interest: news, current affairs, questions of collective relevance. A product page or commercial copy usually falls outside.

The duty does not apply where the content went through human editorial review and someone takes editorial responsibility for it. This is the exception that will be claimed most often, and also the easiest to claim emptily: it has to be substantiated, because a ticked box is not an answer when someone asks about the process.

The Commission icons

The Code of Practice on Transparency of AI-Generated Content, published in final form on 10 June 2026, is voluntary and has two separately signable sections: one for providers on Article 50(2), one for deployers on Article 50(4). Its annex carries three ready-to-use, user-tested icons: fully AI-generated content, AI-modified content, and a basic icon for an informational layer.

They are free and need no attribution, but using them is optional and does not amount to compliance on its own. They make labelling recognisable: the duty to label stays yours either way.

What does not start on 2 August

The high-risk obligations were pushed back by the Digital Omnibus: Annex III stand-alone systems to 2 December 2027, Annex I AI embedded in already regulated products to 2 August 2028. National regulatory sandboxes also slip, to 2 August 2027.

This is where most of the wrong information circulates, because until a few months ago the date really was 2 August 2026. The full picture is in the current deadlines.

What you risk

Penalties reach 35 million euro or 7 per cent of worldwide turnover for prohibited practices, and 15 million or 3 per cent for breaching the other obligations, transparency included. For SMEs and startups the lower of the two amounts applies, under the proportionality principle.

In Italy the sanctioning power sits with ACN, which is also the market surveillance authority and single point of contact, while AgID is the notifying authority. Worth noting alongside it is the Italian duty under Law 132/2025: anyone practising a regulated intellectual profession has to tell clients which AI systems they use, in clear, plain and complete language.