On 2 August 2026 the EU AI Act entered its general application phase: transparency duties for AI systems and enforcement powers over general-purpose AI models are now live across the EU.
If you ship chatbots, agents, or any feature that generates content, this guide shows you exactly what applies today, what was deferred to 2027–2028, and what to do this week.
1. Context: What Actually Applies in August 2026
The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in phases — there is no single start date. Prohibited practices and AI literacy duties have applied since 2 February 2025, GPAI model rules since 2 August 2025, and the general application including Article 50 transparency duties since 2 August 2026.
Confirmed timeline (official EU sources)
The Omnibus shifted high-risk — nothing else
The Digital Omnibus (political agreement May 2026, in force 27 July 2026 per the Commission) deferred only the high-risk dates to December 2027 and August 2028. Prohibitions, GPAI duties, and transparency duties were NOT deferred — they apply on their original dates.
Practical consequence: almost every team reading this is a deployer, not a GPAI provider. Your August 2026 work is transparency, vendor assurance, and literacy evidence — not conformity assessments. Those come later, but the documentation you write now becomes the evidence you will need then.
2. Four Implications for Developers Shipping AI Features
These are the four duties that actually touch product and engineering work today. I ordered them by how likely they are to hit your codebase.
Chatbot and agent disclosure
Art. 50(1) · Provider duty
Any conversational system must disclose it is AI unless it is obvious to a reasonably informed user. Ship a visible first-message disclosure and keep it in every new session — a tiny footer nobody reads will not convince a regulator.
Synthetic content marking
Art. 50(2) · Provider duty
AI-generated images, audio, and video need machine-readable marking plus human-visible labelling where applicable. If you wrap a GPAI image or voice API, verify your provider emits the marks — and get it in writing in the contract.
Deepfake and emotion-AI labelling
Art. 50(3)–(4) · Deployer duty
If YOU deploy emotion recognition, biometric categorisation, or publish deepfakes and public-interest AI text, the disclosure duty stays with you — no procurement clause moves it. Audit avatars, voice clones, and testimonial-style outputs first.
GPAI vendor assurance
Chapter V · Since Aug 2025
Your base-model provider owes technical documentation, training-data summaries, and copyright compliance. Collect those docs now: which model, which version, what documentation exists, and what your contract passes through. You inherit risk from your supplier.
Minimal disclosure pattern I recommend
A visible, persistent pattern beats a one-time toast. This is the shape I ship in every AI chat surface:
function AiDisclosure() {
return (
<p data-ai-disclosure>
You are chatting with an AI assistant. Verify
important facts before acting on them.
</p>
);
}
// Checklist per release:
// [ ] disclosure visible on first message
// [ ] synthetic media carries machine-readable marks
// [ ] provider docs + model version pinned in repoDo not confuse roles
Placing a system on the market under your own name, substantially modifying a model, or repurposing it can flip you from deployer to provider — with provider duties attached. White-labels and heavy fine-tunes deserve a second look from legal.
3. What to Do This Week
A focused week beats a six-month compliance project that never starts. Here is the sequence I would run with any product team:
☀️ Days 1–2: Inventory and classify
- 1. List every AI feature: chatbot, agents, RAG search, image/voice generation, scoring or ranking.
- 2. Mark each against the four Art. 50 duties and note provider vs deployer for every row.
- 3. Flag anything near prohibited practices (manipulation, exploitation of vulnerabilities, social scoring, real-time remote biometrics).
📅 Days 3–4: Fix transparency gaps
- Chat surfaces: add visible AI disclosure and log where it renders.
- Generated media: confirm machine-readable marks with your provider; store the evidence.
- Deepfake exposure: label avatars, cloned voices, and AI testimonials before they ship.
📆 Day 5: Lock vendor and literacy evidence
- Vendors: collect GPAI docs, model versions, and contract pass-throughs in one folder.
- Literacy: record AI-literacy measures per role — market surveillance of this duty has begun.
- Roadmap: if Annex III high-risk is plausible (hiring, education, credit, biometrics), start the doc file now for December 2027.
4. Fines, Enforcement, and What Was Deferred
Enforcement is now shared between the Commission’s AI Office (GPAI models and related systems), the EDPS, and national market-surveillance authorities. The AI Office can request documentation, evaluate models, demand corrective measures, and the Commission can fine.
Prohibited practices
Up to €35 million or 7% of worldwide annual turnover, whichever is higher. Applies since February 2025 — already actionable.
GPAI duties
Up to €15 million or 3% of worldwide annual turnover. Commission fining power live since 2 August 2026.
Info requests
Incorrect, incomplete, or misleading replies to information requests can also draw fines — up to the same GPAI ceilings.
What was genuinely deferred
Core high-risk obligations (risk management, data governance, logging, technical documentation, conformity assessment, EU database registration, CE marking, human oversight) now bite on 2 December 2027 for Annex III standalone systems and 2 August 2028 for Annex I product-embedded systems. Use the runway to build documentation as you go — reconstructing it in 2027 from a running system costs several times more.
Golden rule for 2026
If it faces the user or generates content, disclose and mark it now. If it scores people for hiring, credit, education, or law enforcement, start the high-risk file now and finish it by December 2027.
Conclusion
August 2026 did not bring a single big-bang obligation — it switched on transparency and GPAI enforcement while giving high-risk systems a longer runway to December 2027 and August 2028. For most developers, that means disclosures, content marking, vendor docs, and literacy evidence today.
Do the one-week sprint above and you will be ahead of most teams: compliant on what applies now, and already building the paper trail the high-risk deadlines will demand later.
This week in one screen
Disclose
- • Chatbot AI notice
- • Synthetic media marks
- • Deepfake labels
Document
- • AI feature inventory
- • GPAI vendor folder
- • Literacy evidence
Defer (but start)
- • Annex III → Dec 2027
- • Annex I → Aug 2028
- • Write docs as you go
