On 2 August 2026, Article 50 of the EU AI Act switched on. If your product talks to people in Europe, or generates content they might see, you now have obligations that land squarely in your codebase. This is not a policy memo for the legal team to file away. It is work for whoever owns your chat interface and your content pipeline.
Here is the short version of what changed.
What the rule actually asks for
Two things matter most for builders.
First, any AI system that interacts directly with a person has to make clear that the person is talking to a machine, unless that is already obvious. Chatbots, voice assistants, support agents, the AI concierge you bolted onto your checkout flow. All of it. The disclosure has to reach the user before or at the moment they start interacting, not buried three clicks deep in a terms page.
Second, AI-generated or altered content has to carry a machine-readable mark so it can be detected downstream. Images, audio, video, and synthetic text fall in scope. Deepfakes and content on matters of public interest need a visible disclosure too, unless a human took editorial responsibility for it.
The numbers are worth internalising. Non-compliance can run up to €15 million or 3% of worldwide annual turnover, whichever is higher. There is a grace window until 2 December 2026 for generative systems already on the market to add their marking, but the interaction-disclosure rules apply now.
Why this is engineering, not paperwork
A disclosure banner sounds trivial until you count the surfaces it touches. Your chat widget on web. Your mobile app. The embedded assistant in email. The voice channel. Each one is a separate place where a user could start a conversation without knowing a model is on the other end. Retrofitting a consistent, testable disclosure across all of them is a real ticket, and it needs to survive every future redesign.
The watermarking side is harder. Machine-readable marking means adopting something like C2PA content credentials for media, or a text-provenance scheme for generated copy. That is a decision about libraries, storage, and how metadata travels when a file gets re-encoded or a CDN strips headers. If your pipeline generates a product image and then three services touch it before it ships, the mark has to survive that trip. Most teams have never tested for that.
The AI Office published a voluntary Code of Practice on transparency of AI-generated content, which gives you a recognised path to show you are doing the right thing. Treat it as a spec, not as optional reading.
How to approach it without a fire drill
Start by mapping every point where your software either talks to a user or emits generated content. That inventory is the whole job in miniature, and most teams underestimate how long the list is.
Then make disclosure a shared component, not a per-surface copy-paste. One source of truth for the wording and the trigger logic means one place to update when guidance shifts, and it will shift. For content marking, pick a provenance standard now and write an integration test that proves the mark survives your export path.
The teams that will struggle are the ones treating 2 August as a date that already passed and therefore a problem they missed. It is not a one-off. It is a new property your product has to hold, the same way accessibility or GDPR consent became permanent parts of the build rather than a launch checklist item.
We're here to help founders and teams design and build digital products that are built to scale with you, not slow you down. If you're looking to build something, get in contact with us today!