The AI Act transparency obligation has applied since 2 August 2026

Many organisations read in the news that the AI Act had been postponed. That is only partly true: only the high-risk regime moves. The transparency obligations have applied since 2 August 2026, and those hit mid-sized business in particular.

What exactly applies

Article 50 of the AI Act asks three things that are immediately visible in practice:

• If a visitor talks to an AI system, for example a chatbot, that has to be made clear before the conversation starts.
• AI-generated or manipulated media must be marked in a machine-readable way.
• Anyone using emotion recognition or biometric categorisation has to inform the people involved.

What has not been postponed

The Digital Omnibus pushed back the obligations for high-risk use cases: standalone systems under Annex III to 2 December 2027, AI in regulated products under Annex I to 2 August 2028. That is the headline everyone read.

Unchanged: the ban on certain practices (since February 2025), the requirement of AI literacy for staff (also since February 2025, with enforcement from August 2026), the rules for general-purpose AI models (since August 2025) and therefore the transparency obligations.

Three things to check this week

This is not a big project. It is a round of checks.

• Is there a chatbot on your website? Check that the notice that it is AI appears before the first message, not somewhere on a terms page.
• Do you use AI for customer communication or published content? Decide what you mark and who checks it. Internal correspondence reviewed by a person is a different case from publicly published text.
• Who manages those settings: you or your supplier? Record that, including who applies compliance updates.

The fines

Breaching the transparency obligations carries fines up to 15 million euro or 3 percent of worldwide annual turnover. For prohibited practices that rises to 35 million euro or 7 percent. For a mid-sized organisation the chance of a maximum fine is small; the reputational damage of a complaint is not.

AI literacy is the quiet obligation

The obligation missed most often: staff working with AI must have sufficient basic knowledge. That does not mean everyone takes a machine learning course, but that people know what the system can do, where it goes wrong, which data must stay out and why you check the output.

In practice you arrange that with a readable usage policy and a short training per role. It is also the measure that prevents the most, because most GDPR risks around AI start with someone putting company data into a random tool.