Since last August, if you run a support chatbot, a voice assistant or an avatar that serves your customers, the law demands one specific thing: those people have to know who they are talking to. The EU AI Act (Regulation 2024/1689) is no longer a draft on a shelf: the Commission made it clear on 2 August 2026, when the bulk of the regulation started to apply.
Until now, many companies treated the Act as a distant forecast. Two dates have wiped that idea out. The first, 2 August 2026: the Article 50 transparency rules and fines for general-purpose model providers are now in force. The second comes on 2 December 2026: content-generation systems already on the market must comply with machine-readable marking, and new bans on non-consensual intimate imagery take effect.
What Article 50 asks of your business
The Act separates two roles: the provider, who develops and sells the system, and the deployer, the company that uses it in its operations. If you buy or deploy a chatbot, an assistant or a content-generation system, you are a deployer, and your obligations are these:
- Say that you talk with AI. When a client interacts with a chatbot, a voice agent or an avatar, they must know it is not a person, unless that is obvious from the context.
- Mark synthetic content. If your system generates text, images, audio or video, it must carry machine-readable marks that identify it as generated. Systems already on the market before 2 August have until 2 December 2026.
- Label deepfakes visibly. Image, audio or video that looks like a real person, object or event and is AI-manipulated: clear, visible labelling.
- Warn about biometrics and emotion. If you run emotion recognition or biometric categorisation (adaptive UX, call analysis with mood detection), the people exposed to it must be told.
- Human oversight where the Act requires it, and AI literacy in the team. That last one has been in force since February 2025, although most companies have not implemented it yet.
Fines back this up. Transparency breaches can reach 15 million euros or 3% of global annual turnover, whichever is higher. SMEs and startups get proportionality: the lower of the two applies, which lowers the ceiling a lot. And if your company fine-tunes or substantially modifies a third-party model, be careful: a substantial modification can turn you into a provider in the eyes of the law, with technical documentation and copyright policy duties.
There is good news in the calendar too. The Digital Omnibus package (Regulation 2026/1744) postponed stand-alone high-risk systems (HR, credit scoring, biometrics) to December 2027, and AI embedded in regulated products to August 2028. The deadline gained room; it did not disappear. If your company runs recruitment or customer scoring, the design work starts now: document, define who supervises, decide what you will not automate.
What to do in practice before December
For a business that runs chatbots and generative systems, the 2026 phase comes down to five jobs:
- Inventory. Where your company uses AI: support chatbots, email autocompletion, image generators for the catalogue, call analysis. Each system gets its classification.
- Visible disclosure. The "you are talking to an AI assistant" notice on the contact page, the website and the bot's replies. Write the actual text, not a footer note nobody reads.
- Content marking. The metadata that makes an image or a text detectable as generated. For catalogue photos made with AI, this applies too.
- Vendor review. Ask your model providers what documentation they hand over and whether they signed the Code of Practice. Amazon, Anthropic, Google, Microsoft, OpenAI and Mistral have signed it.
- Incidents and logging. Define who detects a serious failure, who reports it and within which deadline: the Act asks for real reporting channels, not a shared inbox.
None of this list asks for new technology. It asks for documented decisions about what you already have.
At Luxion we build the chatbots, internal copilots and e-commerce assistants that are already serving businesses across Europe, and we are deployers ourselves when we ship them. We design the Article 50 adjustments (identity notices, content marks, conversation traces) so compliance is baked in rather than bolted on. If your platform carries assistants and you are unsure you meet the dates, reach out for a review and we will open it in order of risk: first what is already enforceable, then what lands on 2 December, then 2027.