TL;DR - 15 days. 4 obligations. One afternoon max.
The Digital Omnibus (provisional agreement May 2026) pushed back high-risk Annex III obligations to December 2027. A lot of founders heard "the AI Act was delayed" and put compliance on hold.
That's a mistake. Article 50 (transparency obligations) enters into force on August 2, 2026 as planned. No delay. No exemption for small companies.
Here is exactly what you need to do. Nothing more, nothing less.
The 4 obligations (5 minute checklist)
1. Chatbot & AI Interaction Disclosure (Art. 50(1))
Every AI system that interacts with a person must disclose it is AI at the first point of contact.
- Does your chatbot or support assistant say "I am an AI assistant" before the user types their first message?
- Does your AI phone system or voice assistant identify itself as AI at the start of the call?
- Is this disclosure visible and unambiguous (not hidden in terms of service or a footer)?
Penalty for non-compliance: Up to €15M or 3% of global turnover.
2. AI Content Marking & Provenance (Art. 50(2))
AI-generated content - text, images, audio, video - must be marked in a machine-readable format (metadata, watermarking, or similar).
- Are your AI-generated blog posts, marketing copy, or product images tagged as "AI-generated"?
- Do you have a system to add provenance metadata to every AI output?
- For AI systems already on the market before August 2: you have until December 2, 2026 to comply.
Penalty for non-compliance: Up to €15M or 3% of global turnover.
3. Deepfake & Synthetic Content Labeling (Art. 50(4))
AI-generated content about real people, places, or events must be visibly labeled. This covers marketing ads, social media posts, and any public-facing content.
- Do you label AI-generated images or videos of real people?
- Have you documented your human-review workflow? (This is the exception - see below.)
- Are your AI-generated marketing materials clearly distinguishable from human-created ones?
Penalty for non-compliance: Up to €15M or 3% of global turnover.
4. Risk Classification & Documentation (Art. 5, 6, 50)
Every AI system must be classified by risk level (unacceptable, high, limited, or minimal risk). You need to maintain documentation for each system.
- Do you have a document listing every AI system you use and its risk classification?
- Have you documented how each system works, what data it uses, and what decisions it makes?
- Is this documentation up to date and accessible for audit?
Penalty for non-compliance: Up to €35M or 7% of global turnover (for high-risk misclassification).
What the Digital Omnibus actually changed
Here is a clear table so you can cut through the noise:
| Deadline | Obligation | Status |
|---|---|---|
| August 2, 2026 | Article 50 transparency | Enforceable - no delay |
| December 2, 2026 | Watermarking for pre-existing AI systems | Delayed 4 months |
| December 2, 2027 | Annex III high-risk AI compliance | Delayed 16 months |
The bottom line: If you hear "the AI Act was delayed," ask which part. Article 50 was not delayed. The transparency obligations apply to every SaaS with an AI feature, regardless of size or geography.
The human-review exception (the trick most founders miss)
Article 50(4) includes an important exemption: if AI-generated content goes through human review with editorial responsibility, it does not need a separate visible label.
What this means for you:
- You use Claude or GPT to draft marketing emails? If a human reviews and approves before sending, no label needed.
- You generate product images with Midjourney? If a human selects, edits, and approves each image, the visible label requirement can be waived.
- But you must document this review process. Without documentation, the exception does not apply.
How to document it: A single line in your CMS tracking who reviewed what, a spreadsheet, or Compliance Copilot generates this automatically as part of the transparency report.
The real cost of doing nothing
The fine is one thing (up to €15M or 3% of turnover). But the real cost for a micro-SaaS is different.
Your EU customers will ask for proof of compliance. Enterprise buyers already include EU AI Act language in their procurement contracts. If you cannot produce a simple transparency statement, you lose deals. A bootstrapped founder at $50K MRR losing one enterprise deal because of a missing checkbox is a much bigger hit than the fine.
The August 2 deadline is not a theoretical threat. It is a procurement gate.
Tool comparison: Compliance Copilot vs the rest
| Compliance Copilot | Vanta | DIY | |
|---|---|---|---|
| Price | $49/mo ($9 beta) | $28K+/year | Free (your time) |
| Risk classification | Automatic | Included | Manual |
| Article 50 checklist | 15+ items | Limited | You build it |
| Transparency reports | 1 click | Coming soon | Manual |
| Setup time | 15 minutes | 1-2 weeks | 1 afternoon |
| Gap analysis | Built-in | Included | Manual |
| Human-review tracking | Automatic | Not available | Spreadsheet |
| Audit-ready PDF export | Yes | Yes | Manual |
The 3 deadlines coming up
- July 27, 2026 - Code of Practice deadline. Last day to sign the initial EU AI Act Code of Practice. Early adopters get listed publicly. (Updated from July 22 - the EU extended the deadline.)
- August 2, 2026 - Article 50 enforcement. Transparency obligations become enforceable. This is the one you need to act on now.
- December 2, 2026 - Legacy AI marking. Pre-existing AI systems must comply with machine-readable content marking.
Get compliant in 15 minutes
Compliance Copilot handles the entire Article 50 workflow: risk classification, checklist tracking, transparency report generation, and human-review documentation. All from one dashboard.
Start your EU AI Act compliance →
$49/mo for the full EU AI Act module. Founders Beta at $9/mo for the first 50 customers. 14-day money-back guarantee.