The EU AI Act transparency rules took effect on August 2, 2026 — the same week that running an AI model got dramatically cheaper. Dr. Alex Wissner-Gross covered both developments in The Innermost Loop for August 3: Brussels beginning enforcement on one hand, and Alibaba’s Qwen3.8-Max pricing its output roughly 80% below GPT-5.6 Sol on the other, with DeepSeek’s V4-Flash undercutting frontier rates by close to two orders of magnitude. Those two stories belong together. Cognition just got cheap enough that nearly every small business is deploying AI somewhere. On the same day, disclosing that fact became a legal duty with reach across the Atlantic.
What Changed on August 2, 2026
The European Commission confirmed that from 2 August 2026 its AI Office, working with national authorities, began enforcing the AI Act — and that the new EU AI Act transparency rules started to apply the same day.
Those requirements sit in Article 50 of the Regulation, and they create four distinct duties:
- Chatbots have to admit they are chatbots, unless that is already obvious to a reasonably observant person.
- Synthetic output has to be machine-readable as synthetic. Systems generating synthetic audio, image, video, or text must mark outputs so they are detectable as artificially generated.
- Emotion recognition and biometric categorisation have to be announced to the people exposed to them.
- Deepfakes and AI-written public-interest text have to be disclosed as artificially generated or manipulated.
Pay attention to who carries each duty. The first two fall on the provider that builds or supplies the system. The last two fall on the deployer that puts it to work. Most business owners are deployers, and that distinction is where the money is.
What It Means for Business Owners
The threshold question is whether a European regulation reaches an American company at all. For most of this decade the reflex answer has been “only if you sell into Europe.” The actual trigger is broader.
Article 2 applies the Regulation to providers and deployers established in a third country “where the output produced by the AI system is used in the Union.” The test is not where your company is incorporated or where customers are invoiced. It is where the output ends up.
A support chatbot answering a question from Lisbon produces output used in the Union. A newsletter drafted by AI and read in Amsterdam arguably does too. No court has tested exactly where that line falls, and careful lawyers will disagree at the margins — but “we’re a U.S. company” is no longer the complete answer it was.
A second trap cuts directly against this week’s cheap-model news: running an open-weight model is not a way out. Article 2(12) exempts systems released under free and open-source licences from most of the Regulation — expressly not from Article 50. The inexpensive open models making headlines carry the same transparency duties as the costly closed ones.
The Legal Impact of the EU AI Act Transparency Rules
Here is where the EU AI Act transparency rules stop being a policy story and start being a contract problem.
Your AI vendor agreement probably allocates none of this
The marking duty in Article 50(2) sits with your provider. The disclosure duties in 50(3) and 50(4) sit with you. You cannot contract your way out of your own obligations — yet you depend entirely on the vendor’s marking working, because that is what makes AI output detectable at all.
Most AI vendor contracts signed in 2024 and 2025 contain no AI Act compliance representation. No warranty that outputs are marked. No duty to notify you when the marking method changes. No indemnity if a regulator finds the marking inadequate. Adding those terms at renewal costs a fraction of litigating their absence — and if a dispute follows, it lands in commercial litigation.
The editorial-control carve-out is a workflow, not a technology purchase
This is the most useful sentence in Article 50 and the least discussed. The duty to disclose AI-generated text published to inform the public on matters of public interest does not apply where that content “has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication.”
Read that as a compliance instruction. If a real person reviews AI-drafted content and a named person or entity holds editorial responsibility for it, that disclosure duty falls away. This is a documented process, not a software purchase — and most marketing teams have neither the review step nor the named owner written down anywhere. It is the documented-SOP discipline that operators in heavily regulated industries already use to survive an audit.
Two limits matter. The carve-out reaches only the deployer’s text duty. It does not excuse the provider’s machine-readable marking, and it does not cover deepfake image, audio, or video, where obligations around synthetic media and likeness apply on their own terms.
What the penalties actually look like for a smaller business
Coverage of this deadline has leaned hard on a €15 million headline. The arithmetic deserves more care. Article 99(4) caps Article 50 breaches at €15 million or 3% of total worldwide annual turnover, whichever is higher — which is where that number comes from.
But Article 99(6) provides that for SMEs and start-ups, the fine is capped at the amount or the percentage, whichever is lower. For a small or mid-sized company, realistic exposure is 3% of worldwide turnover, not €15 million. Serious, not existential. Member States set their own penalty regimes within those ceilings, so the practical number varies by country.
Customer-facing systems are the first place to look
Exposure shows up fastest wherever a machine speaks in your company’s voice. An AI receptionist answering the phone, an automated agent handling tickets, and the underlying questions of AI customer service liability all sit inside Article 50(1). The disclosure must be clear, distinguishable, and delivered no later than the first interaction — a design requirement, not a footnote in your terms of service. Businesses already living with mandatory disclosure regimes, from FTC influencer agreement rules to the advertising limits on licensed cannabis operators, will find the muscle familiar.
One honest caveat: enforcement is days old. The Commission has been developing a Code of Practice on Transparency of AI-Generated Content alongside Article 50 guidance, and Article 50(7) contemplates that mechanism for implementing the marking duties. A code of practice is not a safe harbor. What regulators treat as adequate marking, and how hard they pursue non-EU deployers, are open questions. Anyone claiming certainty is guessing.
What Howard East Clients Should Do Now
Four steps, in order:
- Inventory where AI touches the outside world. List every chatbot, automated agent, AI-drafted marketing channel, and synthetic image or voice asset you publish. Note which an EU user could plausibly reach.
- Pull the vendor agreements. Check whether any say a word about AI Act compliance, output marking, or who answers if the marking fails. Most say nothing. That silence is the finding.
- Write down the editorial workflow. Name the human who reviews AI-drafted content and the person or entity holding editorial responsibility. This is the cheapest compliance win available under the EU AI Act transparency rules.
- Fix the disclosure at the interface. Make the chatbot identify itself at first contact, legibly — not buried in a policy page nobody opens.
Call a lawyer when your product reaches EU users and no one has assessed scope, when a vendor agreement is silent on AI Act obligations and renewal is coming, when you publish AI-assisted content on public-interest topics without a documented review process, or when you are buying or selling a company whose revenue depends on customer-facing AI.
Talk to Howard East About Your AI Compliance Exposure
The EU AI Act transparency rules are the first broad AI disclosure regime with real extraterritorial reach, and they will not be the last. The businesses that come through cleanly will be the ones that treated this as a contract and workflow question in August rather than a crisis in December. Schedule a consultation to review where your systems and your contracts actually stand.
This article is for informational purposes only and does not constitute legal advice.
