AI Act Transparency From 2 August 2026: A Practical Checklist for Websites, Freelancers, and Small Teams

Article 50 of the EU AI Act starts applying on 2 August 2026, bringing specific transparency rules for certain AI systems. For a small website, this does not mean placing a warning on every sentence that has been polished with ChatGPT. It does mean taking a closer look at an AI chat interface that appears human, a realistic synthetic video, or public-interest text that is generated and published without meaningful editorial control.

The first distinction to understand is between two legal roles. A provider develops an AI system—or has one developed—and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority in a professional context. A freelancer, publisher, or small business using a third-party generator will usually be a deployer rather than the provider of the underlying model. A white-label product, a materially modified system, or a service released under the organisation’s own brand may require a different assessment.

This guide was checked on 18 July 2026. The Commission’s final Article 50 guidelines had not yet been published on that date, so organisations should check for an update before 2 August. This is a practical editorial guide, not legal advice for a particular organisation or project.

What changes on 2 August 2026

Under Article 113 of Regulation (EU) 2024/1689, most of the AI Act applies from 2 August 2026. That includes Article 50, which addresses four broad situations:

1. an AI system interacts directly with a person;
2. a system generates synthetic text, images, audio, or video;
3. an organisation deploys emotion-recognition or biometric-categorisation systems;
4. an organisation publishes a deepfake or certain AI-generated text intended to inform the public on a matter of public interest.

These are not interchangeable “label all AI” rules. Each obligation has a particular addressee, trigger, form of notice, and set of exceptions.

Legislative status as of 18 July 2026: the politically agreed AI Omnibus proposal includes a targeted four-month transition for providers of certain generative systems placed on the market before 2 August, covering the machine-readable marking duty in Article 50(2). However, the Commission’s current FAQ describes that rule as conditional on final adoption. It is not a general postponement of Article 50, and it should not be treated as permission for deployers to delay deepfake or public-interest text disclosures.

Who may be within scope

The Regulation covers providers placing AI systems on the EU market, deployers established or located in the EU, and certain providers and deployers outside the EU where the system’s output is used in the Union. A global domain name or the mere technical possibility of opening a page from Europe does not, by itself, answer every territorial-scope question. The organisation’s role, target market, audience, contracts, and the actual use of the output all matter.

A natural person using AI in a purely personal, non-professional activity is excluded from deployer obligations. Work performed for a client, a business newsletter, a company support channel, or an editorial website is not purely personal use.

A useful first triage consists of three questions:

• Are we simply using someone else’s AI service, or are we offering a system under our own name?
• Is the activity connected to an EU establishment, customer, market, or use of the output in the EU?
• What does the person actually encounter: an AI conversation, synthetic media, a deepfake, automatically published text, or a human-controlled draft?

The four Article 50 rules in practical terms

1. People should know when they are interacting with AI

The provider of an AI system intended to interact directly with people must design and develop it so that the people concerned are informed that they are interacting with an AI system. The notice is not required where this is obvious to a reasonably well-informed, observant, and circumspect person, taking the circumstances and context into account.

For a website owner, the safe practical approach is straightforward: do not present a bot as “Maria from support” without explaining what it is, and do not hide the explanation solely in a privacy policy. A short notice such as “This conversation is handled by an AI assistant” should appear before or at the first interaction. If a human can take over, explain how that works as well.

When the interface comes from a third-party vendor, check what visitors actually see after branding, translation, and design changes. A contractual promise from the vendor is not a substitute for testing the live interface.

2. Machine-readable marking is primarily a provider duty

Providers of AI systems—including general-purpose AI systems—that generate synthetic audio, image, video, or text content must ensure that outputs are marked in a machine-readable format and can be detected as artificially generated or manipulated. The technical measures must be effective, interoperable, robust, and reliable as far as technically feasible, taking account of content-specific limitations, implementation costs, and the generally acknowledged state of the art.

This is different from a visible caption. The relevant techniques may include metadata, watermarking, cryptographic provenance, fingerprints, or other detection methods. Article 50(2) addresses the provider of the generating system, not every blogger who downloads an image produced by it.

The paragraph contains an exception to the extent that a system merely performs an assistive function for standard editing or does not substantially alter the input data or its semantics. A website owner should not casually transfer that provider-side exception to every other part of Article 50. It does not mean that all obligations disappear whenever a person briefly looks at an AI output.

As an operational practice, preserve provenance information supplied by a generator and avoid stripping metadata without a reason. This supports traceability, even though a deployer’s visible disclosure duty depends on the type and use of the content.

3. Not every AI-generated image is a deepfake

The AI Act defines a deepfake as AI-generated or manipulated image, audio, or video content that resembles existing people, objects, places, entities, or events and would falsely appear to a person to be authentic or truthful. A deployer using AI to produce or manipulate such content must disclose its artificial origin.

A generic illustration of a server room, a fictional robot, or an abstract background does not become a deepfake simply because a generator created it. A synthetic video of a real executive, a fabricated photograph of an actual building after an alleged accident, or a cloned recording of a recognisable person is a different matter.

For evidently artistic, creative, satirical, fictional, or analogous works, the disclosure obligation does not vanish. It may be provided in an appropriate way that does not hamper the display or enjoyment of the work.

4. Public-interest text has an important editorial exception

Where a deployer uses an AI system to generate or manipulate text that is published for the purpose of informing the public on matters of public interest, the artificial origin of that text must be disclosed. The rule may be particularly relevant to news and material concerning elections, public safety, health, individual rights, government policy, or events that matter to a community.

Article 50(4) also contains a significant exception. Disclosure is not required where the AI-generated content has undergone a process of human review or editorial control and a natural or legal person holds editorial responsibility for its publication. Those are two conditions, not a magic “reviewed by a human” checkbox.

For a publication, that means assigning a responsible editor, checking claims and sources, correcting the draft, recording the review, and accepting responsibility for the final version. A quick glance at an automatically generated article is not a convincing editorial-control model.

An organisation may still choose to describe its editorial process voluntarily, even when the exception applies. That can build trust. It is nevertheless inaccurate to claim that the AI Act requires a label on every article where AI assisted with an outline, translation, spelling, or stylistic revision.

Common small-organisation scenarios

• Customer-support AI chat: display a clear AI notice when the conversation opens and provide a route to a human where appropriate.
• Generated article cover: ask whether it imitates a real person, location, organisation, or event in a way that could look authentic. If it does, use a visible disclosure.
• AI voice resembling a real person: treat it as a potential deepfake and separately assess consent, copyright, personality, and data-protection issues.
• A news item generated automatically from a press release: either disclose its AI origin or put it through meaningful human editorial control with an identified responsible publisher.
• Product copy or advertising: it is not automatically a public-interest publication, but consumer-protection, advertising, and unfair-commercial-practice rules still apply.
• A freelancer preparing work for a client: state in the contract who verifies facts, who decides whether a disclosure is needed, and who assumes editorial responsibility when the work is published.

These decisions are easier to apply when they live in one internal document. RozumTech’s practical AI-use policy structure for a small business provides a foundation that can be extended with transparency rules.

A checklist for 2 August

1. Build an AI-use inventory. Include chat interfaces, text and media generators, translation tools, voice services, and automated publishing workflows.
2. Identify your role for each system. Are you deploying a third-party tool, or offering a system under your own name or trademark?
3. Record the EU connection. Note where the organisation operates, who receives the output, and whether it is used in the EU.
4. Separate technical marking from visible disclosure. They are different obligations addressed to different actors.
5. Test every AI chat. The notice should be available at the first interaction, not buried in terms and conditions.
6. Review synthetic media. Flag items that plausibly imitate real people, places, organisations, objects, or events.
7. Create an editorial route for public-interest text. Assign a reviewer, define source and publication standards, and name the person or organisation taking responsibility.
8. Prepare short, localised notices. They should be understandable in the audience’s language, clear, distinguishable, and accessible.
9. Preserve provenance where appropriate. Retain original files, supplied metadata, tool versions, and records of material edits.
10. Review vendor contracts. Ask how the provider supports machine-readable marking, detection, documentation, and future Article 50 updates.
11. Keep evidence. Interface screenshots, notice templates, review logs, and assigned responsibilities demonstrate more than a policy that is never followed.
12. Check the final Commission guidelines. As of 18 July, only the draft Article 50 guidelines are publicly available.

Examples of clear notices

• “This conversation is handled by an AI assistant. You may ask to have your request transferred to a person.”
• “This image was generated or materially altered using AI.”
• “This video contains a synthetic depiction of a real person.”
• “AI assisted with the initial draft; RozumTech’s editors verified the claims and approved the final text.”

The final example may be voluntary where proper editorial control brings the publication within the Article 50(4) exception. A notice should describe what actually happened, not create the appearance of a review that never took place.

The Code of Practice, penalties, and the limits of this checklist

The Code of Practice on Transparency of AI-Generated Content was published on 10 June 2026. Signing it is voluntary; declining to sign is not, by itself, a breach of the AI Act. The Code provides practical measures for machine-readable marking and the labelling of deepfakes and public-interest AI text. The AI Office set 27 July as the deadline for inclusion in the initial list of signatories, although eligible organisations may join later.

Article 99 sets maximum administrative fines for non-compliance with Article 50 at €15 million or 3% of an undertaking’s total worldwide annual turnover. These are ceilings, not automatic penalties for an imperfect caption. For SMEs, including start-ups, the lower of the applicable fixed amount or percentage applies. Authorities must also consider factors such as severity, duration, harm, operator size, cooperation, responsibility, and remedial action.

For a small team, the most useful preparation is not a stack of generic legal documents. It is an accurate map of AI tools, honest notices at the correct point of interaction, a genuine editorial-review process, and records showing how that process works.