EU AI Act Transparency Rules: What Actually Changed on 2 August 2026

On 2 August 2026 the EU AI Act stopped being a planning exercise. The transparency duties in Article 50 became enforceable that day, and national market surveillance authorities began supervising the AI literacy obligation in Article 4.

The part most companies spent 2025 budgeting for — the high-risk regime — is not what arrived. It moved to December 2027.

So the obligations that landed are the ones almost nobody built a programme for: telling people when they are talking to a machine, marking synthetic content, and being able to show that your staff know what they are doing with AI.

What Changed on 2 August 2026?

Three things became live: Article 50 transparency duties, national supervision of the Article 4 AI literacy obligation, and a shifted calendar for everything else. The Commission confirmed on 31 July that the AI Office and national authorities would begin enforcing from 2 August, alongside a voluntary Code of Practice on transparency of AI-generated content that more than 180 organisations have already signed.

The calendar is the fastest way to see what you actually owe and when.

The delays came through the 2026 Digital Omnibus, analysed in detail by Gibson Dunn and Jones Walker. Both reach the same conclusion: the high-risk postponement did not touch transparency, and 2 August still mattered.

What Do the Transparency Rules Actually Require?

Article 50 turns five everyday AI behaviours into disclosure duties. They apply to ordinary tools — support chatbots, marketing image generators, voice agents, drafting assistants — not just to systems anyone would call high-risk. The Commission's quick facts page is the clearest summary of scope.

In practice:

1. Interaction disclosure (50(1)). If a person is talking to a chatbot, an agent or an AI avatar, they have to be told — unless it is obvious to a reasonably well-informed, observant and circumspect person.
2. Synthetic content marking (50(2)). Providers of systems generating synthetic audio, image, video or text must mark the outputs in a machine-readable format, detectable as artificially generated or manipulated.
3. Emotion recognition and biometric categorisation (50(3)). Deployers must inform the people exposed to the system that it is operating, and process the personal data in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable. Read this one next to Article 5(1)(f), which prohibits inferring emotions in the workplace and in education institutions altogether, except for medical or safety reasons. If someone is pitching you sentiment analysis on employee calls, where it infers emotion from voice or other biometric signals, that is the article to quote.
4. Deepfake disclosure (50(4)). Deployers publishing AI-generated or manipulated image, audio or video content constituting a deep fake must disclose that it has been artificially generated or manipulated.
5. AI text on matters of public interest (50(4)). Text published to inform the public has to be labelled as AI-generated — unless a human reviewed it and someone holds editorial responsibility for it.

Why the High-Risk Delay Doesn't Buy You Time

The AI literacy obligation was not delayed, and as of 2 August it has a supervisor. The Commission's guidance names the national market surveillance authorities "which start supervising and enforcing the rules as of 2 August 2026".

What did change is the wording. The Commission now describes Article 4 as requiring providers and deployers "to take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf" — and adds, in terms: "This does not imply that a certain level of AI literacy of any individual is required."

Read that carefully before relaxing. It removes the phantom obligation to certify every employee at a fixed standard. It does not remove the obligation to have done something deliberate, proportionate to role and context, and demonstrable when a regulator asks. If anything, a softer standard shifts the burden from a certificate you can buy to a practice you have to show.

We covered the underlying duty in detail in our guide to EU AI Act Article 4 and AI literacy. The short version: it is sector-agnostic, size-agnostic, applies regardless of risk class, and reaches contractors and vendors operating AI on your behalf.

Transparency Is a Workforce Skill, Not a Legal Document

Every one of the new duties resolves to a decision an individual employee makes, usually in under a minute, with no lawyer present. Someone drafts a customer response and decides whether to disclose. Someone generates a campaign image and decides whether to mark it. Someone publishes a summary and decides whether they have actually reviewed it.

The evidence says those decisions are being made badly right now — not maliciously, but reflexively.

An employee who cannot explain the output they just sent has not performed the human review that Article 50 relies on. That is not a compliance gap you close with a policy PDF. It is a capability gap — the same supervision work that follows every AI output, now with a legal consequence attached — and the shadow AI dynamic that kept it invisible is what makes it a live regulatory risk today.

What to Do in the Next 90 Days

Start from your AI inventory, not your policy library. Enforcement questions will be concrete: which systems, which disclosures, which people, what did you teach them, and when.

Five moves that hold up:

1. List every place your organisation shows AI output to a person. Support chat, voice menus, generated imagery, published copy. Each one maps to one of the five duties above.
2. Fix the machine-readable marking at the tool layer. Watermarks and provenance metadata are a procurement and configuration job, not something a workforce can do by hand. Check what your vendors already emit.
3. Make the human-review standard explicit. Write down what "reviewed" means for your content: claims verified, sources checked, a named owner. Then teach it as a skill.
4. Tier your literacy programme by role. The Commission asks for proportionality. Executives, front-line users, technical teams and procurement need different depth — and that is the same tiering good enterprise AI training uses anyway.
5. Keep records. What was delivered, to whom, when, on what topic. The proficiency bar softened; the evidentiary expectation did not.

The organisations that will find August 2026 uneventful are not the ones with the thickest AI policy. They are the ones where a person who generated something can tell you what it says, where it came from, and why they trust it. That is a daily practice, and the next enforcement date is already on the calendar.