Article 50 transparency obligations under the EU AI Act have applied to United States startups selling AI products in Europe since 2 August 2026, unaffected by the Digital Omnibus. The Digital Omnibus, Regulation (EU) 2026/1744, moved the Annex III high risk deadline to 2 December 2027, and many founders stopped reading there. Article 50 kept its date. A startup that sells a chatbot, an AI agent, or a generative tool to a European customer already owes disclosure and content marking duties, with one grace period that closes on 2 December 2026.
The Omnibus entered into force on 27 July 2026, six days before Article 50 began to apply. The headlines about postponement describe the high risk chapter: standalone Annex III systems now wait until 2 December 2027, and Annex I systems embedded in regulated products until 2 August 2028. Transparency sits in a different chapter, and nobody moved it.
Does a startup without a European office owe Article 50 duties?
Yes. Article 2(1)(a) of the Act applies to providers placing AI systems on the Union market whether they sit in Delaware or Dublin, and Article 2(1)(c) reaches a third country provider whose output is used in the Union. One signed subscription with a German customer makes the startup a provider. The authorized representative requirement in Article 22 belongs to high risk systems, so no European entity is required for Article 50, and none is excused by lacking one.
In thirty years of counseling technology companies, I have seen one pattern repeat with every new set of rules. The customer questionnaire reaches the startup before any regulator does. A European procurement team in October 2026 asks a vendor which Article 50 duties its product meets, and the vendor that cannot produce a dated product inventory answers slowly, and sometimes loses the quarter.
What must the product itself do?
Article 50(1) requires a provider to design an AI system that interacts directly with people so that they are told they are dealing with a machine, unless that is obvious to a reasonably well informed person. For a support bot, a sales agent, or a voice agent, the disclosure belongs in the product by default. The Commission’s guidelines of 20 July 2026 say a disclosure buried in terms and conditions is insufficient, and for an AI agent they add the name of the person on whose behalf it acts.
Article 50(2) requires a provider of a system that generates synthetic audio, image, video, or text to mark the outputs in a machine readable format so that they are detectable as artificially generated. The marking must be effective, interoperable, resilient, and reliable as far as technically feasible. Assistive editing functions that do not substantially alter the input are excepted. A startup that wraps a third party model through an API is the provider of its own application, so the marking duty is the startup’s, whatever the upstream model vendor does.
The Omnibus gave one concession here. A generative system placed on the market before 2 August 2026 has until 2 December 2026 to comply with Article 50(2). A system first sold on or after 2 August 2026 gets nothing. Today, 5 October 2026, the legacy window has 58 days left, and a major new release may count as a new system, a point the text as reported does not settle.
What will European customers demand from the vendor?
European customers are deployers, and Article 50(4) puts the labeling duty on them: deepfake image, audio, and video must be disclosed as artificial, and AI generated text published to inform the public on matters of public interest must be disclosed unless a human has reviewed it and a person holds editorial responsibility. Article 50(3) requires a deployer of an emotion recognition or biometric categorization system to inform the people exposed to it. Article 50(5) sets the timing: clear and distinguishable, at the latest at first interaction or exposure.
A deployer facing those duties asks the vendor for the tooling. Expect contract language on labeling features, retention of marking, a prohibition on stripping metadata, and an indemnity for the vendor’s failure to mark. The statutory ceiling on an Article 50 fine is the greater of 15,000,000 euros or 3 percent of worldwide annual turnover under Article 99(4), and Article 99(6) reduces that for startups to the lower of the two. A customer sees the same ceiling for itself and prices the risk into the vendor’s paper.
What else changed on 2 December 2026?
The Omnibus added Article 5(1) points (ba) and (bb), which prohibit AI systems that generate nonconsensual intimate imagery and child sexual abuse material, from 2 December 2026. The prohibition reaches systems built for that purpose and systems where such outputs are reasonably foreseeable and reproducible without reasonable, proportionate, and effective safeguards. Article 99(3) fines for Article 5 violations reach 35,000,000 euros or 7 percent of turnover. An image generation startup has the same date for marking its legacy models and for showing its safeguards.
What follows after the grace period closes?
Four matters will set the practical standard. The Commission published a voluntary Code of Practice on marking and labelling on 10 June 2026, and the Omnibus removed its power to approve the Code by implementing act, which leaves signatories with evidence of good faith and no presumption of conformity. Article 50(7) still lets the Commission adopt implementing acts on common marking rules if the codes fall short. Member State authorities have not shown which cases they will pursue first. Marking text that a customer pastes elsewhere remains a technical problem with no statutory answer.
The next piece in this series covers the Article 50 clauses a European enterprise customer will put in a master services agreement, including who warrants marking, who indemnifies labeling failures, and how a startup caps that exposure before it signs.
Interested in analysis about the intersection of tech, policy and the law? Check out my Substack channel. https://theinnovationattorney.substack.com/
