Parts of the EU AI Act were delayed, but Article 50 transparency duties were not. Here is what boards and technology leaders should check now.
ai-embed Insights · 29 October 2026
Ask most senior leaders where their organisation stands on the EU AI Act and you will hear a version of the same answer: it was delayed, so we have time. It is a reasonable belief, and it is only half right. The half that is wrong is the half that already applies to organisations deploying AI in front of customers.
The delay that made the headlines concerns high-risk systems under Annex III, such as those used in recruitment and lending. Those obligations do not land until December 2027. Article 50, the transparency provision, was never part of that postponement and has applied on schedule. For many organisations, the compliance clock they believed was paused has been running for months.
The EU AI Act is not a single obligation with a single date. It is a set of distinct provisions, each with its own timetable, and the postponement of one does not move the others. Treating "the AI Act was delayed" as one fact is how organisations end up compliant with the deadline they were watching and exposed on the one they were not.
This matters because the delayed provisions are the ones that demand heavy preparation: risk management, documentation and conformity work for high-risk systems. It is natural to defer that work, and deferral is a sensible use of time where the law allows it. The trouble starts when the same reasoning is applied to provisions that are already live and that are far simpler to meet. Article 50 is exactly that kind of provision. The effort required is modest, which makes it all the more uncomfortable to be found out of step.
The obligations are narrow but clear. Any chatbot or conversational AI system that interacts with the public must tell people they are dealing with AI, not a human. This is a legal requirement, not a design preference, and convenience or a smoother user experience is not an exemption. Separately, AI-generated content, whether text, image, audio or video, needs a visible or technical marking that identifies it as synthetic. Benign intent does not create a carve-out for deepfakes.
The point most often misunderstood is who is responsible. Liability sits with the deploying organisation, not the model provider. Building on a well-known foundation model from a major AI lab does not move your obligation to that lab. If your organisation runs the chatbot, publishes the generated content or embeds the capability in a customer-facing product, the duty is yours. That includes the support assistant a business unit configured last quarter, the marketing imagery produced by an agency using generative tools, and the third-party widget on your website that nobody in technology remembers approving.
The penalty exposure is significant: up to €15 million or 3% of global annual turnover, whichever is higher.
The fine is the lesser concern for a board. The more telling question is how obligations are tracked inside the organisation. If a regulation's progress is summarised in one line, and that line says "delayed", then nobody is reading the provisions individually. That is an assurance gap rather than a legal one, and it tends to recur across regulatory regimes, not only this one.
Proportionate compliance does not mean waiting for the large, visible deadline and assuming everything else follows it. It means that someone is accountable for reading each provision, working out which are live and which are ahead, and reporting that distinction upward accurately. Boards should be asking whether the information reaching them has that level of resolution, or whether it has been flattened into a reassuring headline.
Start with an inventory of every public-facing AI touchpoint, including those owned by marketing, customer service and product teams, and those supplied by vendors or agencies. For each conversational system, confirm that users are told clearly, at the point of interaction, that they are speaking to AI. For each category of generated content, establish whether a visible or technical marking is applied and who is responsible for applying it.
Next, check your supplier contracts. Because the obligation rests with you as deployer, you need evidence that your vendors' products and your own configuration of them meet the requirement. Finally, assign a named owner for tracking AI Act provisions individually, with a short, regular report to the executive team and the board that separates what is live from what is coming.
The simplest test is one question: does your AI disclose that it is AI? If nobody in the room can answer with confidence, you have found the gap, and the time to close it is before the next compliance cycle forces the conversation.