2 August 2026: what the EU AI Act actually requires if you have EU users

2026-07-29 · Collin Obey

Reported figures for the UK mid-market put the readiness gap bluntly: only 34% of UK mid-market organisations have assessed their exposure to the EU AI Act at all — and of those that have, only 18% have implemented any compliance measure. Read those two numbers together and the picture is that the typical mid-market company has done nothing, a year plus a summer after the Act entered into force.

The usual justification is one sentence long: “we're a UK company.” It is wrong in the way that costs money. The Act applies wherever the output of an AI system is used in the Union — established in the EU or not. A Manchester SaaS company whose chatbot talks to a customer in Dublin is in scope. Physical presence is not the test.

What actually lands on 2 August 2026

The Article 50 transparency obligations. Five of them, each scoped to what you build or publish, each carrying the same penalty tier: up to EUR 15,000,000 or 3% of total worldwide annual turnover, whichever is higher (Article 99(4)) — deliberately not the EUR 35M / 7% figure that circulates, which belongs to the Article 5 prohibited practices.

• Article 50(1) — providers: people must be able to tell they are interacting with an AI, by design.
• Article 50(2) — providers: generated audio, images, video and text must carry machine-readable marks (watermarking, metadata, content credentials). One nuance the summaries keep flattening: the May 2026 Digital Omnibus split this date. Systems placed on the market on or after 2 August 2026 get no grace period — the duty applies 2 August 2026. Systems already on the market before that date have until 2 December 2026. The rest of Article 50 was not moved.
• Article 50(3) — deployers: people exposed to emotion recognition or biometric categorisation must be told it is operating.
• Article 50(4), first subparagraph — deployers: deepfake content — AI-generated or manipulated material showing real people, places or events in a way that could appear authentic — must be disclosed at first encounter.
• Article 50(4), second subparagraph — deployers: AI-generated text published to inform the public on matters of public interest must be disclosed, unless a person holds editorial responsibility for it.

What does not land that day

Almost as important, because conflating the dates is how budgets get spent on the wrong thing. The Article 5 prohibited practices have applied since 2 February 2025 — if you are doing any of those, the deadline conversation is already over. General-purpose AI rules have applied since 2 August 2025 and mostly bind model providers, not the companies building on top. The Article 50(2) marking duty for systems already on the market before 2 August 2026 moved to 2 December 2026 — new systems get no such grace — and the Annex III stand-alone high-risk obligations moved to 2 December 2027, both under the May 2026 Digital Omnibus agreement. 2 August 2026 is, for most companies with EU users, a transparency deadline — narrower than the headlines suggest, and much harder to honestly ignore.

The five-minute version of the assessment

The 34% who have assessed exposure did not do anything exotic: they asked which of five obligations touch what they ship. Does the product talk to people? Does it generate content? Do you publish AI-generated media of real people, or AI-written public-interest text? Do you run emotion recognition? Each yes maps to one article above, and each article states its own exception.

We built that assessment as a free self-check: the Article 50 self-check. No account, no email, the logic runs in your browser, and the result is a shareable link that names the exact articles that appear to apply to you. It is a scoping tool, not legal advice — it tells you which obligations to take to counsel, not whether you have met them.

Disclosure: this blog is published by COSTRINITY, the company behind VITNA, a compliance and audit-evidence layer for AI agents. The self-check linked above is free and does not require an account.