EU AI Act Compliance May 9, 2026 · 5 min read

The EU AI Act's Rulebook for Chatbot Disclosure: What Enterprises Must Have in Place Before August 2.

From August 2, 2026, enterprises deploying AI chat interfaces in the EU must disclose that users are interacting with AI — and certain AI-generated content needs machine-readable labels.

In May 2026, the European Commission published draft guidelines on what transparency actually means under the EU AI Act, and ran a stakeholder consultation that closed June 3. The rules themselves take effect August 2, 2026.

The consultation window has closed — but the enforcement date has not moved, and most enterprises still don't have disclosure infrastructure in place.

Most enterprise compliance teams are focused on the high-risk AI system requirements coming in August 2026 and 2027. The transparency obligations in Article 50 are different — and they apply to a much wider population of AI systems than the high-risk rules do.

What the EU AI Act's Transparency Rules Actually Require

The Commission published draft guidelines on May 8 under Article 50 of the AI Act. The core obligation: from 2 August 2026, people in the European Union will have to be informed when they are interacting with artificial intelligence systems or exposed to certain AI-generated or manipulated content.

There are two distinct sets of obligations — one for AI providers, one for deployers.

AI providers must: inform people when they are interacting with an AI system, and add machine-readable marks to enable the detection of AI-generated or manipulated content.

AI deployers must: inform people when they are exposed to deep fakes, AI-generated publications on matters of public interest, and emotion recognition or biometric categorisation systems.

If your organization uses a ChatGPT-based internal assistant, deploys a customer-facing AI chat interface, or produces AI-generated content distributed to EU audiences, you likely have obligations here — regardless of whether those systems qualify as "high-risk."

Why the Guidelines Matter

The Commission's draft guidelines went through a stakeholder consultation that closed 3 June 2026. The final version of a complementary voluntary code of practice — drafted by independent experts — serves as a tool for demonstrating compliance.

In practice, this means:

For enterprises, this creates a specific risk: the obligation lands August 2 whether or not the guidance is final, so the runway to build disclosure mechanisms is already short.

The Disclosure Gap in Enterprise AI Deployments

Here's what most internal AI governance programs miss: the transparency obligation is a runtime requirement, not a documentation exercise.

You cannot satisfy Article 50 with an Acceptable Use Policy update, a terms-of-service amendment, or a compliance questionnaire. The obligation requires that people are actually informed — at the moment of interaction — that they are dealing with an AI system.

For a large enterprise with hundreds or thousands of employees using AI chat tools across ChatGPT, Microsoft Copilot, Claude, Gemini, and Perplexity, this creates a real operational question: how do you ensure disclosure happens consistently, at the browser layer, before prompts are submitted and responses returned?

Policy documents don't enforce themselves. The August 2 deadline makes this an infrastructure question, not just a policy question.

What Practical Compliance Looks Like Before August 2

Four steps enterprises can take now:

1. Map your AI touchpoints. Which tools interact with EU-based employees or customers? Internal copilots, AI chat support, generative AI tools that produce content for EU audiences — all need to be inventoried against Article 50 scope.

2. Assess your disclosure gaps. For each AI system, can users tell they're interacting with AI? Is AI-generated content labeled? If employees use ChatGPT or Claude through a corporate license, is there a disclosure mechanism in place?

3. Implement real-time enforcement. For browser-based AI tools, disclosure needs to happen at the point of interaction. Governance at the browser layer — intercepting AI submissions and enforcing organizational policies before responses are generated — is the practical mechanism for Article 50 compliance at scale.

4. Monitor the final code of practice. The Commission's consultation closed June 3, 2026, and the final voluntary code is expected to follow. Review it against your existing disclosure mechanisms when it publishes.

The Practical Window

The consultation has closed. The transparency rules take effect August 2, 2026 — leaving a narrow window to get AI disclosure infrastructure in place across your organization.

For enterprises that have deployed AI chat tools broadly — and most large organizations have — the question isn't whether Article 50 applies. It's whether your governance infrastructure can enforce disclosure at the layer where AI interactions actually happen.


Source: European Commission press release, 8 May 2026 — Commission opens consultation on draft guidelines for AI transparency obligations

Ready to close the gap?

Talk to us about runtime AI governance for regulated environments.

Schedule a Conversation →