EU AI Act transparency rules: what websites must do now

The EU AI Act's transparency rules have applied since 2 August 2026. If your website has an AI chatbot that talks to people in the EU, you generally need to tell them they are talking to AI, unless that is already obvious. If you publish AI-generated images, video or audio that could pass as real, or AI-written text on matters of public interest, disclosure duties may apply too. One narrow part, the technical watermarking duty for AI tools already on the market, has until 2 December 2026.

The summer brought a lot of confusing headlines about delays. This piece sets out what actually changed, what didn't, and what it means for businesses running websites, at the time of writing (November 2026). It is general information, not legal advice.

What was delayed, and what wasn't

The EU adopted a package of amendments known as the Digital Omnibus on AI, Regulation (EU) 2026/1744. It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, just days before the original high-risk deadline. The main changes to dates were:

So the high-risk rules moved, but the transparency rules that touch everyday websites mostly did not.

What Article 50 requires

Article 50 splits duties between providers (whoever develops an AI system and puts it on the market under their own name) and deployers (organisations using an AI system in a professional capacity). Most businesses with a website chatbot from a vendor are deployers. A business that builds and sells its own AI tool is a provider.

Provider duties

• AI interaction: systems designed to interact directly with people must be built so that people are informed they are dealing with AI, unless that is obvious from the context.
• Marking synthetic content: systems that generate text, images, audio or video must mark outputs in a machine-readable, detectable way where technically feasible. This is the duty with the 2 December 2026 transition for systems already on the market.

Deployer duties

• Deepfakes: disclose that image, audio or video content has been artificially generated or manipulated. Evidently artistic, creative, satirical or fictional work gets lighter treatment.
• Public-interest text: disclose AI-generated or manipulated text published to inform the public on matters of public interest, unless it has gone through human review or editorial control and someone holds editorial responsibility.
• Emotion recognition and biometric categorisation: inform the people exposed to it.

Law firm analyses, including Morgan Lewis and Jones Walker, stress that the December transition covers only the provider-side marking duty. Deployer duties have applied since August.

Does it apply to businesses outside the EU?

It can. The Act covers providers placing AI systems on the EU market wherever they are based, and providers and deployers outside the EU where the system's output is used in the EU. Jones Walker notes that a website simply being reachable from the EU is not, on its own, the trigger. It depends on your role and how the system is used.

For an Indian, UK or US business, the practical question is: do you actively serve customers in the EU with an AI feature? An online shop shipping to Germany with an AI support assistant, or a SaaS company with EU users, should assume the rules are relevant and check with counsel.

What this means for common website features

If you use a third-party chatbot, check what your vendor provides. Many tools already show an "AI" label or opening message, but the deployer is responsible for how it is presented on your site.

The Code of Practice and guidance

The European Commission published a final Code of Practice on Transparency of AI-Generated Content on 10 June 2026. It is voluntary, but the Commission says it is an adequate tool for demonstrating compliance with the marking and labelling duties, and around 190 organisations had signed by the end of July 2026. Reporting on the final text describes common EU icons for fully AI-generated and AI-modified content.

The Commission also consulted on draft guidelines on the scope of Article 50 from May 2026. Check the Commission's AI Act pages for the final version before relying on any particular interpretation.

Penalties and other changes worth knowing

Breaches of Article 50 fall into the tier with fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher. For qualifying SMEs and startups, the lower of the two applies. These are maximums, and the Act requires penalties to be proportionate.

The Omnibus made a few other changes. The AI literacy duty in Article 4 was softened from "ensure" a sufficient level of literacy to "support and facilitate" it, according to Cooley. It also added a ban on AI systems that generate non-consensual intimate imagery or child sexual abuse material, applying from 2 December 2026.

Frequently asked questions

Is it enough to mention AI in our privacy policy?

Probably not for chatbots. The duty is to inform people that they are interacting with AI, which in practice means a clear notice in the chat itself, not a line buried in a policy page.

We only use AI to help draft blog posts. Do we need labels?

The public-interest text duty does not apply where content has had human review or editorial control and someone holds editorial responsibility. A real editorial process is the key safeguard.

Has the chatbot rule been postponed?

No. The Omnibus postponed high-risk obligations and the technical marking duty for existing systems. Disclosure for AI interaction has applied since 2 August 2026.

What to do next

List every AI feature on your website and in your customer journey: chat, voice, generated images, generated content and any automated decisions. For each one, note whether you are the provider or the deployer, whether EU users are exposed to it, and how it is currently disclosed. Add clear AI notices where they are missing, keep a record of AI-generated assets, and make sure content workflows include genuine human review. If you sell into the EU at any scale, take legal advice on your specific setup.

Sources: Cooley: Digital AI Omnibus, Gibson Dunn: AI Act Omnibus agreement, Morgan Lewis: Transparency rules from 2 August, Jones Walker: August 2 still matters, European Commission: Code of Practice on AI-generated content