Article 50 of the AI Act: what to do on Monday 3 August if you are not ready
5 min read
Tomorrow, Sunday 2 August 2026, Article 50 of Regulation (EU) 2024/1689 becomes applicable across the Union. For almost every organisation Sunday changes nothing: the first moment anyone can actually do something is Monday morning, 3 August, the first working day. We have read the text article by article, checked the list of signatories to the marking code name by name, and followed the still-incomplete Italian decree opinion after opinion. One piece is missing: what does someone who has done none of this actually do, on Monday at nine o’clock?
What applies regardless, even without an authority ready to enforce it
The obligation does not wait for whoever is meant to police it. Chapter XII of the regulation — penalties included, Article 99, up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher — has applied since 2 August 2025: a full year earlier. Sunday does not create the penalty; it creates the infringement to be penalised: until now there was no transparency duty to breach, from Sunday there is. It is the difference between a weapon already loaded and a target that appears.
In Italy, who will actually use it first is still unsettled. The draft decree that assigns the tasks — Government Act No. 421, currently before parliamentary committees — names ACN as the market surveillance authority “in general”, with the Garante competent only for justice, law enforcement, migration and democratic processes; but the text is not yet law, and the Garante president’s hearing before the Chamber dates from 21 July. The deadline for designation, set by Article 70(2) of the regulation, was 2 August 2025: we found no record of a definitive Italian designation published before this draft. That is not an excuse to wait: it is an excuse that benefits whoever enforces, not whoever must comply. The absence of a final decree suspends certainty about who will enforce the rule first, not the obligation itself.
Three things, in order
One, what you can fix in hours. The banner disclosing “you are interacting with an AI system” on public-facing chatbots (Article 50(1)) is a configuration change, not a project. Any synthetic content you publish from Sunday onward must be labelled, even if it was generated earlier: that is what the Commission’s guidelines say at paragraph 154. And if your supplier appears on the list of signatories published on 31 July, check that it is the same legal entity as the one in your contract: the list records company names, not brands.
Two, what you can no longer recover. If a conversational assistant has been online for months without a word about being an AI system, from Sunday that gap is a failing that keeps existing until you close it: every extra day of delay is one more day, not recoverable by fixing it later. Different is content already published before Sunday and left unchanged: the guidelines require the label for what is published from Sunday onward, regardless of when it was generated — the more consistent reading is that they do not ask you to relabel, after the fact, what is already out there. That is a reading, not an explicit provision: we flag it as such.
Three, what belongs in writing, not in a phone call, to your supplier. Now that the list exists, ask in writing for: (a) confirmation that the entity you contract with is the one on the list, not the parent group; (b) which product and version the adherence covers, since the list is organised by organisation, not by system; (c) which of the code’s two technical layers applies to your output — signed metadata, imperceptible watermark, or both; (d) since when labelling has been active on your own environment, not generically on the supplier’s website. File the reply with the date received: it is the first line of the log an inspection will ask for.
What to do now
In your map of systems exposing AI to customers or citizens, mark against each one: banner active yes/no, content labelled yes/no, supplier on the list yes/no/different entity, written request sent on — . Put the 2 August deadline, with these four fields, into the compliance deadlines tool: not into the diary of whoever handles it today, who will change before the rule does.
How we deal with it
This is work on confidential documents — contracts, configurations, correspondence with suppliers — that is not handed to a generic cloud service. We build dedicated, closed AI that keeps this map current on its own: re-reading the signatory list on every update, retaining supplier correspondence with the dates sent and received, flagging content published without a fresh label before an inspector sees it. It is how we build AI governance: in two modes only, on-premise in the client’s own environment, or a dedicated cloud — reserved for the single client, accessed over a dedicated VPN, with the data centre resident in Italy and premises we staff ourselves. In both, the log stays yours.
Do you want to already have the list of what is missing on Monday morning, rather than discover it as you go? Half an hour with one of our specialists.