August 2, 2026 was not a soft launch. It was the date the European AI Office gained formal investigative powers under the EU AI Act — the ability to demand documentation, conduct investigations, and impose fines. If your product reaches users in the EU and uses an LLM, you are in scope.
Most engineering teams haven’t started compliance planning. The teams that have are mostly planning for the wrong layer — the high-risk AI obligations that are visible and heavily discussed, which don’t come into force until December 2027 or August 2028. The obligations that are live today are different, and simpler, and for most software teams, immediately actionable.
This is the engineering breakdown of what’s live now, what’s coming, and what your team should actually be doing.
What’s Live Today: Article 50 Transparency Obligations
Article 50 of the EU AI Act is the transparency chapter, and it became enforceable on August 2, 2026. It covers three categories:
Interactive AI systems must disclose they are AI. Any chatbot, virtual assistant, or AI-powered interface that interacts with natural persons in real time must clearly disclose to the user that they are interacting with an AI system — not a human — in a timely manner. The exception is when this is “obvious from the context” (a clearly labeled AI assistant), but “obvious from context” is interpreted narrowly. If there is any ambiguity, you need an explicit disclosure.
AI-generated content must carry machine-readable marks. AI-generated images, video, and audio must be marked using machine-readable watermarking or other technical means that allow automated detection. The C2PA (Coalition for Content Provenance and Authenticity) standard is the leading implementation: cryptographic signing of media content that embeds provenance metadata. The regulation doesn’t mandate C2PA specifically, but it’s the de facto standard and over 180 organizations have aligned to it under the EU Code of Practice on AI content transparency.
Emotion recognition and biometric categorization must be labeled. Any system using AI to analyze or categorize human emotional states or to categorize natural persons by biometric data must explicitly label those capabilities to users.
What the article doesn’t do: it doesn’t prohibit these systems or require special authorization. It requires transparency. A chatbot is fine; a chatbot that doesn’t tell users it’s a chatbot is not.
What’s Not Yet Live: The High-Risk Obligations
The high-risk AI system requirements — the parts of the AI Act most covered in press and compliance discussions — are deferred under the Digital Omnibus directive:
- Annex III high-risk AI systems (hiring tools, credit scoring, biometric identification, educational assessment, critical infrastructure AI): enforcement starts December 2, 2027
- AI embedded in regulated products (medical devices, safety systems, consumer products under existing CE directives): enforcement starts August 2, 2028
This means your hiring automation, candidate screening tool, or credit-scoring AI has 16 months before obligations are enforced. Your AI-powered medical device has two years. The runway is real, but the governance infrastructure you build now for Article 50 is the foundation you’ll extend — building it twice because you didn’t start early is avoidable.
The GPAI Documentation Requirements
General Purpose AI model providers face a third track: documentation obligations for models with wide general-purpose capabilities. This applies to providers of the models, not just users of them. But if you’ve fine-tuned a foundation model or modified a base model for distribution, you may be a provider.
GPAI model providers must maintain:
- Technical documentation of the model
- A summary of training data (not the full dataset, but categories, sources, and scope)
- A copyright compliance policy demonstrating how training data rights were handled
- Compliance with the Code of Practice on transparency
This has immediate implications for teams doing significant fine-tuning and distribution of AI models internally or externally. Verify whether your provider’s compliance documentation exists and whether your own fine-tuned models trigger provider obligations.
The Engineering Checklist: What To Do Now
Immediate (live August 2, 2026)
1. Audit all user-facing AI interactions. Map every touchpoint where your product uses AI to interact with EU users. This includes: chatbots, AI assistants, customer support automations, AI-generated content in emails, AI-generated images or video in your product. The question for each: does the user know they’re interacting with AI or AI-generated content?
2. Implement disclosure for chatbots and AI assistants. The engineering implementation is simple: a clear label or disclosure message at session start for any interactive AI. This should read something like “You’re talking with an AI assistant” — specific enough to satisfy the “timely disclosure” requirement. Document the implementation date.
3. Add C2PA marking to AI-generated media if you generate it.
If your product generates images, video, or audio using AI and delivers them to EU users, you need C2PA metadata. The Python c2pa-python SDK and Node.js equivalents are available. Integration typically requires: sign generated content with a certificate, embed the C2PA manifest, surface the provenance in your UI or allow external verification. If you’re using third-party generation services (OpenAI, Google Imagen, etc.), check whether they already add C2PA marks — some do, and it may satisfy your obligation without additional work.
4. Create a compliance log. EU enforcement is documentation-driven. Investigators examine whether you knew about obligations and took steps to meet them. A simple log of: what you audited, what disclosures you added, when, and who owns ongoing compliance, is meaningful evidence of good faith compliance — and lack of one is meaningful evidence of the opposite.
Near-Term (Q3-Q4 2026)
5. Map your GPAI providers’ documentation. Request or verify that every LLM API you use has published GPAI compliance documentation. The major providers (Anthropic, OpenAI, Google DeepMind) have published or are publishing compliance docs. Smaller or open-source models used in production are a gap area. Document which providers you’ve verified.
6. Begin high-risk system inventory. Even with 16 months before enforcement, the inventory phase for high-risk AI systems takes longer than teams expect. The technical inventory is straightforward: what AI systems do you operate, what decisions do they affect? The regulatory mapping is harder: does this system fall under Annex III categories? That question benefits from early legal review before the last-minute sprint.
7. Assess whether your C2PA implementation covers all generated content channels. C2PA signing at generation time is table stakes, but content often travels: embedded in emails, exported to third-party platforms, shared via API responses. Each channel where EU users receive AI-generated content is a disclosure point. Audit your content distribution paths.
Planning Horizon (2027-2028)
8. Build a compliance foundation now for Annex III requirements. High-risk AI systems will require: conformity assessments, human oversight mechanisms, logging of system decisions for audit, accuracy and robustness documentation, and registration in the EU AI systems database. The technical infrastructure for decision logging and human oversight is the long-lead item — you need 6-12 months of historical decision logs to demonstrate system behavior for a conformity assessment. Starting that logging in 2026 means you have it when enforcement arrives. Starting in late 2027 is too late.
9. Establish an AI governance owner. The EU AI Act is iterative enforcement — auditors check whether you have governance processes, not just technical implementations. Assigning a named person or team as AI compliance owner before enforcement is an advantage. That ownership role should include: tracking obligation timelines, maintaining the compliance log, owning provider documentation relationships, and reviewing new AI features against Article 50 requirements before launch.
The Content Provenance Standard: What C2PA Actually Is
C2PA deserves a brief technical note because it’s likely unfamiliar to most engineering teams and the implementation is simpler than it sounds.
C2PA is a cryptographic signing standard for media files. The mechanism: when you generate AI content, you create a C2PA manifest — a JSON structure containing provenance metadata (creator, timestamp, AI model used, any editing history) — and sign it with a certificate. The signature and manifest are embedded in or linked to the media file. Any C2PA-compatible viewer can verify the signature and surface the provenance information.
The certificates come from Content Credentials providers. Adobe, Google, Microsoft, and the CAI (Content Authenticity Initiative) operate certificate infrastructure. For most engineering teams, the implementation flow is: register for a certificate from a trusted issuer, integrate the C2PA SDK into your media generation pipeline, sign content at generation time, optionally surface a “Content Credentials” badge in your UI.
This is a few weeks of implementation work for a team that hasn’t done it. It’s not a multi-year project. The earlier you do it, the more time you have to test the implementation before enforcement creates urgency.
Why August 2 Actually Matters
The European AI Office’s enforcement mandate is not symbolic. The GDPR history is instructive: the regulation was passed in 2016, enforcement started in 2018, and the first significant fines came in 2019. Teams that dismissed GDPR as EU bureaucracy and planned to “figure it out when enforcement happens” learned that “when enforcement happens” arrives faster than legal timelines suggest, because enforcement begins when the first investigation starts — not when the first fine is issued.
The AI Act’s enforcement is modeled similarly. You don’t hear about the investigation until it starts. You don’t get a grace period to implement disclosures once an investigation is underway. The question “did you know about the obligation and take steps to address it” is answered by what you did in August 2026, not what you plan to do next year.
The good news for Article 50: the obligations are simple. Disclose that your chatbot is a chatbot. Mark your AI-generated images as AI-generated. These are not complex system builds. They’re product decisions that take a week to implement and document. The cost of doing them is low. The cost of not doing them is investigatory risk, reputational exposure, and the more-difficult compliance position of implementing under pressure.
The AI Act’s complexity is ahead of you, in the high-risk obligations arriving in 2027-2028. Use the relative simplicity of today’s obligations to build the governance muscle you’ll need for that complexity.
Thuận Lương is a Tech Lead with 15+ years of experience in .NET, cloud architecture, and AI systems. He writes about lessons from building real production systems.