The EU's "tell people it's AI" rule is live. The only grace period ends 2 December.

Article 50 of the EU AI Act is already live, and the one grace period in it is narrower than most summaries make it sound.

Article 50 of the EU AI Act became generally applicable on 2 August 2026, and national authorities can enforce it now. It applies whatever your risk classification is, which is the part small teams tend to miss: you do not need to be a "high-risk" system to be covered. The Digital Omnibus that entered into force in July did not change the substance of these duties, according to the law-firm write-ups I read (Goodwin, and Ropes & Gray).

What it asks for, going by the text of the article itself. If your system interacts directly with people, they have to be told they are dealing with an AI, unless that is already obvious to a reasonably informed, observant person. If your system generates synthetic audio, image, video or text, the output has to be marked in a machine-readable way so it can be detected as AI-made. Deployers who publish deepfakes must disclose them, and deployers of emotion recognition or biometric categorisation must inform the people exposed to it. The information has to be clear and given no later than the first interaction.

The grace period. Generative systems that were already on the market before 2 August get until 2 December 2026, but only for the marking and detection duty. Both firms say the same thing: it does not cover the chatbot disclosure, and anything placed on the market on or after 2 August gets no grace at all. So if you launched a new generative feature this autumn, the clock is not running for you.

The numbers. The fine ceiling for Article 50 breaches is up to 15 million euros or 3% of worldwide turnover, whichever is higher, with some proportionality for small companies. That figure comes from the law firms' summaries rather than from me reading the penalty article, so check it before you quote it. The Commission published its transparency guidelines on 20 July and finalised a Code of Practice on AI-generated content marking on 10 June, and signing up to it is one way to show compliance.

What I would do this month, as a builder and not a lawyer. First, list every place your product talks to a user or produces text, images or audio, and ask for each one whether a reasonable person could think a human wrote it. Second, put the disclosure in the interface itself, at the start, rather than in terms of service. Third, if you generate content, find out what marking your model provider already applies, because as a deployer you may be inheriting that and not building it. Fourth, write down your reasoning for anything you decided was obvious, since the exemption turns on that judgement.

For Murror this one is easy to state. People write to it on hard days, and they should never have to wonder whether something that sounds warm is a person. Telling them plainly is not a compliance chore, it is part of earning the right to be in that conversation. It is also the same direction as California's companion-chatbot law I wrote about last week, so one honest disclosure design can cover both.

If you ship anything conversational or generative to EU users, where does your AI disclosure live today, and would a first-time user see it before their first message?