The AI Act’s disclosure rules took effect. The high-risk deadline did not.

Two things happened to the AI Act this summer and many companies heard only one of them. The Digital Omnibus pushed the Annex III high-risk obligations from 2 August 2026 to 2 December 2027, because national authorities and the harmonised technical standards were not ready. That delay got reported widely and plenty of people read it as a general reprieve.

It was not. The transparency duties in Article 50 started to apply on 2 August 2026 and national authorities can enforce them now. Those duties do not depend on a system being high-risk. They attach to ordinary things: a chatbot on your website, a generated product photo, a synthetic voice on your support line.

Who the rules reach

Article 50 splits duties between providers and deployers. If you build the system, you make sure a reasonably observant person can tell they are talking to software, and you mark generated text, audio, images and video so a machine can detect it. If you only use someone else’s system, you still carry duties of your own: disclose deepfakes, tell people when AI assesses their emotions or biometric categories, and label AI-generated text you publish to inform the public on a matter of public interest.

A second date matters for anything already shipped. Systems that were on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking requirement.

The exemptions are narrower than they sound

• ✳Disclosure drops away when AI involvement is obvious in context, which is a judgement call worth writing down rather than assuming
• ✳Assistive editing such as grammar correction falls outside the marking duty, but a tool that substantially rewrites your text does not
• ✳Art and satire get lighter treatment, disclosed in a way that does not spoil the piece
• ✳AI-generated text escapes the public-interest label only when a human reviewed it substantively and someone holds editorial responsibility

Penalties reach 15 million euros or 3 percent of worldwide turnover. The rules follow the user rather than the company address, so a provider outside the EU serving EU users is in scope.

Read it this way: the deadline that slipped covers systems most Estonian SMEs do not build. The deadline that held covers the chatbot and the generated marketing images many of them already run.