Article 50 applies. To your agent too.

The headline in July read: deadline postponed. For high-risk systems that is true. For the chatbot on your website it is not.

I have heard the sentence several times in recent weeks that we now have until the end of 2027. That is the most expensive misreading in circulation this year. The transparency obligations in Article 50 took effect on schedule on 2 August 2026, and they hit precisely the systems most organisations have already shipped.

Up front, clearly: I am not a lawyer and this is not legal advice. It is an implementation checklist from the perspective of someone who builds these systems. For a binding assessment of your specific case you need your legal department.

What was postponed and what was not

Regulation (EU) 2026/1744, the digital omnibus regulation on AI, dated 8 July 2026, was published in the Official Journal on 24 July and entered into force on 27 July. Five days before the original cut-off. The legislator explicitly brought it into force on the third day after publication as an urgent matter, which gives a good sense of how close it was.

Obligation

Originally

Now

Standalone high-risk systems (Annex III)

2 August 2026

2 December 2027

High-risk AI in regulated products (Annex I)

2 August 2027

2 August 2028

Transparency obligations (Article 50)

2 August 2026

unchanged

GPAI obligations (Articles 51 to 55)

2 August 2025

unchanged

Prohibited practices (Article 5)

2 February 2025

unchanged

Machine-readable marking, legacy systems

2 December 2026

Two new prohibitions under Article 5

2 December 2026

One detail weighs more than the postponement itself. The original draft wanted to tie the start of the high-risk obligations to the availability of harmonised standards. In trilogue, that mechanism was replaced by fixed calendar dates. The 2 December 2027 date now hangs on nothing. A second postponement is not built into the text.

The four obligations in Article 50

Paragraph 1: disclosure of AI interaction. If your system interacts directly with a person, that person must be informed they are dealing with AI. Exception: it is obvious from the context. The information has to come no later than the first interaction.

Paragraph 2: machine-readable marking of synthetic output. Providers of systems that generate audio, image, video or text must mark the output so that it is machine-detectable as artificially generated. This is a requirement for provenance metadata, not a visible watermark. Content Credentials under C2PA are the obvious implementation. For systems that were on the market before 2 August 2026, the deadline runs to 2 December 2026.

Paragraph 3: emotion recognition and biometric categorisation. Deployers must inform the people concerned.

Paragraph 4: deepfakes and texts on matters of public interest. Artificially generated or manipulated image, audio and video content must be disclosed. For AI-generated text informing the public on matters of public interest, disclosure is likewise mandatory, unless the content was reviewed by a human and somebody holds editorial responsibility.

Paragraph 1 is the one that touches almost everyone. Support bot, onboarding assistant, the copilot inside the internal application: all covered.

What this means for a Copilot Studio agent

Concretely, in the order I would work through it:

The web channel. The greeting message has to state the AI nature. Not in the imprint, not in a collapsible notice, but in the first message the user sees. One sentence is enough: that an AI assistant is answering and how to reach a human. That is a field in the configuration and ten minutes of work.

Voice agents. A voice channel has no greeting bubble. The disclosure belongs in the announcement before the first dialogue step. If you also record, consent comes on top. Copilot Studio has had a dedicated configuration for consent-based recording since May.

Teams and internal channels. You can argue here that the AI nature is obvious from context, because the agent appears as a bot in the directory. I would not rely on that and would write it down instead. The effort is nil, the risk is not.

Generated documents. The GitHub Copilot harness natively creates Word, Excel, PowerPoint and PDF files. As soon as those files leave the organisation or represent matters of public interest, paragraph 2 and, depending on the case, paragraph 4 become relevant. Establish early whether your document pipeline even passes provenance metadata through. In most toolchains I have seen, it is lost at the first conversion step.

Agent-to-agent chains. When an agent delegates to a specialist agent and that one ends up answering the human, the disclosure applies to the chain, not to the individual link. In distributed architectures this gets lost easily.

The trap in the grandfathering

Article 111 protects systems placed on the market before the respective date of application. That sounds like a free pass for everything already running.

The exception eats the rule. Grandfathering falls away as soon as the system is subject to significant changes in design.

For classic enterprise software with a half-yearly release, a significant change is a rare, deliberate event with a changelog entry. For an agent under continuous deployment it is not. You swap the model because a better one is available, which is now a dropdown. You rewrite the instruction because answer quality dropped. You attach a tool, then three more. You switch on memory. After six months, the agent in production has little to do with what you placed on the market.

There is no clear line for when accumulated changes add up to a significant change. What there is, is an evidence problem. If somebody asks in 2028 what your system looked like in August 2026, "we do not log that" is the worst available answer.

Which is why the most important step is not legal but craft: keep records. Model version, instruction state, active skills, connected tools, the date of every change. If your skills sit in git as files, you have that history anyway. That is one of the reasons I keep going on about it.

Checklist

1. Inventory. List every AI surface that talks to people. Experience says there are more than you think, because somebody built a summarisation feature into the admin panel and told nobody.
2. Per surface, check whether the AI nature is apparent at the first interaction. Not "findable" but apparent.
3. Clarify your role. Are you a provider or a deployer? The obligations in Article 50 distribute differently.
4. Check generative output paths. Where do image, audio, video or text originate that go outside? Is there provenance metadata there?
5. Date the legacy estate. What was on the market before 2 August 2026? For machine-readable marking, the deadline runs to 2 December 2026.
6. Log version states, starting now. This data cannot be produced retroactively.
7. Set up a classification register. A table, one owner, reviewed quarterly: every AI capability, what it does, whether it touches an Annex III use case, which disclosures apply. The pleasant side effect: an unbounded compliance problem becomes a bounded one, because usually one or two systems are critical rather than the whole portfolio.

Where the sources diverge

Two points where I found differing accounts.

On the date of the marking obligation for legacy systems, several sources name 2 December 2026, while others describe the deadline situation inconsistently. For your project, do not rely on the secondary literature; read the text of the regulation or have it read.

And a general point: the digital omnibus was a political agreement without legal force for a long time. It has since been published and is in force, but many articles from the spring still describe the state before that. Watch the date when you read.

The sentence I would leave you with

The postponement is not permission to stop. It is a redistribution: you can write paper in 2027, but you cannot produce evidence retroactively. The year 2026 cannot be reconstructed.

And Article 50 is already due anyway.

Sources

• Regulation (EU) 2026/1744, the digital omnibus regulation on AI, dated 8 July 2026, published in the Official Journal on 24 July 2026, in force since 27 July 2026. The binding text.
• EU AI Act 2026: the deadline was postponed, but not entirely, 14 August 2026, with a solid breakdown of the Article 50 paragraphs
• What the EU AI Act means for companies, KPMG, as of August 2026
• EU AI Act 2026: all rules, deadlines and penalties, August 2026
• What's new in Copilot Studio, Microsoft Learn, on consent-based recording for voice agents