Skip to content
Zollwerk

EU AI Act · practical

The EU AI Act questions your buyers are already sending.

Article 50 has applied since 2 August 2026. Much of what is published online was written before the Digital Omnibus, Regulation (EU) 2026/1744, moved the high-risk deadlines and left Article 50 exactly where it was. This page separates the two, in the order a procurement questionnaire asks.

Every claim below was checked against the Regulation and the Commission guidelines on 4 September 2026. Sources are at the foot of the page.

Which dates actually apply to me?

Which of these bind you depends on what you sell and when you shipped it. Provider and deployer are defined in the next section. Annex III is the list of high-risk uses such as hiring, credit scoring and education; Annex I covers AI built into products that are already regulated, like machinery or medical devices.

DateWhat appliesWho it binds
2 Feb 2025Prohibited practices (Art. 5) and the AI literacy duty (Art. 4).Everyone
2 Aug 2025Obligations for general-purpose AI models, governance, and penalties. Commission fines on model providers (Art. 101) followed a year later.Model providers
2 Aug 2026Article 50 transparency obligations apply. Not deferred by the Digital Omnibus.Providers and deployers
2 Dec 2026New prohibited practices added by the Omnibus: AI that generates or manipulates non-consensual intimate imagery of identifiable people, or child sexual abuse material. It reaches systems where such output is reasonably foreseeable without adequate safeguards, not only tools built for it.Everyone, generative AI included
2 Dec 2026Deadline for systems that were ALREADY on the market before 2 August 2026 to meet the Art. 50(2) marking duty (Art. 111(4)). A system launched after that date gets no grace period; its duty starts on release.Only systems on the market before 2 Aug 2026
2 Dec 2027Annex III high-risk obligations, moved back from 2 August 2026 by the Digital Omnibus.High-risk only
2 Aug 2028Annex I high-risk obligations, for AI inside already regulated products. Also deferred, from 2 August 2027.High-risk only

The Digital Omnibus postponed the Annex III high-risk deadline to 2 December 2027. It did not postpone Article 50. A checklist telling you that everything moved to 2027 is describing an obligation you probably do not have, and skipping the one you do. Note also that the nearest deadline on this page is not a transparency duty at all: it is the new set of prohibitions on 2 December 2026.

The questions, in the order they get asked

Am I a provider or a deployer?

Both are defined in the Regulation, and you can be both at once. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its own authority, other than in a purely personal, non-professional activity.

  • If you ship a product with a chat feature under your own brand, you are the provider of that system, even though you did not train the model.
  • You are simultaneously a deployer of the model you call.
  • Personal, non-professional use falls outside the deployer definition entirely.

Do I have to tell people they are talking to AI?

Yes, where they interact with it directly, unless that is obvious. Article 50(1) puts the duty on the provider: a person must be informed they are interacting with an AI system, unless it would be obvious to someone reasonably well-informed, observant and circumspect. Article 50(5) adds that the information must be clear and distinguishable, and given no later than the first interaction.

  • The Commission guidelines say a disclosure sitting only in terms and conditions, a URL or documentation is not enough on its own. It may complement an in-context disclosure, not replace it.
  • Those guidelines interpret the Act rather than being the Act. What is enough for your interface is a question for your lawyer.

Do I have to mark what the model generates?

If your system produces synthetic audio, image, video or text, Article 50(2) requires the output to be marked in a machine-readable format and detectable as artificially generated or manipulated. The duty sits with the provider, and the technical solution has to be effective, interoperable, robust and reliable as far as that is technically feasible.

  • The Regulation carves out systems performing an assistive function for standard editing, and, as a separate alternative, systems that do not substantially alter the input data or its meaning.
  • The Commission guidelines treat three further cases as outside the obligation: short sequences of numbers, symbols or letters; source code; and output passed only between machines and never seen by a person.
  • Systems already on the market before 2 August 2026 had until 2 December 2026 for this one obligation. Anything launched after that date is covered from release.

Does the deepfake labelling rule apply to me?

It depends which half of the rule. The deepfake half binds any deployer that generates or manipulates image, audio or video content constituting a deepfake, whether or not it is ever published. The separate text half applies only to AI-generated text published to inform the public on matters of public interest.

  • Publication is not a condition of the deepfake half. If you generate synthetic faces or voices for a client and never publish them, you are still within it.
  • The text exemption needs two things together: the text went through human review or editorial control, and a natural or legal person holds editorial responsibility for publishing it. It never covers deepfakes.
  • Human review means deliberate examination of the substance by someone with relevant knowledge and professional judgement. A spell-check or a grammar pass does not count.
  • Where a deepfake is evidently part of an artistic, creative, satirical or fictional work, the duty narrows to disclosing that the content exists in a way that does not spoil the work. It is narrowed, not removed.

What does an EU buyer actually ask in the questionnaire?

Three things, repeatedly: which models you use and where they run, what sits between a user and the model, and what you can show after the fact. These arrive as security and procurement questionnaires long before any authority contacts you, which is why the deadline that costs you money is usually your next enterprise deal, not an enforcement date.

  • Which model providers and subprocessors are in the path, and in which country they run.
  • Whether prompts or customer data are used to train anyone else’s model, and how long they are retained.
  • What controls exist on spend, on personal data leaving your servers, and on prompt injection.
  • What record you can produce of a specific call, months later.
  • A data processing agreement and a current subprocessor list.

What Zollwerk ships toward these

Mechanisms, mapped to the need they serve. Read the right column as what exists in the codebase, never as therefore you are done.

What is being asked of youWhat the kit ships
Tell a user they are interacting with AI (Art. 50(1)).A disclosure component in the app shell. Wording, placement, and whether you need it at all stay your decision.
Show, after the fact, what a specific call did.An append-only audit ledger recording every model call, including the ones that were refused.
Say which models ran, and where.One gateway every call passes through, self-hosted on your own EU server, with the full source in your repo.
Answer the subprocessor and data-processing questions.A compliance pack: AVV, subprocessor list, checklists. Templates your lawyer reviews rather than writes.
Keep a coding agent inside the rules it agreed to.A hard daily spend ceiling, PII redaction and prompt-injection screening, enforced below the level the application can edit.

These are technical building blocks. They do not make you compliant, and no software sold at this price can. That is a judgement about your specific product, made with your lawyer.

Review the €149 offer
Live offer · checkout openSee the full pricing

Sources

Every claim above comes from one of these. Check them yourself.

This page is a summary of published sources, written by a developer, and it is not legal advice. It cannot tell you whether your product is high-risk, and it does not create a lawyer–client relationship. Zollwerk is software and document templates: technical building blocks. Review your obligations with your lawyer.