If your SaaS product already had a generative AI feature live in the EU before August 2, 2026 — an AI writer, an image generator, a voice or video tool — you are on a short clock. The European Commission's Article 50 transparency FAQ confirms that Article 50 of the AI Act has applied since August 2, 2026, with one narrow grace period: for AI systems placed on the market before that date, the duty to mark AI-generated output in a machine-readable, detectable way applies from December 2, 2026 . That date came out of the AI Omnibus, Regulation (EU) 2026/1744 , which the Commission says entered into force on July 27, 2026. Headlines focused on the high-risk delay, but for teams shipping generative features, December 2 is the date that lands this quarter.
What the AI Omnibus changed, and what it did not
The Omnibus pushed the high-risk obligations back. According to the Commission's AI Act page , rules for high-risk use cases in Annex III areas such as employment, education, and biometrics now apply from December 2, 2027, and high-risk AI embedded in regulated products under Annex I from August 2, 2028. What the Omnibus did not do is delay transparency in general. The rest of Article 50 — telling people they are talking to an AI, labelling deepfakes, and labelling certain published AI text — has applied since August 2, 2026 for everyone. The December 2 grace period covers only one obligation, marking and detection under Article 50(2), and only for systems already on the market before August 2. Anything you launched on or after August 2 should already be compliant.
Are you a provider or a deployer?
The FAQ defines providers as those who develop an AI system, or have one developed, and place it on the market under their own name or trademark — including companies outside the EU whose system's output is used in the EU. Deployers are those who use an AI system under their own authority in a professional capacity. Many B2B SaaS companies sit on both sides. If you wrap a model API into a feature your customers use under your brand, you are likely acting as the provider of that AI system, and the marking duty is yours. Your customers who publish what that feature generates are deployers, with their own labelling duties. Confirm the split with counsel; it decides who owns the fix.
What has to be marked, and what is out of scope
Article 50(2) covers providers of systems that generate synthetic audio, image, video, or text. The marks must be machine-readable and let outputs be detected as AI-generated or manipulated, and the FAQ describes them as needing to be effective, reliable, robust, and interoperable. The Commission's guidelines also narrow the scope. Per the FAQ, these are outside the marking obligation: short sequences of numbers, symbols, or letters; source code; outputs exchanged only machine to machine with no human exposure; and outputs used only in closed-loop industrial or product development, unless they are the final output. Assistive "standard editing" features such as grammar fixes are excluded, and the guidelines envisage a narrow exemption for some business-to-business or industrial outputs if specific conditions are met. Do not assume "we are B2B" covers you until you have read those conditions.
A build plan for the next five weeks
1. Inventory every generative surface. List each feature that outputs text, images, audio, or video to a human, which model or vendor sits behind it, and when it first shipped to EU users. That launch date decides whether you are working to December 2 or are already late. 2. Decide where the mark is applied. For images, audio, and video, embedded metadata and watermarks are the usual routes; open provenance standards such as C2PA Content Credentials are one interoperable option to evaluate. For text, marking is harder, so check what your model vendor already provides before building your own. Either way, apply the mark server-side at the point of generation, not in the UI, so exports, API responses, and webhooks carry it too. 3. Look at the Code of Practice. The FAQ says the Code of Practice on Transparency of AI-generated content has been assessed as adequate by the Commission and the AI Board, and that signatories get more legal certainty. Non-signatories must show compliance by other adequate means and may face more information requests. 4. Keep visible disclosure separate. Machine-readable marks do not replace the human-facing duties. The FAQ is explicit that deployers cannot rely on a provider's machine-readable mark to disclose a deepfake. We covered the interface side in our AI disclosure UX guide for Article 50 , and the text-provenance tradeoffs in what B2B SaaS must decide about EU text provenance . 5. Write it down for buyers. Procurement teams will start asking. A one-page note covering which features generate content, how outputs are marked, and what customers must label themselves belongs next to the rest of your AI governance checklist .
Art. 50(2) readiness, per generative feature
[ ] First EU launch date recorded (before or after 2026-08-02)
[ ] Output types: text / image / audio / video
[ ] Out-of-scope check (code, M2M, standard editing, B2B conditions)
[ ] Marking method chosen and applied server-side
[ ] Marks survive export, API and webhook paths
[ ] Vendor marking capabilities confirmed in writing
[ ] Code of Practice alignment decision recorded
[ ] Customer-facing labelling guidance publishedWhat it costs to ignore
The FAQ says enforcement sits mainly with national market surveillance authorities, with the AI Office covering a narrower set of systems built on general-purpose models, and that fines can reach 15 million euros or 3% of worldwide annual turnover, with proportionality for SMEs. In practice the commercial cost arrives first: a buyer's security review asks how your AI output is marked, and the deal stalls.
The founder takeaway
If a generative feature was live in the EU before August 2, put December 2, 2026 on the roadmap with an owner this week. Inventory the surfaces, pick a marking method you can apply at generation time, decide on the Code of Practice, and keep the visible disclosure work moving alongside it. That is a few sprints of work if it starts now.
