The AI Act is here, just not the one everyone expected

The primary source, published four days before it took effect — and the reason this week matters: since 2 August, the Article 50 transparency obligations apply. A chatbot has to identify itself as a machine, synthetic content needs machine-readable marking, deepfakes and unreviewed AI text on matters of public interest must be labelled. Alongside it a Code of Practice: follow it, or demonstrate "alternative equivalently adequate means". Read the original, not the summaries — and treat it as a design input, not legal cleanup after the fact.

The part everyone heard — and from which most drew the wrong conclusion. Now final: stand-alone high-risk systems (Annex III) have until 2 December 2027, AI embedded in regulated products (Annex I) until 2 August 2028, and watermarking for systems already on the market until 2 December 2026. For my world Annex I is the one that counts: machinery, medical devices, vehicles — the longest runway of all. But a runway is not a cancellation, and anyone reading it as a pause will be two years behind in 2027.

The details almost nobody reported. The AI-literacy obligation was softened (companies must support the development of literacy, not guarantee a level), a new Article 5 prohibition targets "nudifiers" and abuse imagery — and the underrated one: the EU AI Office gains new enforcement tools, including investigations and on-site inspections. The deadlines slip while the teeth grow. Anyone reading "simplification" as "deregulation" is misreading the package.

The most usable practical checklist I found: map AI use cases, review existing disclosures, evaluate content workflows, set labelling standards, document exemption analyses — and the point almost everyone misses: review vendor arrangements and clarify who carries the obligation. That is the build-vs-buy question in legal form. If a supplier’s model generates your customer-facing content, whose disclosure duty is it? You settle that in the contract, not in the audit.

The trap and the technical reality — for me the most important piece of the week. The Omnibus deferred high-risk but left Article 50 untouched: anyone who assumed "everything moved" has had a compliance gap since Sunday, at up to €15 million or 3% of global turnover. Then the sober part: a watermarking scheme adopted in good faith today can be publicly defeated within months — research demonstrates attacks in the $50 range. Compliance is a floor, not proof. Here too: the model is the easy part.