abhinavbhatia
Sheet 02 / 05 — Blogs← Archive

Your chatbot now has to say it's a chatbot

On 2 August 2026 the EU AI Act's transparency rules started applying, and the high-risk deadline everyone was preparing for moved to 2 December 2027. Two different things, widely reported as one. This is the whole shape of the law, what Article 50 actually says paragraph by paragraph, what lands in December 2027, and what all of it meant for this site.

Two things happened to the EU AI Act on 2 August 2026, and most of the coverage I read ran them together.

The first is that Article 50 started applying. If you run something people talk to, it now has to tell them it is a machine. The second is that the deadline everyone had been preparing for — high-risk systems, the annex with recruitment and credit scoring and access to essential services in it — stopped being the deadline. The Digital Omnibus moved it to 2 December 2027. That was agreed on 6 May 2026, confirmed by Member States a week later, and in force before August.

So a lot of teams spent the summer bracing for a date that had already been pushed back, and quietly missed the one that hadn’t.

I want to start further back than the news cycle did, because the two dates only make sense once the shape of the law is clear. Then Article 50 in detail, then what actually arrives in December 2027, then what all of it meant for this website.

The shape of it: four tiers, not one rulebook

The AI Act does not regulate AI. It regulates uses of AI, sorted into four tiers by how much damage the use can do. Everything else in the law — the deadlines, the paperwork, the fines — follows from which tier you are in.

This is the part worth internalising, because it is where most of the confusion starts. People ask “is my chatbot regulated?” and the question has no answer. A chatbot answering questions about a blog and a chatbot deciding who gets a mortgage are in different tiers, owe completely different things, and have different deadlines.

TIER EXAMPLES WHAT YOU OWE LIVE FROM Prohibited Article 5 €35m or 7% turnover social scoring by public authorities, untargeted scraping of faces, emotion recognition at work or school do not ship it no compliance route Feb 2025 High-risk Annex III, Annex I €15m or 3% turnover CV screening, credit scoring, life and health insurance pricing, exam marking, emergency triage, safety components the whole stack: risk management, data governance, documentation, conformity assessment, CE Dec 2027 Annex I: Aug 2028 Transparency risk Article 50 €15m or 3% turnover chatbots and assistants, anything that generates text, images, audio or video, deepfakes, emotion recognition tell people. mark the output. that is all — but do it properly Aug 2026 now Minimal everything else spam filters, recommendation engines, the model in your camera app nothing —

the four risk tiers of the EU AI Act, what each one owes, and when each became or becomes enforceable

A system can sit in two tiers at once. A CV screener is high-risk and, if it talks to candidates, owes the Article 50 disclosure too. The tiers are not exclusive; they stack.

There is a fifth thing that does not fit the pyramid: general-purpose AI models. Whoever trains the model — OpenAI, Google, Anthropic, Mistral — carries a separate set of obligations that started on 2 August 2025. If you are calling somebody else’s model over an API, those are their obligations, not yours. That distinction matters more than it sounds, and I come back to it below.

The dates, and which ones moved

Aug 2024 in force Feb 2025 prohibitions, AI literacy Aug 2025 GPAI models, penalties 2 Aug 2026 Article 50 transparency 2 Dec 2027 Annex III high-risk 2 Aug 2028 Annex I high-risk WHAT THE DIGITAL OMNIBUS MOVED The two dashed arrows. Agreed 6 May 2026, confirmed by Member States 13 May. Article 50 did not move.

the AI Act timeline, showing which obligations applied on which date and the two deadlines the Digital Omnibus moved

The hollow circles are where those two deadlines used to be. Annex III high-risk was going to land on 2 August 2026, the same day as Article 50 — which is exactly why the two got confused in the reporting. It moved sixteen months. Annex I, the systems embedded in physically regulated products like medical devices and machinery, moved twelve months to 2 August 2028.

It is not a privacy law

I keep hearing the AI Act called Europe’s AI privacy law, and it is worth clearing up before anything else, because it sends people to the wrong department and produces the wrong project plan.

GDPR asks what you do with personal data: what you collected, why, whose it is, how long you keep it, and whether the person can see it or have it deleted. The AI Act barely mentions any of that. It is product safety law, built on the same machinery the EU uses for toys and lifts and medical devices. It asks what the system does, how much damage it does when it is wrong, whether the person on the other end knows what they are dealing with, and whether you can produce evidence that you built it carefully.

You can breach one without going near the other. A recruitment screener trained entirely on synthetic data, storing nothing at all about the candidate, is clean under GDPR and lands squarely in Annex III. A newsletter signup form is the reverse. And the enforcement lands in different places: your data protection authority for one, market surveillance authorities for the other, with the AI Office at EU level for general-purpose models.

GDPR · 2018 data protection Whose data is this? What is your lawful basis? How long do you keep it? Can they see it, or delete it? Where in the world is it stored? enforced by data protection authorities AI Act · 2024 product safety What does the system decide? Who gets hurt when it is wrong? Does the person know it is AI? Is there a human who can override? Can you show how it was built? enforced by market surveillance authorities Both apply at once. Neither answers the other's questions.

the questions GDPR asks compared with the questions the AI Act asks

Which one are you?

Almost every argument I have watched about this law turns out to be an argument about a single word: are you the provider or the deployer?

The provider develops the system, or has it developed, and puts it on the market or into service under its own name or trademark. The deployer uses it under its own authority. Most of the heavy obligations sit on the provider, which is why so many companies would like to be the deployer.

The trap is that the distinction has nothing to do with who wrote the code. Take a model you did not build, put your name on the interface, ship it to customers as your product, and you are the provider of that system. Every enterprise I have worked with that is wrapping a foundation model in its own interface is walking towards this line, and most of them have not looked down.

GPAI provider trains the model obligations since 2025 System provider builds it, or ships it under its own name Deployer uses it under its own authority Person affected ARTICLE 50(1), 50(2) say it is AI · mark output ARTICLE 50(3), 50(4) label deepfakes · label public text THE STEP MOST TEAMS MISS Take a model you did not build, put your name on the interface, sell it to a customer — and you have moved one box left. You are now the system provider, with the provider's obligations, for a system whose internals belong to somebody else.

the chain from model provider to system provider to deployer to the person affected, and where obligations attach

Article 50, paragraph by paragraph

Article 50 is one page of legal text and five distinct obligations. They bind different parties and have different escape hatches, so it is worth taking them one at a time rather than reading “transparency” and moving on.

PARAGRAPH BINDS REQUIRES WAY OUT 50(1) provider tell the person they are interacting with an AI system if it is obvious to a reasonably informed person 50(2) provider mark synthetic audio, image, video and text in a machine-readable format assistive editing, short sequences, source code, machine-to-machine output 50(3) deployer tell people they are exposed to emotion recognition or biometric categorisation narrow law-enforcement cases only 50(4)a deployer disclose deepfakes on first exposure, visibly — a watermark alone is not enough art, satire, fiction — disclose without wrecking the work 50(4)b deployer label AI-generated text published to inform the public on matters of public interest human review and editorial control

the five obligations in Article 50, who each binds, what it requires and the exemption attached to each

50(1) — say that it is AI. This binds the provider of a system intended to interact directly with people. The disclosure has to happen at the start of the first interaction, and it has to be clear and distinguishable. The exemption is that you can skip it where it would be obvious to a reasonably well-informed, observant person in the circumstances — and I would not lean on that. A branded chat bubble on a support page is obvious to you, because you built it. It is not obvious to a sixty-year-old customer who thinks they have reached the help desk.

50(2) — mark what the machine made. This binds the provider of a generative system, and it is a technical obligation rather than a labelling one: the output must be marked in a machine-readable format that lets a downstream tool detect it as artificially generated. Watermarking, metadata, cryptographic provenance. The exemptions are narrow and practical: assistive standard editing functions that do not substantially alter the input, short sequences of letters or numbers, source code, and output that never reaches a person because it goes machine-to-machine. There is a grace period here — systems already on the market before 2 August 2026 have until 2 December 2026 to comply with the marking and detection duties.

50(3) — say when you are reading someone. This one binds the deployer, not the provider, and it covers emotion recognition and biometric categorisation systems. You have to inform the people exposed to it that it is operating. You do not have to tell them what you are doing with the result, which is a gap worth noticing.

50(4), first half — deepfakes. If you deploy a system that produces image, audio or video content that appreciably resembles real people, places or events and would falsely appear authentic, you have to disclose that it is artificially generated. Crucially, disclosure here is a human-visible one, on first exposure. A machine-readable watermark satisfies 50(2) but not this. Art, satire and fiction get an exemption, provided the disclosure happens in a way that does not spoil the work — a credit rather than a banner across the frame.

50(4), second half — published text. If you publish AI-generated or AI-manipulated text in order to inform the public on matters of public interest, it has to be labelled as such. Public interest is broad — politics, public health, the environment. The exemption is human review and editorial control, and the Commission’s guidance is specific about what that means: a person with knowledge of the subject who deliberately examined the content, and who has the authority to alter or reject it. A spellcheck pass does not qualify. Neither does a skim by somebody who could not have said no.

Two more things about Article 50 that are easy to miss.

There is a Code of Practice on Transparency of AI-generated Content, and it is voluntary. Signing it does not change your obligations, but it gives you a defensible answer to “how do you know your marking is adequate”, which otherwise you have to construct yourself. Non-signatories have to demonstrate compliance by other means and can expect more scrutiny for it.

And the penalty tier is the same as high-risk: up to €15 million or 3% of total worldwide annual turnover, whichever is higher. Article 50 sits in the same fine bracket as failing a conformity assessment. It is a one-line fix guarded by a very large number, which is an unusual combination and the reason it is worth doing properly rather than approximately.

What actually happens on 2 December 2027

This is the part with real work in it, and sixteen extra months to do it is less generous than it sounds.

High-risk means one of two things. Annex I covers AI that is a safety component of a product already regulated by EU product law — medical devices, machinery, lifts, cars. Annex III is the standalone list, and it is the one most companies land in. Eight categories:

  1. Biometrics — remote identification, categorisation by sensitive attributes, emotion recognition
  2. Critical infrastructure — safety components in road traffic, water, gas, heating, electricity, critical digital infrastructure
  3. Education and vocational training — admissions, evaluating learning outcomes, assessing the level of education someone should receive, monitoring behaviour during exams
  4. Employment and workers’ management — recruitment and selection, and decisions about promotion, termination, task allocation and performance monitoring
  5. Access to essential private and public services — eligibility for benefits and healthcare, evaluating creditworthiness or establishing a credit score, risk assessment and pricing for life and health insurance, and emergency call triage
  6. Law enforcement — victim risk assessment, polygraphs, evaluating evidence reliability, offending risk, profiling
  7. Migration, asylum and border control — polygraphs, risk assessment, examining applications, detecting and identifying people
  8. Administration of justice and democratic processes — assisting judicial research and fact-finding, influencing electoral outcomes

Category 4 and the credit line in category 5 are where most ordinary enterprises discover they are in scope. If your HR team runs a CV ranker, or your bank scores a loan application, that is not an edge case — it is the middle of the target.

The escape hatch, and the trapdoor in it

Being in Annex III does not automatically make you high-risk. Article 6(3) says a system in the list is not high-risk if it does not pose a significant risk of harm to health, safety or fundamental rights, and it meets one of four conditions: it performs a narrow procedural task; it improves the result of a previously completed human activity; it detects decision-making patterns or deviations from prior patterns and is not meant to replace or influence the human assessment without proper human review; or it performs a preparatory task to an assessment.

Then the trapdoor. If the system performs profiling of natural persons, it is high-risk regardless. That single sentence closes the exemption for most of what people were hoping to use it on. A tool that ranks candidates is profiling. A tool that formats CVs into a standard template is not.

And relying on the derogation is not a quiet decision. You have to document the assessment before the system goes on the market, register anyway under Article 49(2), and hand the documentation over when an authority asks. It converts an obligation into a smaller obligation, not into nothing.

Is the use case in Annex III? yes Does it do one of the four narrow things in Article 6(3)? yes Does it profile natural persons? the trapdoor no Not high-risk. Article 50 may still apply — check it. no HIGH-RISK the full stack applies yes Still high-risk. Profiling closes the exemption, whatever else is true. THE EXEMPTION IS NOT A GET-OUT Relying on 6(3) means documenting the assessment before the system goes to market, registering under Article 49(2) anyway, and producing the documentation on request. A smaller obligation, not the absence of one.

the decision path for whether an Annex III system is high-risk, including the Article 6(3) derogation and the profiling carve-out

What the stack actually contains

If you are the provider of a high-risk system, this is what December 2027 means. It is not a policy document and a training video.

A risk management system that runs across the whole lifecycle, not a one-off assessment. Data governance for the training, validation and test sets, including examining them for bias. Technical documentation detailed enough that an authority can assess conformity from it. Automatic logging over the system’s lifetime. Instructions for the deployer complete enough that they can actually exercise oversight. Human oversight designed into the system rather than asserted about it. Accuracy, robustness and cybersecurity appropriate to the purpose, declared and tested.

Then the process wrapper. A quality management system. A conformity assessment before it goes on the market. An EU declaration of conformity. CE marking. Registration in the EU database. And after launch, post-market monitoring and serious incident reporting.

Deployers get a shorter but real list: use it according to the instructions, assign human oversight to someone competent and supported, monitor operation, keep the logs, and inform workers’ representatives before putting one into use in the workplace. Public bodies, and private bodies providing public services — plus anyone doing creditworthiness or life and health insurance pricing — additionally owe a fundamental rights impact assessment before first use.

PROVIDER · BUILD IT RIGHT Risk management system Data and data governance Technical documentation Automatic logging Instructions for deployers Human oversight by design Accuracy, robustness, security Quality management system PROVIDER · PROVE IT Conformity assessment EU declaration of conformity CE marking Registration in EU database PROVIDER · AFTER LAUNCH Post-market monitoring Serious incident reporting DEPLOYER Use it per the instructions Competent human oversight Monitor operation, keep logs Tell workers before workplace use Fundamental rights impact assessment — public services, credit, life and health cover All of it before the system goes on the market. Conformity assessment is not a launch-week task.

the obligation stack for a high-risk system, split between provider and deployer, with the conformity route across the bottom

Why it moved, and what that should change

The deadline moved because the harmonised standards were not ready. Conformity assessment works by measuring a system against published technical standards; without them, “assess conformity” has nothing to point at. The obligation did not get smaller. The ruler was late.

Which suggests a specific reading of the extra sixteen months. The work that does not depend on standards — knowing which of your systems are in Annex III, whether 6(3) genuinely applies, who the provider is in each case, whether your training data has been examined, whether a human can actually override the thing — is the same work it was in July, and none of it was waiting on a standard. What the extension buys is time to do it against a ruler that exists, rather than guessing at one.

What this site had to do

This is a static site on Firebase’s free tier. There is no server in it anywhere. Press ⌘K and you can ask questions about my writing, and the browser calls Gemini directly through Firebase AI Logic. So: what does the Act want?

Visitor presses ⌘K The ask box my interface, my name Gemini Google is the GPAI provider APPLIES · ARTICLE 50(1) The box now says it is a language model before you type, names the model, and says it can be wrong about my work. one line of text · the whole compliance cost NOT IN THIS DIAGRAM Annex III high-risk — a blog is not employment, credit or access to essential services. 50(2) machine-readable marking — that sits with Google, who provide the model. 50(3) biometrics and 50(4) deepfakes — there are none, and there will not be.

which parts of the AI Act apply to this website's assistant, and which do not

Working through it properly, in the order above.

Which tier? Transparency risk. Nothing about a blog assistant touches Annex III — it is not employment, credit, education, or access to a service anyone needs. So none of the December 2027 stack applies, now or later.

Which role? This is the one I had to think about. I did not build Gemini; Google did, and Google carries the general-purpose model obligations and the 50(2) marking duty for its output. But I took that model, wrapped it in an interface, and put it on a site with my name at the top. That is the move that pulls you towards being the provider of the system, even though the model underneath is somebody else’s. Rather than construct an argument for being a deployer, I wrote the disclosure as though I am the provider. It cost one line of text to be on the safe side of a question I would rather not have to answer.

So what changed? The ask box says, before you type anything, that you are talking to a language model, which model it is, and that it can be wrong about my work. That is 50(1), satisfied.

Two things I want to be precise about, because they are the sort of thing that gets waved through.

The site does not store the questions people ask. That is not the AI Act — it is GDPR, and it is enforced by a hasOnly() allowlist in the Firestore security rules that rejects any write containing the question text. The promise does not live in my application code, where I could break it by accident with a stray field. It lives on Google’s servers, where a client that tried to send the question would simply be refused.

And this post is a worked example of the 50(4) exemption. It was drafted with a model and then edited, checked and cut by me — human review with the authority to reject, which is what takes AI-assisted text about a matter of public interest out of scope. Published raw, it would have needed a label, and it would have deserved one.

What I would tell a customer

Establish which box you are in before you argue about anything else. Almost every disagreement I have watched about this law is two people who never agreed whether they are the provider or the deployer, discovering forty minutes later that they were answering different questions.

Then do the inventory. Not “are we compliant” — that question cannot be answered yet — but “which of our systems are in Annex III, and for each one, are we the provider or the deployer”. That list does not depend on a single harmonised standard, and until it exists, every other conversation is speculative.

And check what your own products say when they open. The transparency rules are the easy part, the cheap part, and the part that is live right now.

Sources: the Commission’s FAQ on Article 50 and its Code of Practice on Transparency of AI-generated Content; the consolidated text of Annex III, Article 6, Article 16 and Article 99; Gibson Dunn on what the Digital Omnibus moved. I am an architect, not a lawyer, and none of this is legal advice.