AI Policy

The AI Label Rule Lands on You, Not Your Vendor

The EU Code of Practice on Transparency of AI-Generated Content binds deployers, not just vendors, from 2 August 2026. The signatory deadline is 27 July, not 22 July. What owners need to know.

AI PolicyBy Servola Tech Desk2026-07-178 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

The AI Label Rule Lands on You, Not Your Vendor

Key takeaways

Article 50(4) of the AI Act binds the deployer, which is your company, and it applies from 2 August 2026 with a ceiling of up to 15 000 000 EUR or 3 % of total worldwide annual turnover, whichever is higher.
Submit the signatory form for the Transparency Code by 27 July 2026, 18:00 CEST to be listed as an initial signatory, and verify that date on the European Commission's own page rather than in trade coverage.
Sign Section 2 alone by 27 July 2026 if you publish AI-assisted content but do not build AI systems, because Section 2 carries the deployer labelling obligations without the provider marking obligations of Section 1.
If your company is an SME, including a startup, read Article 99(6) before you budget for the fine, because it reduces the penalty to the lower of the applicable amounts, not the higher.
Name a human reviewer against every AI-assisted piece you publish before 2 August 2026, because the Commission's Code sets a specific regime for cases involving human review and editorial responsibility.

The Person Who Schedules Your Posts Has Not Heard of This

The exposure in your company sits with whoever clicks schedule on your posts, and that person almost certainly does not know a European deadline is attached to it. It is a Tuesday afternoon. Someone on your marketing team has eleven AI-drafted posts queued in a scheduler, staggered across the next fortnight. Two of them summarise a policy change in your sector. One reworks a customer story. Nobody has read them line by line since the model produced them, because the whole point of the workflow was that nobody would have to. The queue goes out. It has been going out like this for months.

On 10 June 2026 the European Commission published the final version of the EU Code of Practice on Transparency of AI-Generated Content. The Commission states that Article 50(2), (4) and (5) of the AI Act become applicable from 2 August 2026. Most of what has been written about that date has treated it as a vendor problem, something for the companies that build the models to solve with watermarks and detection tooling. That reading is half the rule. Article 50(4) does not point at your vendor. It points at the deployer, and the deployer is the company that published the eleven posts.

There is a form, and there is a date on the form, and the date is closer than 2 August. The Commission's signing FAQ is explicit: "To be included in the list of initial signatories that will be published before the AI Act's general date of entry into application of 2 August 2026, signatories must submit their completed forms by 27 July 2026, 18:00 CEST." Ten days from now, at six in the evening, Brussels time. The person with the scheduler open has no reason to know that, and no mechanism in your business is going to tell them.

27 July, Not 22 July, and Why the Difference Is Costing People

A large share of the trade press has reported this deadline as 22 July, and that is wrong. The 22 July date is real, but it belongs to a different instrument. It is the signatory deadline for the GPAI Code of Practice, which is a separate code with a separate scope and a separate set of signatories. The Commission's own page for the Code of Practice on Transparency of AI-Generated Content says 27 July 2026, 18:00 CEST. It does not mention 22 July anywhere. Two EU AI codes with adjacent late-July deadlines have been conflated, and the error has propagated.

We are not naming outlets, because the point is not who got it wrong. The point is what the error does to a reader. If you took 22 July as your deadline and you are one of the companies that would have signed, you have already built your internal timeline around a date that does not apply to the code you need. If you noticed the conflict and assumed the earlier date was the safe one, you have made a reasonable guess that happens to be about the wrong document entirely. Neither reader is careless. Both are working from coverage rather than from source.

The instruction here is narrow and it is the most useful thing in this piece. Do not take the date from us either. Open the European Commission's own page for the Transparency Code and read the deadline off it yourself before you act. That takes four minutes and it settles the question permanently. For a rule that carries the penalty this one carries, four minutes against a primary source is the cheapest work in your week, and the Commission publishes it precisely so that nobody has to rely on a secondhand account of what it says.

Two Sections, and You Probably Only Need the Second

The Code has two sections, and a deployer can sign the second one alone without taking on any of the provider obligations in the first. Section 1 covers the marking and detection of AI-generated content. It binds providers under Article 50(2), which is to say the companies that build and supply the AI systems. If you buy your models rather than build them, Section 1 is not describing you. Section 2 covers the labelling of deepfakes and of AI-generated or manipulated text published to inform the public on matters of public interest. It binds deployers under Article 50(4). That is your company.

The Commission's signing FAQ confirms that a deployer may sign Section 2 on its own. This matters more than it sounds. The reason most owners have filed this whole subject under vendor problem is that the marking and detection language reads like engineering work they cannot do and should not own. They are right about that, and it is not work they should be taking on. But the deployer half of the Code is separable, and signing it does not drag the provider half along behind it.

What signing buys is a presumption of conformity, again per the Commission's signing FAQ. That is the practical prize and it is worth being clear about its size. A presumption of conformity does not make you immune and it is not a certificate. It shifts the starting position: your labelling practice is presumed to meet the obligation rather than presumed to be an open question. For a company that publishes AI-assisted content and would like to keep doing so after 2 August, the cost of that shift is a form submitted by 27 July.

The Fine Arithmetic Inverts If You Are an SME

The number everyone quotes is the large-company ceiling, and for an SME the formula runs the other way. Article 99(4) of the AI Act covers transparency obligations for providers and deployers pursuant to Article 50. The ceiling reads: "up to 15 000 000 EUR or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher." That is the sentence that has travelled. It is accurate and it is not the whole provision.

Article 99(6) provides that for SMEs, including startups, the fine is reduced to whichever of the applicable amounts is lower, not higher. Nearly all coverage omits this. Read the two together and the arithmetic inverts by company size. For a large undertaking, 15 million and 3 % of worldwide turnover are two candidate figures and the bigger one governs. For an SME, they are the same two candidate figures and the smaller one governs. The provision is a reduction rule, not an exemption, and the ceiling it produces is still a real number that can be large relative to a small balance sheet.

Be careful with this and do not let it do more work than it can carry. It does not mean SMEs are outside Article 50. It does not change the 2 August application date, the obligations themselves, or the 27 July signing deadline. What it changes is the figure an owner should be holding in their head when they decide how much this is worth to them. If you have been budgeting attention against the headline number and your company is an SME, you have been sizing the wrong risk, and the correct one is still worth sizing properly.

The Compliance Artifact Is a Named Human, Not Software

The route through Article 50(4) is not a watermark, a detector, or a clause in a vendor contract, but a person whose name is against the output. The Commission's FAQ describing the Code says it "also provides practical guidance on the design, placement and presentation of labels, disclaimers or icons, while considering specific regimes for artistic, creative, satirical, fictional or analogous works, as well as cases involving human review and editorial responsibility." Read that last clause slowly. It is a specific regime for cases involving human review and editorial responsibility. It is not a blanket exemption and it is not a loophole, and anyone selling it to you as either is overclaiming.

Now put it next to how AI content workflows are actually built. The workflow that maximises headcount savings is the one where a model generates, a scheduler publishes, and no human reads anything in between. That is the whole business case. It is also precisely the workflow with no human review and no editorial responsibility in it, which means it is the workflow that forfeits the regime that would have covered it. The cheaper you run the pipeline, the more of the Code's own accommodation you give up. Nothing about that is a technical problem, so nothing about it has a technical fix.

The mechanics are undramatic. On labels, the Commission's FAQ references "an optional EU icon in three variants that deployers can rely on to easily implement the labelling obligation in the AI Act in a consistent and effective manner." Optional, and in three variants. On timing, AI systems placed on the market before 2 August 2026 get room: "These AI systems benefit from a transitional period for compliance until 2 December 2026." That transitional period is about systems, not about your publishing practice, and it does not move the 27 July form or the 2 August application of Article 50(4). What moves those is you, deciding whose name goes on the work.

Frequently asked questions

What is the actual signing deadline for the Transparency Code?

27 July 2026, 18:00 CEST. The Commission's signing FAQ states that to be included in the list of initial signatories published before the AI Act's general date of entry into application of 2 August 2026, signatories must submit their completed forms by 27 July 2026, 18:00 CEST. Check the Commission's own page for the Code of Practice on Transparency of AI-Generated Content rather than relying on coverage.

I read that the deadline is 22 July. Which is right?

27 July 2026 is the deadline for the Transparency Code. The 22 July date belongs to a different instrument, the GPAI Code of Practice, which is a separate code with separate signatories. The Commission's page for the Transparency Code says 27 July 2026, 18:00 CEST and does not mention 22 July. The two codes have adjacent late-July deadlines and have been conflated in a good deal of trade reporting.

Does this apply to my company if we only use AI tools rather than build them?

Yes, through Section 2 of the Code and Article 50(4) of the AI Act, which bind deployers. Section 1 covers marking and detection and binds providers under Article 50(2), so it does not describe a company that buys its models. Section 2 covers labelling of deepfakes and of AI-generated or manipulated text published to inform the public on matters of public interest. Article 50(2), (4) and (5) become applicable from 2 August 2026.

Do I have to sign the whole Code?

No. The Commission's signing FAQ confirms that a deployer may sign Section 2 alone, without taking on the provider marking obligations in Section 1. Signing gives a presumption of conformity. For a company that publishes AI-assisted content and does not build AI systems, Section 2 on its own is the relevant commitment.

What are the penalties?

Article 99(4) of the AI Act covers transparency obligations for providers and deployers pursuant to Article 50, with a ceiling of up to 15 000 000 EUR or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher. Article 99(6) provides that for SMEs, including startups, the fine is reduced to whichever of the applicable amounts is lower rather than higher. The headline figure is therefore the large-company ceiling.

Is there an exemption for edited or human-reviewed content?

Not an exemption. The Commission's FAQ describing the Code says it provides practical guidance on the design, placement and presentation of labels, disclaimers or icons while considering specific regimes for artistic, creative, satirical, fictional or analogous works, as well as cases involving human review and editorial responsibility. That is a specific regime for those cases, which is a narrower thing than an exemption, and it requires that human review and editorial responsibility genuinely exist in your process.

The instinct with a rule like this is to ask what to buy. There is nothing to buy. The Commission's Code sets a specific regime for cases involving human review and editorial responsibility, and the only way to be in that regime is to have a human who reviewed the work and a person who is answerable for it. That is a staffing decision and an accountability decision, made once, and it holds. The trap is that the pipeline built to need no reviewer is the pipeline with nothing to point at when someone asks who was responsible. Between now and 2 August 2026, the useful work is short: read the deadline off the Commission's own page, decide whether Section 2 is worth a form by 27 July, and put a name against every piece you publish. Owners who do that will not think about this rule again.

EU AI ActArticle 50Code of PracticeAI transparencyDeepfakesEuropean Commission

China Would Rather Delete Its AI Than Fake a Human

China's anthropomorphic-AI rules took effect on 15 July 2026 and two giants deleted their companion agents rather than comply. Read it before the EU's own transparency rule lands on 2 August.

4 min read

AI Policy

Your AI Vendors Face EU Fines From August 2

The 2026 AI Act delay pushed the high-risk deadlines to 2027 and 2028, but it left the enforcement clock on general-purpose AI providers untouched. From 2 August 2026 the European Commission can fine any GPAI model maker up to 3 percent of global turnover. Here is what that reaches on your desk.

3 min read

Digital Sovereignty

The EU Council Revived the Rule That Scans Private Messages

The EU Council revived the lapsed rule that lets providers scan private messages with AI. For owners, confidential communication is now a governance choice.

2 min read

← All articles