Since 2 August 2026, the transparency obligation under Article 50 of the EU AI Act has applied across Europe. The deadline passed a week ago, a good moment to take stock. What do you now need to have in place, which requirements do not yet apply, and what changes for the models you use every day?
What applies now
The core is simple: any AI that communicates directly with people must make itself known as AI. That sounds obvious, but the law is more precise than most implementations so far. Specifically, from 2 August the following obligations apply:
Chatbots and voicebots must inform users at the start of a conversation that they are dealing with an AI system, unless this is "obvious to a reasonably well-informed and reasonably observant person." That exception is narrower than it sounds: an embedded assistant on a business website usually does not fall under it.
AI-generated content, text, audio, images and video, must be marked in a machine-readable way so that detection tools can recognise it. This applies to content published to the public on matters of general interest, unless it has been editorially reviewed and a person holds editorial responsibility.
Emotion recognition and biometric categorisation: users must be informed about how the system works before they interact with it.
Fines for infringement can reach €15 million or 3% of annual turnover, whichever is higher. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has been designated as the supervisor for the transparency obligations in the Netherlands.
What does not yet apply
This is where many compliance projects run into trouble: the high-risk requirements do not yet apply. Systems listed in Annex III, think of AI used in recruitment, credit assessment or essential public services, only have to meet the stricter requirements from 2 December 2027. AI in safety components of regulated products has until August 2028.
The practical implication: the step from "we have an AI policy" to "we fully comply with the AI Act" is bigger than August might suggest. The transparency obligation is step one, not the finishing line. On our safety page you can see, per model, which privacy aspects are relevant for Dutch organisations.
Which models are directly affected?
The obligation applies to providers and users (deployers) of AI systems. If your organisation has set up a chatbot based on, for example, Claude or ChatGPT, you as the deployer are responsible for the disclosure obligation, not only Anthropic or OpenAI.
On 24 July 2026, Anthropic released Claude Opus 5, with a context window of one million tokens, adaptive reasoning on by default, and the same price as its predecessor Opus 4.8: $5 per million input tokens and $25 per million output tokens. Via the Batch API these rates are halved. For organisations working heavily with structured documents, the long context window is relevant, but the AI Act obligations apply regardless of which model you use.
Three concrete steps
If you have not yet sorted this out, these are the priorities:
- Make an AI inventory. Which systems communicate directly with employees, customers or citizens? Every chatbot, voicebot or embedded assistant falls under the transparency obligation.
- Add an opening disclosure. The notice must be proactive, not buried in the terms and conditions. "You are speaking with an AI assistant" at the start of the conversation is the minimum standard.
- Document the chain of responsibility. Who is the deployer, who is the provider, and who is internally accountable? Recording that is also the basis for the stricter requirements that follow in 2027 and 2028.
For sectors such as healthcare, financial services and legal services, the step towards full EU AI Act compliance is larger, because the high-risk classifications are likely to apply to the systems they already run.
Sources: De Saak, AI Act from August 2026, Primelaw, transparency obligation and postponement, Lucas IT, new phase of the AI Act, Coursiv, Claude Opus 5