Some business owners read the headlines about the AI Act being delayed and put their preparation on hold. If that includes you, you are now behind on the part that affects most small businesses.
This week the EU moved from writing the rules to setting up how they are enforced. On 12 October the European Commission opened a public consultation on a draft regulation covering how AI Act penalty procedures will work, including safeguards for companies and limitation periods. It runs until 9 November. Two days later, AI Weekly reported that Executive Vice-President Henna Virkkunen told a summit in Dublin that the EU AI Office has sent its first AI Act information requests, to OpenAI and Anthropic. That report comes from a single outlet and has not been confirmed by an official announcement.
Those requests target AI labs, not your shop or clinic. But the rules covering the chatbot on your website and the AI images in your newsletter already apply, and they can be enforced today.
What the Digital Omnibus actually delayed
The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It moved the obligations for stand-alone high-risk AI systems from 2 August 2026 to 2 December 2027. Those are the Annex III uses: recruitment tools, credit scoring, exam grading and AI used by police or border agencies. AI built into products covered by EU safety law now has until 2 August 2028.
If you screen job applicants with an AI tool or score customers for credit, you gained time. Use it, because those are the heaviest obligations in the Act.
The Omnibus did not touch Article 50. Its transparency duties applied on schedule from 2 August 2026, and national market surveillance authorities can enforce them from that date. Breaching the transparency obligations can cost up to €15 million or 3% of worldwide turnover. The same source notes that UK businesses serving EU users are also in scope.
What Article 50 means for everyday tools
Article 50 covers chatbots, AI-generated content, deepfakes, emotion recognition systems and texts meant to inform the public. For most small businesses, three situations matter.
Chatbots and AI agents that talk to customers. AI systems meant to interact directly with people, such as chatbots, voice assistants and similar conversational agents, must make sure users understand they are dealing with AI, unless that is already obvious from the context. Think of the booking assistant on your clinic site, the order-status bot in your shop, or the voice agent answering calls for your property agency. A customer should know from the first message that a machine is replying. Relying on context being obvious is a judgement call you can avoid with one clear line of text.
AI-generated or manipulated images, video and audio. When content counts as a deepfake, the business publishing it must disclose its artificial or manipulated origin. Artistic and satirical works get lighter rules. If your marketing team generates a realistic video of a person or a scene that could pass as real, label it.
AI-written text on matters of public interest. The same disclosure duty applies to AI-generated or manipulated texts meant to inform the public. A clinic publishing health guidance or a logistics firm commenting on new customs rules is closer to this than a shop writing product descriptions. Where the line falls is explained in the Commission's draft guidelines published on 8 May 2026, which cover who must disclose chatbots, mark synthetic content and label deepfakes. Have whoever runs your content read them.
The December deadline your vendors need to meet
Generative AI systems already on the market before 2 August 2026 have until 2 December 2026 to add machine-readable marking to their outputs. Every other Article 50 obligation has applied since August.
That marking is mainly the job of the companies that build the tools: image generators, writing assistants, video tools and voice platforms. But you choose which tools your team uses. If your marketing runs on a tool that cannot mark its output by December, that gap ends up in the content you publish. Ask your vendors now, while there is still time to switch if the answer is vague.
The same date brings a hard ban: AI systems built to generate child sexual abuse material or non-consensual sexual imagery of real people become illegal to place on the EU market. Legitimate business tools are not affected, but it shows 2 December is a real milestone on the enforcement calendar.
What to do this week
- Make a list. Write down every place where AI talks to customers or produces content you publish: website chat, WhatsApp or email bots, phone agents, image and video tools, writing assistants. Name one person who owns the list and keeps it current.
- Add a disclosure to every chatbot and voice agent. Show it at the start of the conversation, for example a line saying the customer is chatting with an AI assistant and how to reach a person. Your web team or chatbot vendor can usually change the welcome message in minutes.
- Set a labelling rule for marketing. Realistic AI-generated or manipulated images, video and audio get a visible label, and so do AI-written articles meant to inform the public. Put the rule in writing so freelancers and agencies follow it too.
- Email your AI vendors. Ask how they will meet the 2 December 2026 machine-readable marking deadline, and whether the marking stays in place when your team exports or edits the output.
- Calendar the high-risk date. If you use AI in hiring or credit decisions, put 2 December 2027 in the diary and start mapping those tools now.
The EU is building the machinery to enforce the AI Act, starting with the largest AI labs. National authorities already have the power to check the transparency rules that apply to ordinary business tools. Telling customers they are talking to AI and labelling synthetic content are small, cheap changes, and making them now keeps you out of the group that has to catch up later. If you want help auditing your chatbots and content workflows, Stolos sets this up for businesses as part of our automation work.