Since 2 August 2026, Article 50 of the AI Act has applied: if you run a chatbot, publish realistic AI-generated images or video, or publish AI-written text on matters of public interest, you have to say so clearly. The delay to the AI Act (the “Digital Omnibus”) is in force, but it only moved the rules for high-risk systems and one point of Article 50. For a small business with a chatbot on its website, the basic rule has not changed.
I’m Toure Tia Kevin, a web developer in Bassano del Grappa, Italy. This article summarises official sources and legal commentary checked in November 2026; where I add my own opinion, I say so. This is not legal advice: for your specific case, talk to a lawyer or your data protection consultant.
What is actually in force in November 2026
- The delay is in force. Regulation (EU) 2026/1744 (the “Digital Omnibus on AI”) was published in the Official Journal of the European Union on 24 July 2026 and entered into force on 27 July 2026, according to law-firm summaries I consulted (if you need an exact date, check the official text on EUR-Lex).
- What it delayed. Rules for Annex III high-risk systems move to 2 December 2027; systems built into regulated products (Annex I) move to 2 August 2028.
- What it did not delay. The Article 50 transparency duties have applied since 2 August 2026. The one exception is machine-readable marking of synthetic content (Article 50(2)) for systems already on the market before that date, which moves to 2 December 2026.
| Date | What | Status in November 2026 |
|---|---|---|
| 2 August 2026 | Article 50: transparency for chatbots, deepfakes, public-interest text | Applies |
| 2 December 2026 | Machine-readable marking for systems already on the market; new bans on AI-generated non-consensual sexual content and child abuse material | Not yet reached |
| 2 December 2027 | High-risk systems (Annex III) | Delayed |
| 2 August 2028 | High-risk systems in regulated products (Annex I) | Delayed |
What Article 50 asks of a small business
Article 50 splits the duties between whoever provides the AI system (the company that builds it) and whoever uses it professionally (you, when you put it on your site or use it to communicate). The most common cases, according to the text of the regulation:
- Chatbots and virtual assistants (para. 1). The system must be designed so people know they are talking to an AI, unless that is obvious to a reasonably well-informed person. The formal duty sits with the provider.
- Realistic AI-generated or altered images, audio and video, known as deepfakes (para. 4). Whoever publishes them must disclose that they are artificial. For clearly artistic, creative or satirical works the duty is lighter: it is enough to flag it without spoiling the work.
- AI-generated text published to inform the public on matters of public interest (para. 4). It must be disclosed, unless a person has reviewed it and someone takes editorial responsibility.
- Marking of synthetic content (para. 2). This falls on the providers of text, image and video generators, not on you. If you use ChatGPT, the job belongs to its maker.
- Emotion recognition and biometric categorisation (para. 3). Whoever uses them must inform the people exposed.
The information must be given clearly, at the latest at the first interaction (para. 5).
What this means for your website
What follows is my reading, not a rule:
- Chatbot on the site. Show a message like “You’re chatting with an AI assistant” straight away. If an outside company supplied the chatbot, ask how it complies with Article 50 and keep the answer. If you need a custom assistant, see the AI chatbot for websites service.
- Posts and marketing copy written with ChatGPT. Text promoting your business is not, in itself, text “published to inform the public on matters of public interest”. Disclosing it is not forbidden, but Article 50 doesn’t require it here. If you publish press releases or articles on public topics without human review, the answer changes.
- Photos and video. In the regulation, a deepfake is AI-generated or altered content that resembles real people, objects or places and could pass as authentic. A realistic face, voice or scene invented with AI must be disclosed; a deepfake of a real person must always be disclosed.
- Voice on the phone. An AI voice assistant must be disclosed at the start of the call (I cover this in voice AI for small businesses).
Penalties and oversight
For breaches of the transparency duties the regulation sets fines of up to 15 million euros or 3% of worldwide annual turnover; for SMEs the lower of the two applies (Article 99). It is not the 35 million ceiling quoted in many articles: that one covers prohibited practices.
In Italy, Legislative Decree 179/2026, published in the Gazzetta Ufficiale (the Italian official gazette) on 8 October 2026 and in force since 23 October 2026, names the ACN as the market surveillance authority and AgID as the notifying authority. The decree also has a workplace rule: decisions on hiring and dismissal can’t rest solely on automated processing. I couldn’t verify which Italian penalty applies to Article 50 breaches: the summaries I read don’t say.
Two other things to know
- AI CV screening. It isn’t covered by Article 50: it is a high-risk system, so its rules move to 2 December 2027. The GDPR and the Italian rule on employment decisions already apply, though.
- If you have a 231 model. According to a legal commentary (Filodiritto, 7 October 2026), Legislative Decree 160/2026 added Article 25-vicies to Legislative Decree 231/2001 (corporate liability), covering offences committed using AI systems, including the unlawful spread of AI-falsified content (Article 612-quater of the Criminal Code). The same commentary notes that a dedicated protocol isn’t necessarily required: the outcome should be documented in the risk assessment. Ask your consultant.
For other tools, read the guide to artificial intelligence for small businesses and the one on AI automation in Veneto. For the effect on site traffic, see the article on Google AI Overviews and AI Mode.
Frequently asked questions
Did the Digital Omnibus delay the transparency duties?
No, apart from one point. It delayed high-risk systems to 2027-2028. Article 50 has applied since 2 August 2026; only machine-readable marking for systems already on the market moved to 2 December 2026.
I have a chatbot on my site: what do I do?
Tell the person writing that they are talking to an AI, in the first message and not buried in the terms. If the chatbot comes from a vendor, ask them in writing how they comply with Article 50.
Do I have to write “AI-generated” on every post?
According to the text of Article 50, no: the duty covers deepfakes and text published to inform the public on matters of public interest without human review. If in doubt, ask a professional.
If I don’t comply, do I risk 35 million?
No: that ceiling is for prohibited practices. For transparency the maximum is 15 million or 3% of turnover, and for SMEs the lower of the two.
If you’d like to check what is on your site (chatbots, forms, AI content), get in touch.
