The EU AI Act's Article 50 transparency obligations started applying on August 2, 2026, the same day the Commission's fining powers over general-purpose AI model providers switched on. Most CTOs I talk to who serve European customers still have not completed an AI system inventory, and many are still figuring out whether the law applies to them. It does. And the next hard deadline, December 2, 2026, is about six weeks away.

I'm not a lawyer, and this isn't legal advice. But as a fractional CTO who has led 50+ engagements, I can tell you what the engineering side of this looks like. Here's the checklist I walk through with every team I advise.

What's Actually Enforcing Right Now

The EU AI Act is rolling out in phases. As of August 2, 2026, two categories of obligations are live:

Transparency obligations (Article 50). If your product uses a chatbot, it must clearly disclose to users that they're interacting with an AI system. If it generates synthetic images, audio, or video, that content must be labeled as AI-generated. Deepfakes require explicit disclosure. These aren't suggestions: Article 50 has applied since August 2, 2026, and breaches sit in the €15 million or 3% of global turnover penalty tier under Article 99(4).

General-purpose AI model obligations. If you provide a GPAI model (think foundation models, large language models offered as a service), you have had to maintain technical documentation, comply with EU copyright law, and publish a sufficiently detailed summary of training data since August 2, 2025 (Article 53). What changed on August 2, 2026 is enforcement: the AI Office, not national regulators, can now fine GPAI providers directly, up to €15 million or 3% of global turnover under Article 101. Models released before August 2, 2025 have until August 2, 2027 to comply.

The headline penalty ceiling is €35 million or 7% of global annual turnover, whichever is higher, but that top tier is reserved for the prohibited practices in Article 5. Transparency and GPAI breaches sit one tier down at €15 million or 3%. Either way, the ceiling is above the GDPR maximum of €20 million or 4%. The EU is not treating this as a soft launch.

The December 2 Watermarking Deadline

Here's the deadline that's catching teams off guard: AI systems that were already on the market before August 2, 2026 have a grace period until December 2, 2026 to implement machine-readable watermarking for AI-generated content. Systems deployed after August 2 were required to have this from day one.

What does "machine-readable watermarking" mean in practice? Your AI-generated text, images, audio, and video need embedded metadata that automated tools can detect. This isn't a visible "made by AI" label: it's a technical marker in the content itself.

If you're using third-party model APIs (OpenAI, Anthropic, Google), check whether the provider's output already includes compliant watermarking. OpenAI, for example, attaches C2PA metadata and SynthID watermarks to images generated with ChatGPT and its API, but says text is not yet covered. Across providers, text marking is still inconsistent. Don't assume your provider has you covered. Verify it.

What Got Deferred (and What Didn't)

The EU Digital Omnibus amendments (Regulation (EU) 2026/1744), which the Council gave final approval on June 29, 2026 and which entered into force on July 27, 2026, pushed back several major deadlines:

What did not move: the transparency rules, the GPAI obligations, and the watermarking deadline. Those are all live or imminent. If you were waiting for the Omnibus to give you more time on transparency, it didn't.

This deferral of high-risk obligations is a relief for teams building AI in healthcare, HR, or financial services. You have until late 2027 to get conformity assessments, risk management systems, and human oversight mechanisms in place. But don't use that time to do nothing: the classification exercise alone takes months for a complex product.

What I'd Do: The Inventory, Audit, Register, Owner Checklist

Based on what I've seen work across the engagements I've led, here's the engineering-side checklist I'd run before December 2. I call it Inventory, Audit, Register, Owner, because those four nouns are the whole method:

Do Now (Before December 2)

  1. Inventory every AI system that touches EU users or processes EU-origin data. Include internal tools, not just customer-facing products. If it uses an LLM, a classifier, or a recommendation engine, it's in scope.
  2. Audit chatbot disclosure. Every AI-powered chat interface needs a clear, upfront disclosure. "You are chatting with an AI" before the first interaction, not buried in terms of service.
  3. Verify watermarking on synthetic content. For each system that generates text, images, audio, or video: is machine-readable provenance metadata embedded in the output? If you're using a third-party API, request their compliance documentation. If you're self-hosting, implement C2PA or an equivalent standard.
  4. Label AI-generated content in your UX. Beyond machine-readable markers, users need to know when they're seeing AI-generated content. This means visible labels, not just hidden metadata.
  5. Document your GPAI usage. If you provide a general-purpose AI model, the Article 53 technical documentation (training data summary, capabilities, limitations, intended use) has been due since August 2025. If you're a deployer, which is the far more common case, document how you've integrated the model, which provider documentation you rely on, and what safeguards you've added.

Do This Quarter (Q4 2026)

  1. Classify your AI systems by risk tier. Even though high-risk obligations don't kick in until 2027, the classification itself is complex. Start mapping each system to the Act's Annex III categories now.
  2. Build a compliance register. A simple spreadsheet works: system name, description, risk classification, applicable obligations, current status, responsible owner, next action date. Make it a living document reviewed monthly.
  3. Assign compliance ownership. This can't sit with legal alone. You need an engineering owner for each AI system who understands both the technical implementation and the regulatory requirements. In my experience, this works best as a shared responsibility between your lead engineer and your legal or compliance team.
  4. Brief your board or leadership. The penalty exposure is material. If you're the CTO, this is a conversation you should initiate: don't wait for the board to ask.

Where Teams Get This Wrong

The three failure patterns I see most often:

"Our provider handles compliance." No. The EU AI Act places obligations on both providers and deployers. If you deploy an AI system to EU users, you have your own set of obligations regardless of what your model provider does. Shared responsibility means both parties are on the hook, not that either one is off it.

"We only serve US customers." Article 2 covers providers placing AI systems on the EU market wherever they're based, deployers located in the EU, and providers and deployers in third countries where the system's output is used in the EU. If EU users get your product, or your AI's output lands in the EU, you're likely in scope. The reach follows the output, not the company's headquarters.

"We'll deal with it when we get to high-risk." The transparency obligations are live now, not in 2027. Every chatbot, every content generator, every deepfake generator has obligations today. Teams that wait for the high-risk deadline are already non-compliant on the transparency requirements that have been enforcing since August.

The Bottom Line

The EU AI Act is the first comprehensive AI regulation with real enforcement teeth. The transparency and GPAI obligations are live. The watermarking deadline is December 2. The high-risk obligations are deferred, but the classification work should start now.

If you're a CTO shipping AI products to European users, this isn't a 2027 problem. It's a right-now problem. The teams that treat AI compliance as an engineering discipline (inventories, audits, registers, owners) will navigate this cleanly. The ones that treat it as a legal department problem will find out the hard way that the engineering gaps are where the fines land.