AI Act: The European Commission Has Clarified the Rules. Three Checks Your Company Should Run Before August 2

What changed on July 20

Article 50 of the AI Act already existed, and the August 2 deadline was already known from our July 3 article about what the Digital Omnibus postponed and what it didn't. What's new as of July 20 is the Commission's implementation guidelines — a document that translates the legal text into checkable criteria, with concrete examples, plus an official FAQ and a voluntary Code of Practice for content-marking compliance.

Until now, companies had only the letter of the law; now they also have the Commission's official reading. The questions that seemed ambiguous — what counts as "obvious," who counts as a "deployer," what exempts you from labeling — now have an official answer, not just a consultant's interpretation.

Test 1: does your agent need to say it's AI?

The guidelines set four conditions that must all be met at once for the disclosure obligation (Art. 50(1)) to apply: the system must qualify as AI; it must be built for a genuine two-way exchange with people, not just data collection or automated replies; the interaction must be direct, with the AI itself communicating rather than through a human intermediary; and it must involve a natural person. A system that runs in the background, or only automates an internal process, stays outside the obligation.

There's an exception — "when it's obvious" — but the guidelines narrow it more than most companies would expect: the official test asks you to picture an average person, reasonably informed and observant, not a tech-savvy user, and the Commission requires the exception to be read restrictively, "given that it deprives people of transparency." A chat that answers naturally, with no label at all, doesn't automatically pass this test just because your technical team knows it's a bot.

Test 2: does your AI-generated content need to be marked?

The technical marking obligation (Art. 50(2)) falls on the generative AI provider — they must add a machine-detectable mark to generated text, images, audio, or video. The guidelines exempt a few categories: short sequences of characters, source code, output that only ever moves between systems without being seen by people, and content used internally in a production workflow (video editing, for instance) until it becomes part of the final output — plus a new, narrower exemption for strictly B2B or industrial contexts.

For deepfakes, the test has three cumulative criteria: a strong resemblance to something or someone real, a subject that exists or could plausibly have existed, and a false impression of authenticity. A standard special effect in video production, one the audience isn't expected to take as real, doesn't automatically count as a deepfake.

One detail the guidelines spell out explicitly: if you publish a deepfake, you can't rely solely on the provider's technical mark to meet your own disclosure obligation. The two obligations are separate — the provider's is technical; yours, as the publisher, is toward the audience exposed to the content.

Test 3: "we read it" doesn't mean editorial control

The text-labeling obligation (Art. 50(4)) applies if AI-generated or modified text is published, informs the public, and covers a matter of "public interest" — a category wider than politics or the courts. The official list includes public administration, fundamental rights, public security and health, the environment, consumer safety, and any economic, financial, scientific, or cultural development relevant to public debate. A blog post about how a new regulation affects an industry, written with AI, can fall in scope just as easily as a political statement.

The exception: text that has gone through editorial control doesn't need labeling. The guidelines define that strictly — a person with real authority to approve, alter, or reject the content on its merits, including fact-checking and verifying sources. A spelling or grammar pass alone is explicitly called out as insufficient.

The mistake most companies make

Most of the AI Act discussions we see start from the assumption that the rule only applies if "we use ChatGPT" or "publish with AI" visibly, logo and all. The test in the guidelines depends on what the system does — a genuine, two-way, direct exchange with a person — regardless of the label on the tool. If an AI agent built into your website or app talks directly with a customer, the disclosure obligation applies whether or not that customer has ever heard of "the AI Act" or the provider behind it.

A "smart" contact form that's actually holding a conversation can fall under the law just as much as an explicitly labeled chatbot. A company that only looks at the well-known tools — ChatGPT, Copilot — while ignoring its own custom-built integrated agents risks missing exactly the area where it invested the most.

For a company running operational AI agents — the kind of work we do at MassAI — disclosure and labeling need to be built in by design, not bolted on in the final week. Today's guidelines complete our earlier piece on what the AI Act postponed and what it didn't, with the "how, concretely" part. We detail how we build compliant agents from day one in our guide to operational AI agents.

MassAI editorial policy: our analyses combine primary sources and independent publications. The information above comes from the European Commission's official guidelines and associated FAQ, both published on July 20, 2026, and is not a substitute for legal advice specific to your company's situation.

Sources: ↗ Official European Commission guidelines, AI Act Art. 50 · ↗ Official FAQ, European Commission · ↗ Quick Facts, European Commission · ↗ Code of Practice on Transparency of AI-Generated Content