The EU AI Act already applies to your chatbot. Most of the scary deadline did not.

If you offer an AI system to people in the European Union, or its output is used there, the EU AI Act already reaches you. You do not need an EU office. The obligation that arrived on 2 August 2026 is transparency — tell people they are dealing with AI, and mark synthetic content — not the full high-risk conformity stack.

The headline "the EU delayed the AI Act" was about a different chapter. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July. It moved the heavy high-risk dates. It left Article 50 where it was.

What moved, and what held

The Omnibus rewrote the calendar in Article 113. Read the rows, not the slogan.

If your compliance calendar slid everything to 2027, pull it back. The entries that talk to your customers did not move.

The question is your role, not your headcount

The Act does not care that you have 20 people and no Brussels office. Article 2 applies to providers placing an AI system on the EU market from anywhere, and to providers and deployers outside the EU where the system's output is used in the Union.

Two roles do most of the work:

• Provider. You develop an AI system and place it on the market, or put it into service, under your own name or trademark.
• Deployer. You use an AI system under your authority, other than as a purely personal activity.

A company can be both, on different products, in the same week.

Calling the OpenAI or Anthropic API does not make you the provider of their model. Chapter V — the training-data summary, the copyright policy, the Commission's model questions — sits on the company that places the general-purpose model on the market. You wander into that lane only if you develop or substantially modify a model yourself. A support bot on top of someone else's API is not that.

It can still make you the provider of an AI system. If the bot ships under your name, talks to your customers, and you put it into service, Article 50(1) is pointed at you. The model vendor already tells people that their product is AI. Your wrapper does not inherit that sentence.

The four buckets that are actually due

Article 50 is short. The Commission published guidelines on it in July, and Cooley's 3 August note is a clean restatement of who owes what. In operator language:

"Obvious" is not a vibe. A box labeled "Chat with our team" that is a model is not obvious. A box labeled "AI assistant" can be. The disclosure has to reach the person. A paragraph in the privacy policy does not.

Fines for an Article 50 miss are capped at EUR 15 million or 3% of worldwide annual turnover, whichever is higher. For SMEs the rule flips: Article 99(6) takes whichever is lower, so a small company is looking at a percentage of turnover, not an eight-figure ticket. The Omnibus extended that lower-of treatment to small mid-caps. National market-surveillance authorities impose these, and they are not equally staffed. Uneven enforcement is a reason to expect uneven early cases. It is not a reason to skip the sentence in the chat window.

What to do this month if you are not a model lab

1. List every system that talks to people or publishes content, and whether EU customers are part of the offer. An EU office is not the test. Selling the product to users in the Union is. A one-off tourist hitting a US-only tool is a question for counsel, not a reason to ignore a bot you market in English to European companies.

2. Put the disclosure in the interface. First message, or a persistent label. Same for voice: say it before the conversation pretends to be a person. If an agency or a vendor built the bot, the contract should say who the provider is. "The model company handles compliance" is usually wrong.

3. Separate marking from disclosure. Telling a human "this is AI" was due on 2 August. Machine-readable marking of outputs, for systems already on the market before that date, has until 2 December 2026 under the new Article 111(4). Systems you ship after 2 August do not get that window. Do not spend the autumn building a watermark lab if you have not yet labeled the chat.

4. Write the literacy measure down. Article 4, as amended, asks providers and deployers to support AI literacy for staff and anyone operating systems on their behalf. It explicitly does not require a guaranteed competence level per person. A one-page note — what this bot can do, what it must not do, who to call when it goes odd — is the shape of the duty. It pairs with the shadow-AI problem: the unsanctioned chatbot and the sanctioned one both need a human who knows the edges.

5. Do not open a high-risk conformity project because a blog told you August was the deadline. Hiring, credit, and education tools in Annex III now point at 2 December 2027. That is a build window. Write down whether you have one of those systems, then spend this quarter on the disclosure you already owe. If you are about to ship a hiring agent into the EU, design for the 2027 duties now. Retrofitting logs and human oversight is how those projects get expensive.

6. Keep the kill switch anyway. Transparency is the legal floor. A production agent that can write to a CRM still needs the operational ceiling we described after the Hugging Face incident: a job, not a role, and a way to stop it on a weekend.

For each AI system you ship or run:
Who is the provider (whose name is on it)?
Who is the deployer (who uses it on whose authority)?
Does it talk to a person, or publish content?
Are EU users part of the offer, or is the output used there?
↓
If yes: label the interaction, and schedule marking if you generate media or text.
If it is "just internal ChatGPT": literacy note, plus a rule for what staff may paste.

None of this is a reason to avoid putting an agent on a real workflow. It is a reason to ship the label with the bot, name an owner, and keep the high-risk paperwork on the calendar it actually has.