EU AI Act Transparency: What to Build Now

Most of the AI Act coverage this year has been about the delay. High-risk obligations slipped to December 2027, product-embedded AI to August 2028, and a lot of teams read the headline and moved the whole thing to next year’s problem list.

The part that affects your front end didn’t slip. Article 50 — the transparency and content-labeling rules — applied from 2 August 2026 and is in force now. It’s also the cheapest part of the Act to comply with, provided you build it in rather than bolt it on. Two caveats before anything else: we build software, not legal opinions, and scope questions belong with counsel. What follows is the engineering work.

Why This Reaches Israeli Products

Scope follows your users

If your product’s AI output reaches someone sitting in Munich, the Act can apply regardless of where your company is registered. Same extraterritorial shape as GDPR. For an Israeli SaaS company with European logos on the homepage, “we’re not an EU company” has never been a working answer, and it isn’t here either.

Procurement will ask before a regulator does

In practice the enforcement you feel first is commercial. Enterprise buyers in the EU have been adding AI Act questions to security reviews since the spring, and the questions are specific: how do you disclose, how do you mark outputs, where are your logs. A deal stalling for six weeks over a checkbox costs more than the two sprints it takes to build the thing properly.

The Four Things Article 50 Asks For

Tell people when they’re talking to a machine

Any system that interacts directly with a person has to make clear it’s an AI, at the start of the interaction, unless it’s obvious to a reasonably well-informed user. A chat widget on a support page is not obvious. An agent that phones a customer is very much not obvious.

When we built Agents Army, a multi-agent chat platform, agent identity was already a product requirement — users needed to know which model was answering. Disclosure came almost free. Retrofitting it into a product where the assistant was deliberately designed to feel human is the expensive version.

Mark synthetic output machine-readably

Providers of systems that generate synthetic image, audio, video, or text have to mark the output in a machine-readable format so it’s detectable as generated. That means metadata and provenance signals — C2PA content credentials, watermarking, cryptographic signing — not a visible logo in the corner.

This one has a real failure mode: your pipeline eating the metadata. Thumbnailing, format conversion, and most CDN image transforms strip EXIF and XMP by default. On AI Studio, where the entire product generates photorealistic imagery, provenance has to survive every resize between the model and the browser. Test it end to end, not at generation time.

Label deepfakes where a human will see them

Deployers publishing image, audio, or video content that depicts real people or events have to disclose it as artificially generated, clearly and at first exposure. The machine-readable marker doesn’t cover this — it’s a separate, human-facing duty, and it lands on whoever publishes.

Say when text was machine-written

Text published to inform the public on matters of public interest carries a disclosure duty too, softened where a human reviewed and took editorial responsibility. If your product auto-publishes articles, listings, or summaries at scale, that human-in-the-loop step is now doing double work: quality control and compliance.

Building It Instead of Bolting It On

Disclosure is interaction design, not a footer

Grey 10px text under the input box is the pattern that gets flagged. The requirement is that a person actually understands, at the moment it matters. That’s the same problem agentic UX has been solving anyway — telling users what the system is, what it’s about to do, and what it just did. Good disclosure and good AI UX are mostly the same work, which is why we treat it as part of UX design rather than a legal patch.

Provenance is a pipeline concern

Decide where marking happens — at generation, or at the last step before storage — and enforce it in one place. Scatter it across three services and you’ll ship an unmarked path within a quarter. Add a test that pulls a generated asset back through the full delivery chain and asserts the credentials are still readable.

Your logs are the evidence

When a customer or regulator asks what your model produced and whether it was disclosed, you need a record. Prompt, output, model version, disclosure state, timestamp. If you’ve already done LLM observability work, you have most of this and just need to keep it long enough. If you haven’t, this is another reason to.

What We’d Prioritise This Quarter

Inventory every surface that emits AI output

Start with an inventory: every place your product generates or relays AI output to a user. Most teams find two or three surfaces nobody was tracking — an email summariser, an internal tool someone exposed to customers, a vendor widget.

Fix in order of engineering cost

Then fix disclosure first, because it’s UI work and it’s fast. Provenance marking second, since it touches infrastructure. Retention and logging third. None of this is heavy engineering. It’s a couple of sprints, and it’s substantially cheaper than explaining to a European buyer why you can’t answer question 47.

If you’re shipping AI features into European markets and want a second pair of eyes on what needs building, that’s the kind of scoping we do at the start of AI development work. Tell us what you’re building.

Yaniv Amrami is founder of quickdev. He has built and shipped AI products for Israeli startups selling into European markets, and spends more time on disclosure UI than he expected to.