2 August 2026: the AI deployer checklist — what stays binding despite the Digital Omnibus

A dangerous misunderstanding is doing the rounds: that the Digital Omnibus "softened" the AI Act and bought everyone time. That holds for the high-risk obligations — but not for the transparency obligations. Those apply from 2 August 2026, and they bind not only providers but also deployers: every company that uses AI.

The deadline is only weeks away. This article cleanly separates what was deferred from what stays, clears up the often-confused distinction between provider and deployer, and gives you a checkable checklist. Up front, plainly: this is a professional briefing, not legal advice.

What the Digital Omnibus deferred — and what it didn't

On 7 May 2026, the Council and Parliament reached a provisional agreement on the Digital Omnibus, the first major amendment to the AI Act. It defers the high-risk obligations — but the transparency obligations under Article 50 stay on 2 August 2026. Equating "deferred" with "done" overlooks exactly the obligations that bite first.

Two caveats belong to honesty: the Omnibus began as a provisional political agreement (7 May 2026) — the European Parliament adopted the text on 16 June 2026, so only the Council's formal adoption and publication in the Official Journal remain (expected before 2 August 2026). And one detail does touch Article 50: the machine-readable marking of synthetic content by providers (Art. 50(2)) applies from 2 August 2026 in general; only generative AI systems already on the market before then get a four-month grace period to 2 December 2026. The other transparency obligations are unchanged.

Provider or deployer? The distinction decides

Under Article 3(4) of the AI Act, a deployer is any natural or legal person using an AI system professionally under its own authority. A provider is whoever develops it (or has it developed) and places it on the market under its own name. So most companies using a third-party AI tool are deployers — and carry their own obligations, independent of the provider.

Article 50 splits the duties along this line:

Important: anyone who substantially modifies, adapts or offers an AI system under their own name can additionally become a provider — and then carries both sets of duties.

The deployer duties under Article 50 — the checklist

For deployers, two paragraphs matter most — plus the rule on how disclosure must happen:

The provider duties — flagging the AI interaction (50(1)) and machine-readable marking of synthetic content (50(2)) — apply on top if you provide systems yourself. To support labelling, the European Commission published a (voluntary) Code of Practice on marking AI-generated content on 10 June 2026. The Code is voluntary — the underlying Article 50 obligations are not.

What happens on a breach — and who checks?

Breaches of the transparency obligations can be fined up to EUR 15 million or 3% of total worldwide annual turnover under Article 99 of the AI Act — whichever is higher. In Germany the Bundesnetzagentur becomes the central market-surveillance authority: the Bundestag passed the implementing law (KI-MIG) on 11 June 2026; the final step in the legislative process is still pending. The supervisor is getting its national teeth right on time for the deadline.

How a local, auditable stack makes compliance easier

Transparency, labelling and traceability are not architectural accidents — they are a property. An AI stack that delivers sourced answers (every statement backed by a source) and logs every retrieval in an audit trail makes disclosure and documentation duties practically achievable, rather than something to reconstruct after the fact. That is exactly how Lokalaise is built: a grounded, permission-aware knowledge layer on your own hardware, with no external APIs — with traceable data flows you can actually evidence to a supervisor (see Security & data sovereignty).

It fits the wider sovereignty thread we described using the cloud criteria: BSI C3A: when is a cloud truly sovereign? — and why uncontrolled AI use also gets expensive, we show in our piece on shadow AI. To be clear: Lokalaise is an enabler, not legal counsel. Which of your use cases fall under Article 50 is something to assess with your legal team — we provide the technical foundation.

Your next steps

Three questions create clarity fast — answer them for every AI use in your organization:

1. Role: For this system, are you the deployer, the provider — or both?
2. Trigger: Do you generate deepfakes or publish AI text on matters of public interest? Does the human-review exception apply?
3. Evidence: Can you, if challenged, evidence disclosure, labelling and data flows?

Wherever you hesitate, it's worth a closer look. In a short demo we'll show how a local, auditable AI stack practically supports meeting the transparency obligations.