Since 2 August 2026: the AI deployer checklist — what is binding despite the Digital Omnibus

A dangerous misunderstanding is doing the rounds: that the Digital Omnibus "softened" the AI Act and bought everyone time. That holds for the high-risk obligations — but not for the transparency obligations. Those have applied since 2 August 2026, and they bind not only providers but also deployers: every company that uses AI.

The deadline has passed; the obligations apply. This article cleanly separates what was deferred from what applies, clears up the often-confused distinction between provider and deployer, and gives you a checkable checklist. Up front, plainly: this is a professional briefing, not legal advice.

What the Digital Omnibus deferred — and what it didn't

The Digital Omnibus — politically agreed on 7 May 2026 and in force as Regulation (EU) 2026/1744 since 27 July 2026 — is the first major amendment to the AI Act. It defers the high-risk obligations; the transparency obligations under Article 50 have applied unchanged since 2 August 2026. Equating "deferred" with "done" overlooks exactly the obligations that bite first.

On procedure: the European Parliament adopted the text on 16 June 2026; after the Council's adoption it was published in the Official Journal on 24 July 2026. One detail does touch Article 50: the machine-readable marking of synthetic content by providers (Art. 50(2)) has applied since 2 August 2026 in general; only generative AI systems already on the market before then get a grace period to 2 December 2026. The other transparency obligations are unchanged.

Provider or deployer? The distinction decides

Under Article 3(4) of the AI Act, a deployer is any natural or legal person using an AI system professionally under its own authority. A provider is whoever develops it (or has it developed) and places it on the market under its own name. So most companies using a third-party AI tool are deployers — and carry their own obligations, independent of the provider.

Article 50 splits the duties along this line:

Enlarge image

Important: anyone who substantially modifies, adapts or offers an AI system under their own name can additionally become a provider — and then carries both sets of duties.

The deployer duties under Article 50 — the checklist

For deployers, two paragraphs matter most — plus the rule on how disclosure must happen:

The provider duties — flagging the AI interaction (50(1)) and machine-readable marking of synthetic content (50(2)) — apply on top if you provide systems yourself. To support labelling, the European Commission published a (voluntary) Code of Practice on marking AI-generated content on 10 June 2026. The Code is voluntary — the underlying Article 50 obligations are not.

What happens on a breach — and who checks?

Breaches of the transparency obligations can be fined up to EUR 15 million or 3% of total worldwide annual turnover under Article 99 of the AI Act — whichever is higher. For SMEs including start-ups, the lower of the two amounts applies (Art. 99(6)). In Germany the Bundesnetzagentur is the central market-surveillance authority: the Bundestag passed the implementing law (KI-MIG) on 11 June 2026, the Bundesrat approved it on 10 July 2026, and it has been in force since 29 July 2026. The national supervisor was in place in time for the deadline. More in our article KI-MIG: who supervises artificial intelligence in Germany?

How a local, auditable stack makes compliance easier

Transparency, labelling and traceability are not architectural accidents — they are a property. An AI stack that delivers sourced answers (every statement backed by a source) and logs every retrieval in an audit trail makes disclosure and documentation duties practically achievable, rather than something to reconstruct after the fact. That is exactly how Lokalaise is built: a grounded, permission-aware knowledge layer on your own hardware, with no external APIs — with traceable data flows you can actually evidence to a supervisor (see Security & data sovereignty).

It fits the wider sovereignty thread we described using the cloud criteria: BSI C3A: when is a cloud truly sovereign? — and why uncontrolled AI use also gets expensive, we show in our piece on shadow AI. To be clear: Lokalaise is an enabler, not legal counsel. Which of your use cases fall under Article 50 is something to assess with your legal team — we provide the technical foundation.

Your next steps

Three questions create clarity fast — answer them for every AI use in your organization:

1. Role: For this system, are you the deployer, the provider — or both?
2. Trigger: Do you generate deepfakes or publish AI text on matters of public interest? Does the human-review exception apply?
3. Evidence: Can you, if challenged, evidence disclosure, labelling and data flows?

Wherever you hesitate, it's worth a closer look. In a short demo we'll show how a local, auditable AI stack practically supports meeting the transparency obligations.