If you ship a chatbot to anyone in Europe, it now has to tell them it is a chatbot. That obligation is live. The European Commission's AI Office, working with national authorities, began enforcing the EU AI Act's transparency rules on 2 August, and they apply to a solo developer with a support widget exactly as they apply to a large platform.
This is the part of the regulation that touches small builders first, and it is also the part most easily satisfied. What follows is what actually changed, what it costs to get wrong, and the two dates that matter before the harder rules arrive.
What Actually Changed on 2 August
Three duties came into force. According to the Commission's own announcement, systems that interact with people must inform users they are dealing with AI rather than a human; images, video and audio edited or generated with AI must be labelled; and machine-made or edited content must carry machine-readable marks so it can be detected automatically.
The first is a disclosure. The second is a visible label. The third is the one people underestimate, because a machine-readable mark is not the same as a caption. It means embedded provenance data that a crawler or platform can read without a human present, which is a code change rather than a copy change.
Enforcement powers over general-purpose AI model providers also transferred to the AI Office on the same date. Help Net Security's summary of the change sets out what those providers now owe: documentation supplied to authorities and to downstream developers, a copyright policy, and a published summary of what the model was trained on.
That last point is the one most relevant to anyone building on top of someone else's model. The documentation obligation runs downstream, which means the information you need in order to comply is information the model provider is now required to give you.
The December Deadline Most Builders Have Missed
Systems that were already on the market before August are not exempt. They have a grace period, and it ends on 2 December.
This is the single most actionable date in the whole framework for a small team, and it is the one least covered, because most reporting concentrated on the August start. If you have a product that has been live for a year with an AI feature in it, the work is not optional and the runway is now weeks rather than months.
The audit is short. Every surface where a user talks to a model needs a disclosure. Every image, audio clip or video your product generates or alters needs a label and an embedded mark. If your product does neither of those things, and many do not, you are outside these particular duties entirely.
What It Costs to Get This Wrong
Non-compliance carries fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher. For a company with meaningful revenue, the percentage is the operative number; for a small builder, the fixed ceiling is.
There is an important qualifier. Smaller entities, including SMEs and startups, face lower maximum fines, with the thresholds set by individual member states, per the Software Improvement Group's compliance summary. The framework was not built to bankrupt a two-person team over a missing label, and the penalty structure reflects that.
The Commission has also opened complaint routes: an AI Act complaints tool, a whistleblower tool, and a dedicated channel for downstream providers who use general-purpose models. That third one is worth noting, because it gives a small developer a formal way to escalate when an upstream model provider will not supply the documentation the law says they must.
Small Builders Get a Lighter Version, Not an Exemption
The Digital Omnibus extended the lighter compliance rules originally written for small and medium enterprises to small mid-cap companies as well. That is a real widening of who gets the reduced-burden treatment, and it happened because the original SME carve-out left a gap for companies that had outgrown the definition without acquiring a compliance department.
What it does not do is remove the transparency duties. A lighter documentation burden is not the same as an exemption from telling a user they are talking to software. The distinction matters, because the two are frequently conflated in summaries written for founders.
Open-source projects sit in a more nuanced position than either camp usually claims. Some documentation requirements are reduced for open-source providers, but prohibited practices still apply regardless, and anyone deploying an open model in a high-risk setting carries the full deployer obligations. Publishing weights does not transfer responsibility to whoever downloads them.
The Sandbox Is the Part Worth Using
The Omnibus also created an EU-level AI regulatory sandbox sitting alongside the national sandboxes that member states already operate. A sandbox is a supervised environment where you can develop and test a system with the regulator involved before it goes to market.
For a large company this is a convenience. For a small builder it is the most valuable thing in the entire package, because it substitutes access for legal budget. The usual reason regulation entrenches incumbents is that only incumbents can afford to find out what compliance means; a sandbox is the mechanism that removes that advantage, and it is free to apply to.
Providers and deployers were also given permission to process special categories of personal data, including biometric and health data, specifically to detect and correct bias. That is a narrow authorisation with a clear purpose, and it resolves a genuine catch-22 in which testing a model for discriminatory behaviour required exactly the data you were otherwise barred from touching.
How to Audit a Small Product in an Afternoon
The practical work divides into three questions, and most products answer no to at least one of them, which is how a compliance exercise that sounds enormous turns into a short checklist.
First: does a user ever exchange messages with a model through your interface? A support chat, an in-app assistant, a form that answers back, a voice feature. If yes, that surface needs a disclosure, and the disclosure needs to be visible at the point of interaction rather than buried in terms of service. A line above the input box is sufficient.
Second: does your product output images, audio or video that a model generated or altered? If yes, each of those needs a visible label and an embedded machine-readable mark. The label is a design task. The mark is an engineering one, and it is the item most likely to require a library change rather than a template change, so it is the one to scope first.
Third: are you the provider of a general-purpose model, or a developer building on someone else's? Almost every small team is the second, which puts the documentation, copyright-policy and training-summary obligations upstream rather than on you. Your task is to obtain that documentation, and the law now says the provider owes it to you.
Work through those three and you have either a short list of code changes or a clean result. What you should not do is assume the answer without checking, because the December date applies to systems that shipped before anybody was paying attention, and those are precisely the ones nobody has audited.
What Is Not Coming Until 2027
The high-risk rules, which are the demanding ones, are not in force. Obligations for stand-alone high-risk systems, covering hiring, credit scoring, education and critical infrastructure, apply from 2 December 2027. High-risk AI embedded in already-regulated products such as medical devices, machinery and toys follows on 2 August 2028.
Those dates are fixed rather than conditional, and they are binding law under Regulation (EU) 2026/1744 rather than a proposal still in negotiation. General-purpose models already on the market have their own transition window running to 2 August 2027.
Minimal-risk systems, the category that covers spam filters, video games and inventory management, carry no obligations at all. That is most software with a model in it somewhere, and it is worth confirming which category you are in before spending anything on compliance.
The honest summary for a small team is that the current duties are cheap and the future ones are not, and the gap between now and December 2027 is preparation time rather than a reprieve. The wider pattern of tools moving faster than the institutions around them is one we have looked at before, in how agentic coding tools stopped one in three software purchases. Regulation is the part of that story that arrives late and then all at once.
