The EU AI Act Deadline Is Today — What Every No-Code Builder Deploying AI to Europe Must Know

**TL;DR:** As of 2 August 2026, the EU AI Act's Article 50 transparency rules are live and enforceable. If you deploy an AI chatbot, generate synthetic content, or publish AI-written text for EU users, you now have legal obligations — with fines up to €15 million or 3% of global turnover. The Digital Omnibus pushed high-risk Annex III rules to December 2027, creating a split: transparency is now, but the heavier compliance machinery around high-risk classification is still years out. Here's what actually changed, what's still unclear, and what no-code builders need to do.

---

## What actually happened on August 2?

Two things went live. One got all the headlines. The other matters more for most no-code builders.

The headline-grabber was the European Commission's enforcement powers over general-purpose AI (GPAI) model providers. From 2 August, the AI Office can demand documentation, run technical evaluations, order corrective measures, restrict or withdraw models from the EU market, and issue fines of up to €15 million or 3% of global annual turnover under Article 101. OpenAI, Anthropic, Google — they're all now within reach of a regulator that can actually do something.

The quieter change, and the one that hits the no-code ecosystem more directly, is Article 50. Its transparency obligations apply from 2 August to providers *and* deployers of certain AI systems. Not just high-risk systems. Not just GPAI models. Any AI system that falls into one of four buckets.

This is the split that's confusing everyone.

## Why is everyone confused about what's enforced?

The Digital Omnibus — agreed in May 2026 — pushed the high-risk AI obligations under Annex III back to 2 December 2027. Stand-alone systems used in recruitment, credit scoring, education, law enforcement, and border control got a 16-month reprieve. Annex I systems embedded in regulated products like medical devices got pushed to August 2028.

So you have enforcement teeth for GPAI models appearing at the same moment the high-risk classification framework gets kicked down the road. The result: regulators can fine OpenAI for failing to document model training data, but a no-code recruitment tool using that same model doesn't need to meet high-risk obligations until December 2027.

It's an awkward gap, and it means most no-code builders don't need to worry about the heavy compliance machinery yet. But they absolutely need to worry about transparency.

## What does Article 50 actually require?

Four obligations. They're not especially complex, but they reach further than a lot of builders assume.

**1. Chatbot disclosure (Article 50(1)).** If you deploy an AI system that interacts directly with people — a customer support chatbot, an AI agent on your site, a voice assistant — you have to tell them they're talking to AI. Unless it's obvious to "a reasonably well-informed, observant and circumspect" person. The Commission's guidelines make clear that burying it in terms and conditions doesn't count. The disclosure has to be perceivable in the interaction itself.

**2. Synthetic content marking (Article 50(2)).** Providers of AI systems that generate synthetic audio, image, video, or text must mark outputs in a machine-readable format and make them detectable as artificially generated. The Code of Practice on transparency of AI-generated content, assessed as adequate by the Commission and AI Board in July 2026, expects multi-layered marking — digitally signed metadata, imperceptible watermarking, and optionally fingerprinting. If you're a no-code builder wrapping an AI model behind a form or a dashboard, you're a provider under the Act, and this applies to you. Existing systems already on the market get a grace period until 2 December 2026.

**3. Emotion recognition and biometric categorisation (Article 50(3)).** If you're deploying these, you have to tell people. Most no-code builders aren't. Skip this one.

**4. Deepfake and public-interest text disclosure (Article 50(4)).** If you publish AI-generated images, audio, or video that could falsely appear authentic, you have to disclose it's artificial. For AI-generated text published to inform the public on matters of public interest — politics, public health, consumer safety, financial developments — you also have to disclose. The exemption: if the content has undergone human review or editorial control, and a natural or legal person holds editorial responsibility, you don't need to label it. Superficial spell-checking doesn't count as editorial control.

All disclosures must be clear, distinguishable, and provided at the time of first interaction or exposure (Article 50(5)). They must meet accessibility requirements.

## Who does this actually hit?

The extraterritorial reach is the bit that catches people off guard. Article 50 applies to providers and deployers wherever they're established, so long as the output of the AI system is used in the EU. A no-code builder in London or Lagos or Lima — if EU users interact with your AI features, you're in scope.

Open-source AI systems aren't exempt. The "purely personal, non-professional activity" exception is interpreted narrowly; a deepfake shared on social media to criticise a politician can still fall within scope if it influences public discourse.

If you're a no-code builder who has added any of these to your product in the last 18 months, Article 50 applies to you:

- A customer-facing chatbot or AI support agent
- An AI feature that generates text, images, or audio for users
- An AI-generated content pipeline that publishes without human editorial review
- An AI summarisation, translation, or content transformation feature

## What about GPAI enforcement?

The enforcement powers that activated on 2 August are substantial. The AI Office can now compel GPAI providers to hand over technical documentation (Article 91), require risk-mitigation measures (Article 93), and demand model access for direct evaluation (Article 92). Refusing to cooperate is itself a finable offence.

For no-code builders, the practical implication is fairly straightforward: your model provider is now under regulatory pressure. If the AI Office restricts or withdraws a model from the EU market, anything you've built on top of it has a problem. Due diligence on your AI vendor's regulatory posture stops being optional.

## A compliance checklist for no-code builders serving EU users

Here's what to do, roughly in priority order:

1. **Inventory your AI touchpoints.** List every place your product uses AI that interacts with users or generates content. Include chatbots, content generation features, summarisation tools, translation, image generation — anything where AI output reaches a human.

2. **Add chatbot disclosure.** If you have an AI chatbot or conversational agent, add a clear disclosure visible in the interaction — not in your privacy policy, not in a dismissible banner. In the chat itself.

3. **Assess your content pipeline.** If your product generates text, images, or audio that could reach the public, determine whether it needs labelling under Article 50(4). If you have human editorial review, document it.

4. **Check your AI provider's compliance posture.** Are they signatories to the Code of Practice on transparency of AI-generated content? Have they published their GPAI Code of Practice compliance documentation? If your provider gets restricted by the AI Office, do you have a fallback?

5. **Review vendor contracts.** The distinction between provider and deployer matters — different obligations attach to each role. If you're wrapping a third-party AI model, make sure your contract allocates transparency responsibilities clearly.

6. **Document everything.** Even if high-risk obligations don't apply to you yet, building an audit trail now is cheaper than retrofitting one later. Record what AI systems you use, how they're configured, what content they generate, and what disclosures you've implemented.

## Why governed platforms are better positioned for this

This is the part where I admit my bias — I work at Stacker, and we build a governed no-code platform. But the logic holds regardless.

Transparency obligations are fundamentally about knowing what your AI systems are doing and being able to prove it. That's hard to do when your AI features are scattered across three different tools, configured by different team members, with no central record of what's connected to what.

Platforms that bake in audit trails, permission models, and centralised configuration give you a natural compliance advantage. When a regulator asks "which AI systems do you deploy and what content do they generate?", the answer can be a query rather than a forensic investigation across Slack messages, rogue Airtable bases, and someone's personal Make.com account.

The Code of Practice on transparency of AI-generated content — now formally assessed as adequate by both the Commission and the AI Board — expects signatories to implement layered marking and detection. Platforms that handle the technical plumbing of content provenance at the infrastructure level remove that burden from individual builders.

I'm not saying you should drop everything and migrate. I'm saying that if you're building AI features for EU users, the governance foundations you put in place now — audit trails, permission models, documented configurations — will compound as the regulatory framework tightens toward December 2027.

## What's still unclear

Several things, honestly:

- **The "obviousness" exemption in Article 50(1).** The guidelines say it's context-dependent and depends on the audience. That's a lawyer's way of saying "we'll find out when someone gets fined."

- **Article 50(2) machine-readable marking standards.** The Code of Practice is voluntary and expects multi-layered marking. What counts as sufficient for a provider who doesn't sign the code? Unclear.

- **Enforcement appetite.** National market surveillance authorities are responsible for Article 50 enforcement. Some member states haven't even designated their authorities yet. How aggressively will they pursue no-code builders versus big platforms?

- **The gap between transparency and high-risk.** If your no-code AI tool performs a function that would be classified as high-risk under Annex III (say, screening job applications), you don't need to meet high-risk obligations until December 2027. But Article 50 transparency applies now. That creates an odd situation where you're required to disclose that AI is involved but not required to meet the substantive obligations around accuracy, bias, and human oversight.

## The takeaway

August 2 landed. Article 50 transparency obligations are live and enforceable. The Digital Omnibus didn't touch them. If you're deploying AI that faces EU users, your compliance clock started ticking — not in December 2027 when high-risk rules arrive, but now.

The good news: the obligations are relatively straightforward. Tell people when they're talking to AI. Mark synthetic content. Disclose deepfakes. Label AI-generated public-interest text unless a human editor is accountable for it.

The strategic move is to treat this as a forcing function. Build the audit trails, document your AI touchpoints, and choose platforms that make governance a feature rather than an afterthought. The 2027 obligations will be heavier. The builders who start now will be the ones who don't panic later.