Your Agent Now Has to Say Who Sent It

For eighteen months, 2 August 2026 was the date on every AI compliance roadmap in Europe — the day the high-risk obligations arrived. Then the Digital Omnibus moved that to December 2027, and a lot of teams quietly closed the workstream. What they missed is that the date did not empty out; it changed contents. Article 50's transparency duties applied on schedule, and the Commission's final guidelines read them onto agents with a requirement the statute never spells out: an agent must disclose that it is artificial and the person on whose behalf it is acting. The first is a string. The second is a field your protocols do not carry.

At a glance

Two instruments landed within days of each other, and they pull in opposite directions — one deferred the heavy obligations, the other sharpened the ones that stayed.

Item	Detail
Applied 2 Aug 2026	Article 50 transparency obligations; Commission/AI Office enforcement powers over general-purpose AI; Article 101 GPAI fines; market-surveillance investigatory powers
Moved	Annex III stand-alone high-risk obligations: 2 Aug 2026 → 2 Dec 2027. Annex I product-embedded high-risk: 2 Aug 2027 → 2 Aug 2028
Instrument that moved them	Regulation (EU) 2026/1744 (“Digital Omnibus on AI”) — in the Official Journal 24 July 2026, in force 27 July 2026
Guidance on Article 50	Commission guidelines adopted 20 July 2026 — non-binding, but what supervisors are expected to follow
Exposure for an Article 50 breach	Up to €15,000,000 or 3% of total worldwide annual turnover, whichever is higher (for SMEs and start-ups the cap is the lower of the two)
Grace period	None, except: systems already on the market before 2 Aug 2026 have until 2 Dec 2026 to meet the machine-readable marking duty in Article 50(2)

The deadline did not disappear. The half that stayed is the half that touches your product surface.

The date split in two

The Digital Omnibus was proposed in November 2025, agreed in trilogue in May 2026 and finished its passage in July. Its headline is deferral: the Annex III high-risk obligations — recruitment screening, credit scoring, law-enforcement decision support, and the rest of the stand-alone list — now bite on 2 December 2027 rather than 2 August 2026. The Commission's original draft made that deferral conditional on harmonised standards being ready; the final text dropped the condition and set fixed calendar dates, which means the dates cannot slip again without new legislation.

What the Omnibus did not touch is Article 50. Its substantive text was left alone, and it applied on 2 August 2026 with one narrow transitional carve-out. So the compliance picture inverted: the obligations that require conformity assessments, technical files and quality-management systems are eighteen months away, and the obligations that require you to change what users see are live now, enforceable, and sitting in the €15m-or-3% penalty tier.

One nuance worth getting right, because it is widely misstated: the penalty regime itself is not new. Chapter XII has applied since August 2025. What changed on 2 August 2026 is that Article 50 became an obligation capable of being breached, that the Commission's fining power over general-purpose model providers under Article 101 became exercisable, and that market-surveillance authorities gained their full investigatory and corrective powers. Enforcement is split three ways — the AI Office for systems built on a general-purpose model by the same provider and for systems inside very large online platforms, national authorities for everything else, the European Data Protection Supervisor for the EU's own institutions.

Where agents come in

The duty attaches where a person is, which in an agent topology is rarely where your code is.

The AI Act does not use the word "agent" anywhere. The Commission's final Article 50 guidelines, adopted on 20 July 2026, close that gap directly — and this is the part that should change an engineering roadmap rather than a policy register. They are guidelines, not law: only the Court of Justice can authoritatively interpret the Act, and the Commission says so. But they are what national supervisors and the AI Office are expected to apply, so they are the best available statement of what compliance looks like.

Two disclosures, and the second one is new work

Article 50(1) says a provider must design a system that interacts directly with people so that those people are informed they are dealing with an AI. Read onto agents — the guidelines name booking, managing correspondence, negotiating and concluding contracts as in-scope activities — that becomes a requirement to disclose both the agent's artificial nature and the person on whose behalf it is acting. The justification given is transparency about the origin of the interaction and about the delegation of authority behind it.

The first disclosure is a string in a template. The second is an architectural property. Ask what your agent would put in that field right now: most systems have a workspace, a service account and an API key, and no representation at all of the human principal whose authority the run is exercising. If the agent emails a supplier, the supplier is entitled to know which of your customers sent it — and that identity has to have survived from the request that started the run, through however many tool calls and sub-agents, to the message that left the building. Agent teams have been building toward this for other reasons, which is the useful part: the same binding makes permissions checkable and actions attributable. It is the argument in shared and multi-user agents — one human principal per run, carried end to end — arriving from a regulator instead of from an incident review.

A design-time duty, because you cannot know who is on the other end

The sharper move in the guidelines is what they ask of a provider who cannot tell in advance whether a natural person will be involved. In that case the agent must be designed at the architecture level, and instructed, to disclose itself in every situation where meeting a person is reasonably likely — including where that person is acting for a company. Disclosure also runs back toward the principal: the guidelines expect an agent to identify itself to the people instructing it at key steps such as authorisation, reporting and validation.

"Design at the architecture level" is doing real work in that sentence. It rules out the reading that most teams would prefer — that disclosure is a per-integration concern handled where you know a human is reading. If you cannot rule out a human, you disclose. In practice that pushes the logic to a single egress layer through which everything leaving the system passes, which is where it should have been anyway; an obligation discharged by remembering to add a line to each new channel is one you will fail on the fourth channel.

Multi-agent architectures are explicitly in scope

The guidelines extend the duty to set-ups where your agent interacts with other agents that in turn interact with people, and point to verifiable credentials as a mechanism for carrying the disclosure across those hops. Nothing in the current interop layer does this for you. Agent Cards and the discovery layer describe who is calling; they do not mark the content that comes back as generated, and they do not carry the human principal behind the call. If you exchange work with a partner's agents, the provenance and on-behalf-of fields are something you will have to agree bilaterally until a protocol carries them — see agent cards and discovery for what exists today.

The marking line is drawn at perceptibility

Article 50(2) requires synthetic audio, image, video and text to be marked in a machine-readable format. Applied to an agent, the guidelines draw the line at what a person can perceive: outputs a human sees or hears must be marked, while intermediate reasoning steps and machine-facing actions such as web requests need not be. That is a sensible cut and a genuinely useful one to have in writing — without it, a literal reading would have you watermarking every internal tool call.

It also leaves the honest problem intact. Machine-readable marking of text is weak: watermarks work by biasing token selection, so they need length to be detectable and they degrade under paraphrase and translation. The Code of Practice on Transparency of AI-generated Content, published on 10 June 2026 and confirmed by the Commission as adequately covering the marking duties, is voluntary and gives signatories a presumption of good faith rather than a technical solution to that. Our take on what actually survives which boundary is in disclosure and content provenance.

What to do about it

Three places the logic can live. Only one of them is still correct after the next integration ships.

If you serve users in the EU, this is a conversation with counsel about your specific systems. What follows is the engineering that the conversation will land on regardless, and most of it is worth doing whether or not the Act applies to you.

Step	What it produces	Why it pays anyway
Enumerate every path from a model output to a human eye	A list of channels, longer than expected	Finds the async paths — sent email, ticket comments, calendar invites — that no disclosure logic covers
Bind every run to one human principal and propagate it	An on-behalf-of identity that survives sub-agents and tool calls	The same field makes permissions the intersection of agent scope and user access, and makes actions attributable
Move disclosure to a single egress layer	One chokepoint that knows channel and recipient class	New integrations inherit compliance instead of re-implementing it
Add a CI test per channel asserting the disclosure is in the first outbound message	A regression gate	Disclosure breaks silently in redesigns and is discovered by a stranger
Record what you generated, for whom, under which model and prompt version	A provenance record you hold	The only durable answer for text, where no watermark reliably survives
Re-check the Annex III question rather than closing it	A documented classification decision	The deferral is sixteen months, not a repeal — and the Omnibus removed the registration duty, not the assessment

One trap to name explicitly. Because the Omnibus dropped the requirement to register in the EU database when a provider concludes its Annex III system is not high-risk, it is easy to read the change as "the assessment went away". It did not. The provider must still perform and document that assessment and produce it to authorities on request; what disappeared is the public-facing entry. That is a transparency reduction for observers and a paperwork reduction for you, and it is not permission to skip the analysis.

FAQ

Does Article 50 apply to my agent if it only talks to businesses?

Very likely yes. The obligation is triggered by interaction with a natural person, and the guidelines are explicit that this includes a person acting on behalf of a company. Purchasing managers, support staff and account contacts are natural persons; only genuinely machine-to-machine paths with no human reader are outside it.

Does a robotic-sounding voice satisfy the "obvious" exemption?

Do not rely on it. The exemption is judged against a reasonably well-informed, observant and circumspect person in the actual audience, and the threshold is lower where children, older people or people with disabilities are among them. For voice agents the safe reading is a spoken disclosure at the start of the call.

Is disclosure in the terms of service enough?

No. The guidelines rule out discharging the duty through terms and conditions, documentation, a URL, a generic notice that a site "uses AI", or machine-readable marking alone. The information has to be perceivable in the interaction itself, clear and distinguishable, at the latest at the first interaction.

Are the guidelines binding?

No — they are interpretive, and only the Court of Justice can authoritatively interpret the Act. They are nonetheless the standard the AI Office and national supervisors are expected to apply, so they are the practical benchmark until case law exists.

We shipped before 2 August 2026. Do we get the transition?

Only for one duty. Systems placed on the market before that date have until 2 December 2026 to comply with the machine-readable marking requirement in Article 50(2). Every other Article 50 obligation, including telling people they are talking to an AI, applied immediately with no grace period.

Does the high-risk deferral mean we can stop the classification work?

No, and it is the most expensive way to read the news. The dates are fixed rather than conditional, so 2 December 2027 will arrive on time, and a system you never classified is a system you cannot start a conformity assessment for.