The AI Act is now in application. Your automations do not know that.

Since 2 August 2026, the transparency obligations of Article 50 of Regulation (EU) 2024/1689 apply. The high-risk regime does not arrive until December 2027 — and that gap is exactly where most companies are making a planning mistake.

What applies today

Article 50 is short and inconvenient: systems that interact with people, or that generate synthetic content, must disclose it. No risk classification exercise, no notified body, no dossier. Just a duty that lands on every support bot, every automated reply, every AI-generated description in your catalogue — and it lands on the deployer, not only on the model provider.

The practical problem is not writing the disclosure. It is knowing where to put it. You cannot label what you have not inventoried, and the transparency duty is therefore instrumentally dependent on discovery: a duty you cannot comply with for automations nobody declared.

What waits until December 2027

The Annex III high-risk regime — human oversight under Article 14, event logging, the Article 11 technical dossier — becomes applicable on 2 December 2027. Sixteen months feels like room to breathe. It is not, for two reasons.

1. 01Event logging is retroactive in practice. A dossier submitted in 2028 that only holds evidence from 2028 tells the story of a control you installed for the audit.
2. 02The AI Act is not the framework you should be watching first. Four others already apply.

The deadline that already passed

Treating the AI Act as the trigger invites postponement — and it is the weakest argument available, because the obligations that genuinely bite today have nothing to do with AI. GDPR has required a record of processing activities since 2018 (Art. 30) and appropriate security measures with regular verification of their effectiveness (Art. 32). NIS2 has made asset management a mandatory measure since October 2024, with accountability reaching the management body. DORA has required a complete inventory of ICT assets and a register of third-party providers since January 2025. And the national invoicing-record regimes are arriving on their own calendars.

The AI Act is the frontier, not the trigger. What is enforceable today is a deterministic workflow nobody listed.

What a 200-person company should do this quarter

• →Inventory every automation, with or without AI, whoever built it. Nothing else can be done before this.
• →Name an accountable person per automation. “Owned by the marketing team” is not a name.
• →Label the ones that interact with people or generate content — that is Article 50, due now.
• →Start sealing decisions and outcomes. Evidence you begin collecting in 2026 is worth more in 2028 than any dossier written in a hurry.