Starting August 2, 2026, companies using AI foundation model APIs like ChatGPT, Claude, or Gemini must comply with EU AI Act's chatbot disclosure rules, with 78% of organizations unprepared for potential €15M fines.
TL;DR
- EU AI Act's Article 50 requires chatbot disclosure from API builders starting August 2, 2026.
- 78% of organizations subject to the EU AI Act had taken no meaningful compliance steps as of June 2026.
- Non-compliance can result in fines up to €15M or 3% of global annual turnover.
What happened
The EU AI Act's Article 50, which mandates chatbot disclosure, comes into effect on August 2, 2026. This requirement applies to any company using AI foundation model APIs like ChatGPT, Claude, or Gemini and exposing the results to users through their own product.
A Vision Compliance analysis found that as of June 2026, approximately 78% of organizations subject to the EU AI Act had taken no meaningful compliance steps. Most of these organizations are deployers who have assumed, incorrectly, that their vendor handles compliance for them.
The EU AI Act draws a distinction between a GPAI 'provider' and a 'deployer'. A deployer is any company or professional that uses an AI system for business purposes under its own authority. A GPAI model provider is an entity that develops and places a general-purpose AI model on the market.
Why it matters
For developers and startups, this means that if you are using an AI foundation model API and exposing the results to users through your own product, you are a deployer and must comply with Article 50. This includes informing users that they are talking to an AI, marking AI-generated synthetic images, video, or audio, and disclosing when emotion recognition is active.
For tech investors, this is an important consideration when evaluating startups that use AI foundation model APIs. Non-compliance can result in fines up to €15M or 3% of global annual turnover, which can have a significant impact on a startup's financial health.
The EU AI Act's enforcement architecture divides responsibilities along the provider/deployer line. The European AI Office has exclusive competence over GPAI model providers, while Article 50 compliance for deployers is enforced by national market surveillance authorities in each of the 27 EU member states.
Key facts
- EU AI Act's Article 50 comes into effect on August 2, 2026.
- 78% of organizations subject to the EU AI Act had taken no meaningful compliance steps as of June 2026, according to Vision Compliance.
- Non-compliance can result in fines up to €15M or 3% of global annual turnover.
- The EU AI Act draws a distinction between a GPAI 'provider' and a 'deployer'.
- The European AI Office has exclusive competence over GPAI model providers.
- Article 50 compliance for deployers is enforced by national market surveillance authorities in each of the 27 EU member states.
- As of June 2026, approximately 24 organizations had signed the GPAI Code of Practice, including Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI, and Aleph Alpha.
Context
The EU AI Act is a comprehensive regulation that aims to ensure the safe and ethical use of AI in the European Union. It applies to both AI providers and deployers, with different obligations for each.
The Act's enforcement architecture divides responsibilities along the provider/deployer line, with the European AI Office overseeing GPAI model providers and national market surveillance authorities enforcing Article 50 compliance for deployers.
The Act's requirements for chatbot disclosure, marking of AI-generated synthetic media, and disclosure of emotion recognition are designed to ensure that users are aware when they are interacting with AI systems and can make informed decisions about their use.