Your Vendor Checked the Box. You Still Haven't.

August 2, 2026 was not a headline day for most US enterprises. It should have been.

The EU AI Act's Article 50 transparency obligations went live yesterday. And if your products or services touch EU users, your vendor's compliance documentation does not protect you. This is the part most legal and technology teams have not internalized yet.

I have been in enough AI procurement conversations to know how this goes. Someone asks "are we compliant?" and the answer is a screenshot of the vendor's certification page. That answer just stopped being sufficient. The EU AI Act draws a hard line between a GPAI provider (your vendor) and a deployer (you). Vendor compliance covers the vendor. Deployer obligations are yours.

The scope is broader than most US teams realize. The Act follows the output, not the office. If your AI system touches EU customers, EU employees, or EU-based data subjects, you are in scope regardless of where your company is headquartered.

Article 50 requires any chatbot or conversational AI to disclose "you are talking to an AI" at the start of the interaction, in plain language. Any synthetic or deepfake content generated after August 2 must be labeled. Content published before that date is grandfathered. Everything in-flight is not. And the penalty math is real: up to 35 million euros or 7% of global annual revenue for prohibited-practice violations.

The recommended action is not a legal project. It is an audit: which of our AI deployments faces EU users? Who is the named deployer? Where are our Article 50 disclosures? Most teams do not have clean answers to those three questions yet.

This is the part about AI governance that I find most underestimated. Not the sophistication of the regulation, but the gap between "our vendor is compliant" and "we are compliant." Those are two different sentences with different consequences.

If you have not mapped your EU-facing AI deployments, this week is the right time. The enforcement window is open, and the grace period for not knowing is over.