The EU AI Act from 2 August 2026: What Now Applies to Your Website. A Checklist for SMEs.

Last updated: July 2026 · Reading time approx. 6 minutes · Not legal advice

On 2 August 2026, the grace period ends. From that day, the transparency obligations of Article 50 of the EU AI Act apply, and the supervisory authorities can penalise violations with fines. Until now, the AI regulation has been, for most small and medium-sized enterprises, a topic for large corporations and AI vendors. That is changing now, and in a place many think of last: their own website.

If your website runs an AI chatbot, shows AI-generated images or publishes texts straight from a generator, you should go through the following points once before the deadline. It takes about half an hour.

What happens on 2 August 2026

The EU AI Act (Regulation (EU) 2024/1689) has been in force since August 2024, but is being phased in step by step. The bans on certain AI practices have applied since February 2025, the rules for large general-purpose AI models since August 2025. On 2 August 2026 comes the part that affects website operators directly: the transparency obligations of Article 50. On the same day, the national supervisory authorities take up their work. The obligations for high-risk systems under Annex III, originally scheduled for this date as well, were postponed by the Digital Omnibus to 2 December 2027 (Annex I to 2 August 2028); the transparency obligations under Article 50 are not affected.

For a normal company website, Article 50 is the relevant part. It governs when visitors must be informed about the use of AI.

Obligation 1: The chatbot must identify itself

If an AI system on your website interacts directly with people, they must be told that they are communicating with an AI (Art. 50(1)). At the latest at the first interaction, clearly recognisable. A note buried somewhere in your terms of service or legal notice is not enough.

The regulation makes an exception where the use of AI is obvious anyway from the perspective of a reasonably well-informed user. We would not rely on that. Whether a court considers your chatbot "obviously AI" is not something you want to find out. One sentence in the chat window ("You are chatting with our AI assistant") costs nothing and settles the question.

Obligation 2: AI content. A lot of nonsense is being told here.

A claim is circulating online that from August, every AI image and every AI text must be labelled. That is not what the regulation says. Article 50 distinguishes cleanly between providers, meaning the makers of the AI tools, and deployers, meaning companies like yours that use those tools.

The much-cited machine-readable marking of AI output (Art. 50(2)) is a provider obligation. It applies to the makers of image and text generators, not to their customers.

As a deployer, you must disclose in two cases (Art. 50(4)). First, deepfakes: AI-generated or manipulated image, audio or video content that depicts real people, places or events deceptively authentically. Second, AI-generated texts that inform the public on matters of public interest. For texts, however, there is an exception that makes the difference for most companies: if a human has editorially reviewed the content and a natural or legal person bears editorial responsibility, the labelling obligation does not apply.

In practice: the AI-assisted blog article your marketing team has edited does not trigger a labelling obligation. The deceptively real AI photo of a real person does. The generic AI illustration in the header in between falls under no deployer obligation.

Obligation 3: Emotion recognition and biometric categorisation

Anyone using systems for emotion recognition or biometric categorisation must inform the persons concerned (Art. 50(3)). On company websites this is rare. It becomes relevant with tools that analyse webcam data or voices, for instance in some video recruiting or analytics applications.

What violations can cost

Violations of Article 50 can cost up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher (Art. 99). For perspective: most GDPR-related warning letters of recent years involved a few hundred euros per case. How hard the authorities will actually crack down on SMEs, nobody knows today. That they are allowed to from 2 August is certain.

Alongside this, the GDPR continues to apply unchanged. An AI chatbot that processes personal data still needs a legal basis, a data processing agreement with the tool provider and an entry in the privacy policy. The AI Act comes on top, it replaces nothing.

Does this apply to Swiss companies too?

Switzerland is not an EU member, and the AI Act is not Swiss law. But it reaches across the border: the regulation also applies to companies outside the EU when their AI systems are placed on the EU market or the system's output is used in the EU (Art. 2). If your website deliberately targets customers in the EU, you should not file the obligations above away as a purely EU matter. The GDPR has long worked the same way: it applies to companies outside the EU that offer goods or services to people in the EU. And the revised Swiss FADP adds a national layer of its own.

The checklist: know where you stand in 30 minutes

1. Create an AI inventory of your website. Which AI features are embedded? Chatbot, recommendation widget, AI search, automatic translation, AI-generated images or texts. Purchased third-party tools count too.
2. Check the chatbot notice. Does your chat widget clearly tell users at the first interaction that they are talking to an AI?
3. Go through your AI images. Does any of them show real people, places or events deceptively authentically? Then label it. Generic AI illustrations can stay as they are.
4. Classify your AI texts. Do you publish AI texts on matters of public interest? Then ensure editorial review or label them.
5. Update your privacy policy. Does it mention the use of AI? Are there data processing agreements with the AI providers?
6. Assign responsibility. Someone in-house should keep an eye on AI use and the legal situation. The AI Act will continue to roll out until 2027.
7. Check recurringly, not once. Websites change. A new plugin or a campaign landing page can quietly add new AI services or trackers.

Honestly: point 1 is the catch. What your website really loads is not something you can see from the outside.