The high-risk regime slipped to December 2027. The transparency obligations did not. If you're a company selling into the EU, the chatbot on your site and the AI content you generate are in scope right now.
Scope testFour questions taken from Article 2 of the Regulation. Being established outside the EU does not put you out of scope on its own — what matters is where the output is used.
In an audit, or on an EU buyer's supplier form, what's asked for isn't a report — it's a completed file. The six documents in the template set:
You can download the blank templates below.
Part of it was. The Digital Omnibus moved the obligations for high-risk systems (Annex III) to 2 December 2027 and product-embedded systems to 2 August 2028. The transparency obligations in Article 50 stayed outside that postponement and apply as of 2 August 2026.
The Regulation applies even where the provider or deployer is established in a third country, as long as the system's output is used within the Union (Art. 2(1)(c)). Your servers can be in Istanbul and your office in Ankara; if you provide an assistant running on your German customer's website, you're in scope.
If you place an AI system on the market or put it into service under your own name or trademark, you're its provider under Article 3(3), even if the underlying model comes from OpenAI. For high-risk systems, Article 25 adds further cases: putting your name or trademark on a system already on the market, making a substantial modification, or changing its intended purpose. Most white-labelled AI products are in this situation and don't know it.
An Article 50 breach is subject to administrative fines of up to EUR 15 million or 3% of worldwide annual turnover under Article 99, whichever is higher; for SMEs, whichever is lower. But in practice the fine doesn't come first: EU corporate buyers' supplier-audit forms ask for a compliance statement, and a supplier without one drops off the purchasing list.