Up front: I am not a lawyer and this is not legal advice. It is an operator's notebook — what I am checking on my own products before 2 August.

The delay landed on someone else's problem

On 29 June 2026 the Council of the EU gave its final green light to the Digital Omnibus package. The trade press compressed it into a headline nearly everyone read: the AI Act is being delayed. Far fewer people read what was delayed, and that gap is the whole story.

What moved were the obligations for high-risk systems. Standalone systems under Annex III — recruitment tools, creditworthiness scoring, biometrics, access to education — slid from 2 August 2026 all the way to 2 December 2027. AI embedded in regulated products under Annex I moved to 2 August 2028. If you operate one of those, you just gained a year and a half, and you should take it.

But almost nobody operates a high-risk system. The overwhelming majority of companies "doing something with AI" today have a chatbot on the website, an assistant in the app, or a feature that pulls structured data out of an uploaded document. For those, nothing changed at all. Article 50, which governs transparency obligations, stayed on its original date: 2 August 2026. So did Article 4 on AI literacy. The Digital Omnibus moved neither.

The result is an awkward inversion. Large firms with high-risk systems — the ones with a legal department and a compliance manager — got the extension. Small firms with a chatbot — the ones who never followed the AI Act because "that's for the big players" — did not. And because the headline sounded reassuring, that second group relaxed without having earned it.

What Article 50 actually asks for

The core is mundane and fits in one sentence: an AI system intended to interact directly with people must let the user know they are dealing with a machine. A website chatbot, a virtual assistant inside an app, an autonomous AI agent handling orders — same category. The duty is not to write a whitepaper about it. The duty is to deliver that information, at the latest at the point of first interaction.

More interesting than what counts is what doesn't. Reading the text of Article 50, three things fall out that I would have gotten wrong on instinct:

The second half of Article 50 covers AI-generated content: labelling text, images and video produced by a model, and deepfakes in particular. The Commission is running a code of practice for AI-generated content that is worth tracking if you produce such content at any volume.

I will mention the penalty once and factually, because leading with it is cheap: a breach of Article 50 can reach €15 million or 3% of global annual turnover, whichever is higher. For a small company the real exposure lives somewhere well below the ceiling — but that ceiling makes it clear the legislator did not file this duty under "formality".

One detail surprised me more than the rest: there is no grandfathering for existing products. This is not only about what you place on the market after 2 August. It applies to systems on the EU market regardless of when they were put there. The chatbot that has been running on your site for three years falls under the same rule as the one you ship next week.

The question I can't answer: who declares the machine for an MCP server?

Which brings me to why I am writing this at all. I run eight public MCP servers — over the business register, due diligence, sanctions lists, insolvency records, central bank FX rates, VAT validation, European registries and distressed real estate. When I sat down with Article 50 and went through my own products, I hit a wall on the very first one.

An MCP server is not a chatbot. It does not interact with a human. It interacts with the model that called it — and the human is talking to that model, in an interface operated by someone else entirely. My server receives a structured query and returns a structured answer. Whether there is a person at the other end, another machine, or a nightly batch script, the call does not tell me and cannot.

So who carries the duty to tell the human they are talking to a machine? The operator of the chatbot, who hosts the model and can see the user? Or also the operator of the tool that model reached for? The phrasing about systems "intended to interact directly with natural persons" points at the former — a server that speaks only to a model has, by definition, no direct interaction with a human. That is my reading, and I think it is a reasonable one.

But being right and being comfortable are different states. I am not keen on resting operational certainty on my own reading of a provision nobody has applied yet, with neither interpretive practice nor case law behind it. If I turn out to be wrong, I will find out in a way I won't enjoy. And AI agents — systems that act on their own and call my tools in a chain with no human in every step — are precisely the category Article 50 names explicitly. The line between "a tool an agent calls" and "the agent itself" is a good deal softer in practice than it looks in an architecture diagram.

I handle it the way I handle any ambiguity where the fix is cheap and the mistake is expensive: I cover both readings. The description of every MCP tool and the server metadata carry an unambiguous statement of what the tool is, who operates it, and where the data comes from. It costs me a few lines, and it is information the model can pass on when a user asks where the answer came from. If the interpretation eventually lands on the stricter side, I am done. If it lands where I read it, I lost half an hour and gained better documentation. That asymmetry is not worth arguing with.

The checklist I run on myself

This is not a template to download, and it is not legal advice. It is the set of questions I ask about my own products, and I suspect most of them generalise.

1. List every place our software meets a human through a model. Not "we have AI" — the actual screens and endpoints. Without that list there is nothing to check, and it is surprisingly common to find more places than anyone remembered, because one of them shipped as a side effect a year ago.

2. For each one: does the person find out, and do they find out immediately? Not in the help centre, not in the terms, not one click away. In the interface, at the moment the interaction begins. If I have to click to find the disclosure, it was not delivered.

3. Ask whether the label is specific. "Assistant" says nothing. A sentence that makes clear the responses are generated by a language model says everything. The difference is one line of copy and it is the cheapest item on the whole list.

4. For features that extract data, ask two questions at once. Concretely, the AI import in my mileage-log app: the user uploads a document and a model pulls trip entries out of it. Question one: am I clearly saying a model extracted this, not a fixed parser? Question two, which I consider the more important one: am I legibly telling them to check it before they confirm? A model that fumbles one digit in one row looks exactly as confident as a model that got everything right. That is a property, not a bug — and the user has to know about it before they press the button.

5. Give special attention to products that have been running a long time. A new product gets designed correctly from the start. The risk sits in the feature that has existed for two years, survived three redesigns, and nobody quite remembers where the AI disclosure was — or whether it made it through the second redesign at all.

What I take from this

A regulation everyone believes was postponed applies in three weeks to nearly anyone running a chatbot, and almost nobody is preparing, because the headline had a soothing tone. The delay is real; it just belongs to a completely different group than the one that relaxed.

The practical thing I took from auditing my own products is mundane enough to be worth saying out loud: complying with Article 50 is an afternoon of work; finding out everywhere you have to comply is a day of work. The hard part is not writing "you are talking to an AI assistant". The hard part is holding a complete list of the places your software meets a human through a model — because that list includes the feature someone shipped as an experiment last year and then forgot.

And the open question about MCP servers stays open. I do not know how it will land, and I would not trust anyone who claims certainty today. I only know that I am covering it pre-emptively, because it costs a few lines — and that I will read the first serious interpretation with real interest, whenever one shows up.