What actually happened
On 2 August 2026 the transparency chapter of the EU AI Act — Article 50 — became applicable. This is the part everyone skipped while reading about high-risk systems, because it sounded like paperwork for AI labs.
It isn't. Article 50 applies to any business that puts generative AI in front of other people, whatever its size, and it covers four situations: systems people talk to directly, synthetic audio, image, video and text, emotion recognition and biometric categorisation, and deepfakes plus AI-written text published to inform the public on matters of public interest.
If you run n8n workflows that draft replies, write posts or answer visitors, you are in scope. The good news is that you are in scope as a deployer, and the deployer's list is much shorter than the provider's.
Provider or deployer — the distinction that saves you work
The provider is whoever places the AI system on the market. That is OpenAI, Anthropic, Google, Mistral — not you, as long as you are using their models through an API. Providers carry the heavy obligations: designing systems so people can tell they are talking to a machine, and marking synthetic output in a machine-readable way so it can be detected downstream.
The deployer is you, using the system in your own business. Your obligations are narrower: tell people when they are being profiled by emotion recognition or biometric categorisation, label deepfakes, and disclose AI-generated text that you publish to inform the public on matters of public interest.
One date worth writing down: generative systems that were already on the market before 2 August 2026 have until 2 December 2026 to implement the machine-readable marking and detection duties, under the AI Omnibus provisional agreement from May 2026. That deadline is the vendors' problem. Yours is what you do with the output.
The three things that land on a small business
A chatbot on your site has to be obvious. If a visitor talks to a bot, they must be able to tell at the latest at the first interaction. A greeting line that says an assistant is answering does it. No disclosure is needed when it would be obvious anyway to a reasonably well-informed person — but "obvious to me, who built it" is not the test.
Published text on matters of public interest needs a disclosure — unless a human actually reviewed it. The exemption is real and it is the one most small businesses will live in: content that went through human review with someone taking editorial responsibility does not need the label. Note what that means in practice. It is not a checkbox in your workflow. It is a person reading the thing before it goes out.
Deepfakes get labelled. Manipulated audio, image or video of real people needs a clear, distinguishable disclosure — a visible label, an opening disclaimer on video, an audible one on audio. Obvious fiction is outside this; a synthetic voiceover of a real client is not.
Everything else — the AI that sorts your inbox, extracts invoice data, files documents, writes a draft only you will ever read — is untouched. Article 50 is about what other people see, not about what runs on your machine.
What that changes in a workflow
Three edits, and you are done with most of it.
- If a workflow sends AI-written text to a customer without a human in between, add one sentence that says it is automated. It costs nothing and removes the question entirely.
- If a workflow publishes — blog, newsletter, social — route it through a draft and read it before it goes. That single step is also what keeps you inside the human-review exemption.
- Keep a trace. Which run produced which text, who approved it, when. Not because anyone will ask tomorrow, but because the one time someone does ask, reconstructing it from memory is not possible.
Fines run to €15 million or 3% of worldwide annual turnover, whichever is higher, with explicit proportionality for small and medium businesses. Nobody is coming for a two-person agency over a missing line in a newsletter. But the fix is one line, so there is no reason to carry the risk.
This is a summary of public sources, not legal advice. If your case is unusual — you fine-tune and resell a model, you run emotion recognition, you publish political content at scale — talk to someone who does this for a living.
The pattern underneath
Every one of these obligations gets easier if the workflow drafts instead of sends. The disclosure question mostly disappears, the review exemption applies by construction, and the trace exists because approval is a step. That is a design rule worth following even without a regulation behind it — here is how it works in practice.