AI Regulation

EU AI Act Article 50 and California SB 942: What Changes Aug 2

Every enterprise compliance lead who filed the EU AI Act under “high risk, delayed to 2027” and moved on to other fires needs to reopen that file today. On August 2, 2026, Article 50 of the EU AI Act becomes enforceable, and California’s AI Transparency Act (SB 942, as amended by AB 853) goes live on the exact same day, a coordination that was not an accident. If your chatbot, image generator, or content tool touches users in either jurisdiction, the disclosure duty starts now, whether or not the underlying system counts as “high risk.”

The headline delay story you have probably already read, that the EU pushed its toughest AI rules back sixteen months, is true but incomplete. It describes the parts of the law that got easier. It says almost nothing about the parts that did not. This piece separates the two, walks through what actually changes in a product team’s daily workflow starting today, and flags a California bill sitting one signature away from rewriting who SB 942 even applies to.

What actually happens on August 2

Three things are true at once, and most coverage flattens them into one story. First, the EU AI Act’s transparency rules under Article 50 of Regulation (EU) 2024/1689 take effect on schedule, no delay, no grace period, for the core disclosure duties. Second, the tougher high-risk obligations under Annex III, the ones covering hiring tools, credit scoring, and education systems, were formally pushed to December 2027 when the Council of the EU gave final approval to the Digital Omnibus on June 29, 2026. Third, California’s SB 942 operative date, deliberately set by the state legislature to land on the same calendar day as Brussels, also arrives August 2.

Three deadlines, three different scopes, one date. That is the story worth writing down.

Article 50: the transparency duty that was never delayed

Article 50 requires four things regardless of whether a system is classified as high risk: disclosure when someone is interacting with a chatbot, machine-readable marking of AI-generated or manipulated content, disclosure of emotion-recognition or biometric-categorization tools, and labeling of deepfakes and AI-generated text published on matters of public interest. The Commission finalized its implementation guidelines on July 20, 2026, just thirteen days before enforcement began, after consulting member states, the EU AI Board, and industry.

Penalties sit under the Act’s general regime: up to €15 million or 3 percent of global annual turnover, whichever is higher. Enforcement runs through national market surveillance authorities in each of the 27 member states, with a narrower role for the EU AI Office and the EDPS where EU institutions themselves are providers or deployers.

Content published before August 2 does not need retroactive labeling, though the Commission says retroactive labeling is encouraged. That is the one piece of breathing room in an otherwise live-today obligation.

The high-risk delay everyone is talking about

The Digital Omnibus is the first substantive amendment to the AI Act since it entered into force in 2024, and it is the part of the story that has dominated headlines. The Commission proposed it on November 19, 2025. A first round of trilogue negotiations collapsed on April 28, 2026. A provisional political agreement followed in early May, the European Parliament endorsed the package 423 to 57 with 174 abstentions on June 16, and the Council gave final approval on June 29.

The result: standalone high-risk systems under Annex III, covering hiring, credit scoring, education, and law enforcement tools, move from an August 2, 2026 deadline to December 2, 2027, a sixteen-month deferral. AI embedded in regulated products, such as medical devices and toys, under Annex I, moves from August 2, 2027 to August 2, 2028, a twelve-month deferral.

The Omnibus was not purely a rollback. It also added a new Article 5 prohibition, effective December 2, 2026, banning AI systems that generate non-consensual intimate imagery, so-called “nudifier” tools, and CSAM. That ban applies regardless of a system’s risk classification and was not delayed at all.

“Big Tech is probably popping champagne. While European companies that care about safety and did their homework now face regulatory chaos.” Kim van Sparrentak, Member of the European Parliament, Greens/EFA, quoted via Reuters and IAPP

Van Sparrentak’s framing, given during the failed April trilogue round, is the sharpest on-record pushback: that the delay rewards companies who put off compliance investment while penalizing, relatively speaking, the ones who built ahead of schedule. DigitalEurope’s Director General offers the opposing read.

“The delay shows that the democratic process is working as it should. We now have another opportunity to get the AI Act right and to avoid adding up to 31 billion euros in unnecessary compliance costs.” Cecilia Bonefeld-Dahl, Director General, DigitalEurope

A third voice sits closer to the legislative process itself. Arba Kokalari, the European Parliament’s EPP co-rapporteur on the file, framed the vote as a mandate for simplification rather than a fight between industry and critics, telling reporters the Council needed to show it was “serious about cutting bureaucracy.” Three MEPs, three different reads of the same 423-57 vote. That is not consensus. It is a compromise everyone can point to as evidence for their own argument.

California’s SB 942: who counts as a “covered provider”

California’s AI Transparency Act started as SB 942, signed by Governor Newsom in September 2024 with a January 1, 2026 operative date. AB 853, signed a year later, pushed that date to August 2, 2026, specifically to align with the EU, and layered in two future obligations: a hosting-platform duty starting January 1, 2027, and a capture-device requirement, meaning cameras and phones, phasing in during 2028.

The threshold that determines who has to comply is narrower than most explainers suggest. A “covered provider” under the statute is a person or entity that creates, codes, or otherwise produces a generative AI system with more than one million monthly visitors or users, publicly accessible in California. It is the system’s own userbase, not a parent company’s total reach, and it applies only to image, video, and audio output. Text generation is excluded entirely. Miss that distinction and you will overstate who the law actually reaches.

Penalties are modest by EU standards: $5,000 per violation, enforced by the state Attorney General, a city attorney, or county counsel. There is no private right of action.

The wrinkle: SB 1000 could rewrite SB 942 this week

Why does a threshold-deletion bill exist at all? Because the one-million-user line, once drafted, produced an obvious gaming incentive: nothing in SB 942 defines whether “monthly visitor” is measured cumulatively or per product, and nothing stops a company from splitting a GenAI feature across multiple smaller properties to stay under the line. Legal trackers who have followed the bill since February describe SB 1000 as regulators fixing a flaw they already see, not an outside critique waiting to be validated.

EU vs. California, side by side

The gap in penalty structure, up to €15 million on one side and $5,000 per violation on the other, is itself a story about which regulator actually has teeth on day one. California’s number can compound if violations are counted daily, but the ceiling and the enforcement machinery behind it are not remotely comparable.

SynthID and C2PA: the watermark standard nobody legislated

Neither government wrote a technical watermarking standard into law. The market did that first. On May 19, 2026, OpenAI joined the C2PA steering committee, alongside Adobe, Amazon, the BBC, Google, Intel, Meta, Microsoft, and others, and committed to embedding Google DeepMind’s SynthID watermark in every image generated through ChatGPT, the API, and Codex, on top of existing C2PA Content Credentials metadata. The same day, at Google I/O, Google announced native SynthID and C2PA verification coming to Search and Chrome.

The two systems are complementary rather than redundant. C2PA is structured, human-readable metadata, creator, tool, edit history, that can be stripped when a file is resaved or screenshotted. SynthID is an invisible pixel-level signal that tends to survive compression and resizing but only answers a binary question: AI-generated, yes or no. Neither one is legally mandated by Article 50 or SB 942. A company could technically satisfy both laws with a weaker watermarking approach. The “de facto global standard” framing is directionally accurate for the biggest labs and should not be overstated as universal compliance.

C2PA now counts more than 6,000 members and affiliates, and its specification sits at version 2.1.

The critical view: who actually benefits from the delay

Set the two governments’ actions next to each other and an uncomfortable pattern shows up. Regulators in Brussels and Sacramento are both now leaning on a watermarking standard that neither wrote and neither has independently audited. SynthID is Google-developed and Google-controlled. No credentialed source has gone on record framing that as a risk specifically, but the structural question, who checks SynthID’s false-positive and false-negative rate against a legal disclosure duty, remains open.

There is also a readiness gap worth naming plainly. The Commission’s own Article 50 guidelines finalized just thirteen days before enforcement began. The EU’s standards bodies, CEN and CENELEC, missed a fall-2025 deadline to produce harmonized technical standards for the Act. Expect inconsistent enforcement postures across member states in the first weeks. Legal applicability and enforcement readiness are not the same thing, and several legal trackers following this file have said so explicitly.

Frequently asked questions

What to watch next

Here is what changes in a compliance team’s actual workload starting today, and where to look over the next six to eighteen months.

• Audit deployer-facing disclosure now. Article 50(1) is a deployer obligation, separate from and broader than SB 942’s developer-only threshold. A low-risk internal chatbot with no disclosure banner is exposed on August 2 even though its risk classification never changed.
• Recheck the SB 942 threshold before finalizing any compliance roadmap. If SB 1000 is signed this week or shortly after, the one-million-user line disappears immediately under the bill’s urgency clause.
• Track member-state enforcement posture through Q4 2026. With harmonized technical standards still catching up, expect the first real divergence in how “machine-readable mark” gets interpreted country by country.

Two governments picked the same date for very different reasons, and picked incompatible penalty structures to enforce it. The disclosure duty is real today regardless of a company’s risk classification or its position on the Annex III delay. Everything else, the SB 1000 threshold question, the SynthID audit gap, the member-state enforcement gap, is still being written in real time.

Related NeuralWired coverage

• EU AI Act Compliance 2026: New Deadlines & Fines, our earlier look at the Digital Omnibus agreement, now superseded by the Council’s June 29 final approval covered above.
• EU AI Act Compliance 2026: Deadlines, Fines & Checklist for the pre-Council-approval baseline.
• AI Regulation USA 2026: Federal vs. State Law Guide for where SB 942 sits in the broader US patchwork.
• US AI Regulation 2026: State Laws vs. Trump’s Federal Push for California’s AI law timeline in context.
• GDPR Compliance Checklist 2026: 14 Steps Before EDPB Knocks for adjacent EU compliance deadlines.
• GDPR & Global Data Privacy Laws by Country 2026 for a broader cross-jurisdiction comparison.

Want the next regulatory deadline in your inbox before it lands? Subscribe to The Neural Loop.