The EU AI Act Hits Your SaaS on August 2, 2026: A Founder Checklist

Short answer: no, the part of the EU AI Act that affects your SaaS did not get delayed. On August 2, 2026, the Act's transparency rules (Article 50) and the Commission's power to fine AI providers switch on exactly as scheduled. The "it got pushed to 2027" headlines you saw refer to the high-risk rules, which are a different thing. If your product uses AI and reaches a single EU user, you have a short list of concrete things to ship, and the maximum fine for getting it wrong is up to 15 million euros or 3% of global turnover. The good news: for most SaaS this is a one-sprint engineering job, not a legal nightmare. Here is the checklist.

First, the disclaimer that matters: I am a developer, not a lawyer. This is engineering guidance to get your product technically ready and to tell you what to ask your counsel about. For your specific situation, confirm with a qualified lawyer or DPO, especially as the amended text is finalized.

Why founders think they are safe (and why they are wrong)

In mid-2026 the EU passed a "Digital Omnibus" simplification package. The Council of the EU gave it final green light on 29 June 2026, after the Parliament approved it on 16 June. The headlines said "AI Act delayed," and founders relaxed.

Here is what actually moved, and what did not:

The deferral only touched the high-risk category (things like AI for hiring, credit scoring, or medical devices). The transparency obligations and the enforcement powers still apply from 2 August 2026. Unless you are building a hiring or credit-scoring engine, the deadline you care about did not move.

Are you even in scope? (Yes, probably, even from the US)

This is the part non-EU founders miss. The Act is extraterritorial. Under Article 2, it applies to providers who place AI on the EU market "irrespective of whether those providers are established or located within the Union or in a third country," and to providers and deployers in a third country "where the output produced by the AI system is used in the Union."

Translation: if your AI chatbot, generator, or assistant produces output that reaches a user in the EU, you are in scope. It does not matter that your company and servers are in San Francisco or Ahmedabad. If EU users can sign up, you are in.

Provider or deployer? You are probably both

Article 50 puts duties on two roles, and a typical SaaS is both at once:

• You are a deployer of the foundation models you call (OpenAI, Anthropic, Google).
• You are a provider of the AI feature you built on top and ship to your users.

Roles attach per system, so one company routinely holds both, and each role has its own transparency duties. You do not get to pick one.

The four things your product must do by August 2

Article 50 comes down to four practical triggers. Walk your product against this list:

1. Disclose AI interaction. If a user is chatting with an AI (a support bot, an assistant, an onboarding agent), you must clearly tell them they are talking to a machine, unless it is already obvious to a reasonable person. This is Article 50(1).
2. Mark AI-generated content. Synthetic audio, images, video, and text your product generates must be marked in a machine-readable format and be detectable as artificially generated. This is Article 50(2), and it is the most technical one.
3. Label deepfakes and synthetic media. If you generate or manipulate image, audio, or video that resembles real people or events, you must clearly disclose it is artificial (Article 50(4)).
4. Notify for emotion recognition or biometric categorization. If your system reads emotions or categorizes people by biometric data, you must inform the people exposed to it (Article 50(3)).

Most SaaS products trip triggers 1 and 2. If you have an AI chatbot and an AI content generator, you have work on both.

How to actually ship it in a Next.js / Node stack

None of this requires re-architecting. It is a focused sprint:

• AI-interaction disclosure (trigger 1): add a persistent, visible "AI" label to your chat UI, plus a short first-message notice ("You are chatting with an AI assistant"). Server-render it so it is always present and never depends on a client flag. This is an afternoon of work.
• Content marking (trigger 2): this is the real engineering. For images, audio, and video, embed provenance metadata using the C2PA Content Credentials standard (cryptographically signed "this was AI-generated" metadata that survives downloads). For generated text, attach metadata and a visible label. Do the marking server-side at generation time and store the provenance record. This is the item to start first, because it is the one you cannot fake with a UI badge.
• Deepfake labels (trigger 3): burn a visible disclosure into any realistic synthetic media you produce, in addition to the machine-readable mark.
• Audit logging: log every AI generation with a timestamp, the model and provider used, and the user. You want this for accountability and for your own defense.

There is one timing nuance worth money. If your generative feature was already on the market before 2 August 2026, the Omnibus gives you a grace period until 2 December 2026 to implement the Article 50(2) content marking. Features you launch on or after 2 August must mark from day one. The other transparency duties (interaction disclosure, deepfake labels) apply from 2 August with no grace period.

The paperwork founders forget

The code is only half of it. Before August 2, also:

• Review your AI-vendor contracts. Check that your OpenAI, Anthropic, and Google terms and data-processing agreements cover your obligations, and understand what they mark versus what you must mark.
• Update your terms of service and privacy notice to disclose AI use and any content generation.
• Document your roles. Write down, per feature, whether you are provider, deployer, or both. If a regulator ever asks, "who is responsible for this output," you want a paper trail.

What non-compliance actually costs

The fines are tiered by what you violate:

One important nuance in your favor: for SMEs and startups, the Act uses whichever amount is lower, not higher (Article 99(6)). So a small startup is not staring down a 15 million euro bill on day one. But "we are small" is not a defense against having to comply, and enforcement runs through national market-surveillance authorities plus the AI Office for foundation models.

Your two-week action plan

• Week 1, scope and classify. Confirm whether EU users can reach your AI output (they almost certainly can). Inventory every AI touchpoint in your product. For each, write down whether you are provider, deployer, or both, and which of the four triggers it hits.
• Week 2, ship and paper. Add the AI-interaction disclosure UX. Implement machine-readable content marking (C2PA) for generated media, or schedule it against the 2 December grace window if your feature predates August. Add audit logging. Update your ToS and privacy notice. Review your vendor terms.

The bottom line

The scary "3% of global revenue" number is real, the August 2 date is real, and the widely repeated "it got delayed" is only true for a category most SaaS products are not in. But the actual work is bounded and shippable: four transparency triggers, a content-marking implementation, some disclosure UX, and a bit of paperwork. Founders who treat this as a legal panic will overpay lawyers. Founders who treat it as an engineering checklist will ship it in a sprint and move on.

One last note on freshness: the Omnibus is recent legislation, and the final dates take full effect on publication in the Official Journal. Confirm the final adopted text before you treat any single date as immutable.

If you have an AI feature and want it Act-ready before August 2 without gutting your roadmap, book a call and I will run an AI Act readiness pass over your product, or see how I work first. I will tell you exactly which of the four triggers you hit and what to ship.