Two Deadlines on 2 December 2026 That the AI Act Debate Overlooks

The debate around the AI Act knows two dates: 2 August 2026, when the transparency obligations in Art. 50 became applicable, and 2 December 2027, to which Regulation (EU) 2026/1744 postponed the high-risk regime under Annex III — by 16 months. Between the two sits a deadline that is printed in bold in almost no advisory material: 2 December 2026.

More interesting than the date is whom it hits. Two obligations take effect that day, and they have nothing to do with one another: the machine-readable marking under Art. 50(2) for generative systems placed on the market before 2 August 2026, and two new prohibitions in Art. 5. The first does not hit planned projects but systems that have been running for a long time — and are therefore on nobody’s list.

At a glance

• What applies: Art. 50 of the AI Act has been applicable since 2 August 2026; Regulation (EU) 2026/1744 has been in force since 27 July 2026, the national KI-MIG (the German implementing act) since 29 July 2026.
• What follows: Two things become applicable on 2 December 2026: the marking under Art. 50(2) for generative legacy systems, and two new prohibitions in Art. 5(1)(ba) and (bb).
• The catch: The fine ranges are far apart — up to 15 million euros or 3 % of annual turnover for transparency breaches, up to 35 million euros or 7 % for breaches of Art. 5. The wording of the new prohibitions is so far available only through secondary sources.

The deadlines, sorted by legal status

2 December 2026 is the only date in this table that brings two sets of duties into force at once. A week later the new product liability follows, whose German implementation exists only as a government bill (Bundestag printed paper 21/4297); on its stage in the legislative process the sources contradict each other. I have set out the reshuffled timetable separately.

Duty one: marking for systems that have long been running

Art. 50 has been applicable without a grace period since 2 August 2026 — with one exception. For the machine-readable marking under paragraph 2, the amending regulation gives providers of generative systems placed on the market before that date until 2 December 2026. This point is confirmed by the authority: the Bundesnetzagentur lists the marking obligation in its summary of the Commission’s Art. 50 guidelines. The techniques themselves — watermarks, metadata, content credentials — I have worked through separately.

Three statements by the Bundesnetzagentur weigh more heavily than any technical detail. First: the Commission’s guidelines are not binding, but they are a “suitable orientation aid” — the yardstick by which supervision will measure. Second: disclosure must happen at first contact and must be accessible; a notice in the manual or deep in a menu expressly does not suffice. Third: content created and published before 2 August 2026 does not have to be labelled retroactively — voluntary labelling is encouraged. This website takes that voluntary route and sets out under AI transparency how its content comes about.

The fine range for transparency breaches is up to 15 million euros or 3 % of worldwide annual turnover, whichever is lower for small and medium-sized enterprises. Complaints run through the Bundesnetzagentur’s AI service desk — see the article on the KI-MIG.

Duty two: two prohibitions with the highest fine range

Art. 5 holds the prohibitions of the regulation. On 2 December 2026 two more arrive, inserted as Art. 5(1)(ba) and (bb):

• (ba) — generating or manipulating intimate content of identifiable persons without freely given, specific, informed and explicit consent.
• (bb) — generating depictions of child sexual abuse.

Added to that is a new Art. 5(1a): the provider is covered where generation is the system’s intended purpose or reasonably foreseeable and reproducible without substantial technical modification. This concerns more than providers of image and video generators: anyone who makes such a tool available internally stands in shared responsibility — and what counts as reproducible is decided by what the system can do. The range for breaches of Art. 5 is up to 35 million euros or 7 % of worldwide annual turnover — the highest in the entire regulation.

Where it gets awkward

First: the marking is not your duty, but it is your risk. Art. 50(2) addresses the provider — whoever buys does not have to build anything, but does have to know whether delivery happens. If the marking fails, it fails in your product.

Second: the wording of the new prohibitions is thinly documented. The deadlines and the substance of the prohibitions agree across several independent sources; the exact text of Art. 5(1)(ba)/(bb) and (1a), however, comes from secondary sources. Anyone building operational rules on it should work from the official text of the regulation, not from a summary. Not from this one either.

Third: the code of practice covers only half. The Code of Practice on Transparency of AI-generated Content has existed since 10 June 2026 and covers only paragraphs 2 and 4. The Bundesnetzagentur names adherence to a recognised code as a possible demonstration of conformity; for paragraphs 1 and 3 that template does not exist.

One deadline, two duties, unequal weight — 3 % of turnover at risk against 7 %. To the right of the line there is no further grace period.

What this means for your business

Separate what runs from what is planned. Compliance lists that grew out of rollout projects list plans; the duty on 2 December hits the installed base.

Do the inventory in a week, not in a project. Five days, one result sheet:

1. List. Every generative system in the house, bought in or built, each with its date of introduction — which ones predate 02/08/2026?
2. Role. For each system, record whether you are the provider or the deployer; that decides who owes the marking and where Art. 5(1a) applies.
3. Enquiry. Ask the providers of the legacy systems in writing whether the marking under Art. 50(2) will arrive by 02/12/2026.
4. Interfaces. Do users recognise at first contact that they are talking to a machine — accessibly, not in the manual?
5. Content and tools. Name editorial responsibility; for image and video generators made available internally, set out purpose and usage rules.

Settle the marking in the contract, not in the code. For most companies the deadline is not a development task but an assurance that either stands in the contract or is missing — which clauses belong there is set out in AI contracts.

Conclusion

2 December 2026 carries no headline, because it introduces nothing new — it catches up. The effort is small if you do it now, and unpleasant if it surfaces on the deadline. What does not help is hoping for another postponement: what was postponed is the high-risk regime, not transparency.

If you want to establish which of your systems count as legacy systems and who owes the marking, let’s talk. I read questions like these as a business lawyer and build the systems in question myself.

FAQ

Which two obligations take effect on 2 December 2026?

First, the machine-readable marking under Art. 50(2) of the AI Act for generative systems placed on the market before 2 August 2026. Second, two new prohibitions in Art. 5(1)(ba) and (bb): intimate content of identifiable persons without explicit consent, and depictions of child sexual abuse. Both deadlines come from Regulation (EU) 2026/1744, in force since 27 July 2026. The marking deadline is confirmed by the Bundesnetzagentur; the wording of the prohibitions rests on secondary sources only.

Do I have to label old AI texts and AI images on my website retroactively?

According to the Bundesnetzagentur’s summary, no: content created and published before 2 August 2026 does not have to be labelled retroactively, though voluntary labelling is encouraged. For everything produced after that, Art. 50(4) applies — with the exception for human-reviewed content where a natural or legal person carries editorial responsibility. This website takes the voluntary route and sets out how its content comes about.

I use an image generator I did not build myself. Does 2 December concern me?

The marking obligation under Art. 50(2) binds the provider, not you as the deployer — which makes it a contractual question: will your provider deliver the marking by the deadline, and does it give an assurance to that effect? With the new prohibitions the picture differs: the new Art. 5(1a) covers the provider where generation is the intended purpose or reasonably foreseeable and reproducible without substantial technical modification. Anyone making such tools available internally should set out purpose and usage rules in writing.

How high are the fines for these two obligations?

They differ considerably. For transparency breaches the Bundesnetzagentur states up to 15 million euros or 3 % of worldwide annual turnover, whichever is lower for small and medium-sized enterprises. For breaches of the prohibitions in Art. 5 the range is up to 35 million euros or 7 % — the highest in the entire regulation; that figure rests on secondary sources.

---

Sources — as of 2026-10-15

• Bundesnetzagentur: Art. 50 guidelines — https://www.bundesnetzagentur.de/DE/Fachthemen/Digitales/KI/4_Transparenzpflichten/Leitlinien/start.html
• Bundesnetzagentur: complaints body, AI service desk — https://www.bundesnetzagentur.de/DE/Fachthemen/Digitales/KI/18_Beschwerdestelle/start.html
• Obligations and delays under 2026/1744 — https://www.actuia.com/en/news/ai-act-obligations-in-force-and-delays-under-omnibus-2026-1744/
• Checklist on the Digital Omnibus 2026/1744 — https://euaiactchecklist.com/eu-ai-act-digital-omnibus-2026-1744.html
• Prohibitions from December 2026 — https://legaltech.edu.ge/new-ai-act-prohibitions-december-2026/
• Commission: Code of Practice (AI-generated Content) — https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content
• CMS: extended product liability from the end of 2026 — https://cms.law/de/deu/publication/2026-themen-die-sie-bewegen-werden/erweiterte-produkthaftung-ab-ende-2026

Note: the wording of Art. 5(1)(ba)/(bb) and (1a) and the range of 35 million euros or 7 % come from secondary sources, not from the official text of the regulation; the marking deadline and the range of 15 million euros or 3 % are documented via the Bundesnetzagentur, whose page carries no publication date.

This article is general information and not legal advice in an individual case. As of 15 October 2026; the legal position on the AI Act continues to move, so please check the current state before making decisions.