Since 2 August 2026 the European Commission can actually enforce the AI Act, and the transparency obligations under Article 50 apply. Plenty has been written about the legal position, including by me. What I have not found anywhere is an honest account of what compliance really costs when you are not a corporation with a legal department. So here is mine. This site is operated by AI agents, which makes me a deployer under the regulation, and I counted what that actually took.
Why this applies to me at all
The reflex among many self-employed people goes: this is for the model builders, not for me. That is true for the heavy obligations, and it is a dangerous reflex precisely because it is false for the light ones.
More on this topic: AI in the Founder's Working Day – background, practice and every article in one place.
Anyone using an AI system in a business context is a deployer. Deployers are mainly caught by Article 50, applicable since 2 August 2026. For me that is not an academic case. On this site, agents research, write and publish. They produce texts on regulation, energy markets and tax questions, meaning matters of public interest. That exact combination is named explicitly in Article 50.
The rule there is more precise than it is usually quoted. It does not require blanket labelling of every machine-written sentence. It requires disclosure where AI-generated text is published on matters of public interest, and it carries an exemption: if a human has reviewed the text before publication and taken editorial responsibility, the labelling obligation falls away. Fines for breaching the transparency obligations run to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher.
That one clause about editorial responsibility is the most expensive part of the whole regulation, and not because of the fine. It forces an architectural decision.
The decision that determined everything else
There are two ways to meet that requirement. Route one: let agents publish and put a notice under every article. Route two: build the system so that nothing is published without a human.
I took route two, and in hindsight it is the only decision that genuinely paid off. Not out of legal diligence, but for a practical reason: route one defers the problem. A notice under the article protects you from the labelling obligation, but not from an agent publishing something wrong. Route two solves both with the same move.
Concretely, in my system the intake for finished drafts publishes nothing at all. It files. An article goes live only if someone has given it a date beforehand. That is not a setting you could flip, it is a property of the interface. Anyone wanting to soften that boundary would have to change code, and that shows up in the version history.
What it cost in work
Now the numbers, and first how they came about, so they can be read properly. I did not log hours. What I have is the complete version history of this site, and that does not lie. Everything below is counted from it, as of 7 August 2026.
249 changes in total since this site launched on 14 July 2026. That is the denominator everything else has to be read against.
Seven of them concerned law and transparency. Cookie consent before any analytics load, locally hosted fonts instead of Google Fonts, a privacy policy matched to the services actually in use, a deletion function in the newsletter, security headers. Just under three percent of all work on this site. That is honestly not much, and it does not match the picture the consulting industry paints.
1,288 lines of code make up the entire publishing path in which the approval requirement sits: draft intake, queue, publication routine, article template. The part that actually enforces approval is a handful of lines. The work was not writing them. The work was building the system beforehand so that there was a place to write them at all.
Zero euros of external advice. That is a statement of fact, not a recommendation. I am a deployer, not a provider, I run no high-risk system and publish no deepfakes. In that position the AI Act is readable. Anyone offering their own models or embedding a system in a regulated product is in a different world, and there the same statement would be negligent.
So the honest summary is this: the AI Act did not cost me much, because I made an architectural decision early that I considered right for other reasons anyway. Had I built the system on full automation and now needed to retrofit, the bill would look entirely different. The price of this regulation depends almost entirely on when you price it in.
The inventory I did too late
The dullest part of the whole exercise is the list of which AI runs where in the business, and it is the only one you cannot start without. You cannot judge what is regulated until you know what you are using.
My list has four entries. First, the agents that research and draft. Second, the generator that produces cover images and data charts. Third, a translation step for the English versions, because localisation here is a work stage of its own rather than a by-product. Fourth, an analysis step that turns public sources into topic suggestions.
What was interesting was less the list than what surfaced while writing it: two of those four I had not thought of as AI at all, but as tooling. That is exactly where the gap opens up in most companies. Anything tucked inside a menu item that simply works appears in no inventory, until somebody asks the question differently: not which AI products did we buy, but at which point in our processes does a machine make a decision.
What cost me more than the regulation
Going through my 249 changes, by far the largest share of effort went not into law but into something no authority asks of me: making sure the agents work correctly.
One article sat live for six hours as encoded gibberish, because an interface was called the wrong way and every step still reported success. Eight cover images went live almost entirely white, because the rendering browser fired too early. For nine days every automatically generated article carried a version number that never existed. None of these cases has anything to do with the AI Act. Every single one took more work than all seven legal changes combined. What I built as a result is set out in detail in my piece on the escapes in the labs of OpenAI, Anthropic and Meta.
Which brings me to the real finding after a year: the regulation demands almost nothing a careful operator would not do anyway. The cost lands on those who were not careful before, and the regulation merely makes it visible rather than causing it.
What I would do differently
Three things, knowing what I know now.
First, I would write the inventory before anything else. The list of which AI runs where in the business is the dullest part and the only one without which you cannot judge what is regulated at all. I did it late and found two systems I had not thought of.
Second, I would put the approval requirement into the interface earlier rather than into the process. As long as a rule lives in a process, it holds for as long as somebody remembers it. Once it lives in the interface, it holds by itself.
Third, I would not let the postponed deadlines reassure me. The Digital Omnibus pushed the strict obligations for high-risk systems back, in parts to August 2028. Two things are unchanged by that: the transparency obligations have applied since 2 August 2026, and the duty to train your own team in the use of AI has applied since February 2025. A delay is not a discharge.
If you would rather read the legal position than follow my implementation: what applies from 2 August 2026, to whom, and what the Digital Omnibus postponed, is in my piece The EU AI Act from August 2026. If you want to see how the division of labour between people and agents works here, that is in The Autonomous Organization.
Frequently Asked Questions
What has applied since 2 August 2026?
Two things. The transparency obligations under Article 50 are applicable, and the European Commission can genuinely enforce the AI Act against providers of general-purpose AI models, meaning it can demand information, order audits and impose sanctions.
Do I have to label AI-generated text?
Not across the board. The obligation bites where AI-generated text is published on matters of public interest. It falls away if a human reviewed the text before publication and took editorial responsibility. Artistic, satirical and fictional works have their own exemption.
How high are the fines for transparency breaches?
Up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher.
Am I a provider or a deployer?
A provider develops an AI system or places it on the market under its own name. A deployer uses an AI system in a business context. Most self-employed people and mid-sized companies are deployers. Note that heavily adapting someone else's model, or offering it under your own name, can make you a provider.
What did compliance cost on this site?
Counted from the version history as of 7 August 2026: 249 changes in total since 14 July 2026, seven of which relate to law and transparency, just under three percent. The publishing path containing the approval requirement runs to 1,288 lines of code. External advice: none. The reason the number is low is an early architectural decision, namely that nothing is published without human approval.
Warm regards,
Dennis Weidner
