Since 2 August 2026 the European Commission can actually enforce the AI Act, and the transparency obligations under Article 50 apply. Plenty has been written about the legal position, including by me. What I have not found anywhere is a concrete account of what compliance really costs when you are not a corporation with a legal department. So here is mine. This site is run with AI agents, which makes me a deployer under the regulation, and compliance turned out far leaner than the consulting industry would lead you to expect.
Why this applies to me at all
The reflex among many self-employed people is that this concerns the model builders rather than them. For the heavy obligations that is true. It does not hold for the light ones, and those affect almost everyone who uses AI in business.
More on this topic: AI in the Founder's Working Day – background, practice and every article in one place.
Anyone using an AI system in a business context is a deployer. Deployers are mainly caught by Article 50, applicable since 2 August 2026. For me that is not an academic case. On this site, agents research and draft texts on regulation, energy markets and tax questions, meaning matters of public interest. That exact combination is named explicitly in Article 50.
The rule there is more precise than it is usually quoted. It does not require blanket labelling of every machine-written sentence. It requires disclosure where AI-generated text is published on matters of public interest, and it carries an exemption. If a human has reviewed the text before publication and taken editorial responsibility, the labelling obligation falls away. Fines for breaching the transparency obligations run to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher.
That one clause about editorial responsibility is the most important part of the whole regulation, because it forces an architectural decision.
The decision that determined everything else
There are two ways to meet that requirement. Route one: let agents publish and put a notice under every article. Route two: build the system so that nothing is published without a human.
I took route two, and in hindsight this is the decision that paid off most. Route one defers the problem. A notice under the article meets the labelling obligation, but it does not protect you from an agent publishing something wrong. Route two solves both with the same move.
In my system the intake for finished drafts files everything and publishes nothing. An article goes live only if a person has given it a date beforehand. This boundary is built firmly into the interface and cannot be bypassed by a setting.
Since September, every article also carries a short note that AI tools supported me in writing it. Under Article 50 it would not be required in my case. For me it is part of being open with my readers.
What AI Act compliance actually cost
The legal side, data protection included, was the smallest item in all the work on this site. I implemented a handful of things every deployer should know, namely cookie consent that loads analytics only after approval, locally hosted fonts instead of Google Fonts, a privacy policy matched to the services actually in use, a deletion function in the newsletter and security headers. That was a fraction of the total effort and far less than the consulting industry makes it out to be.
The approval requirement itself sits in the publishing path, meaning the draft intake, the queue, the publication routine and the article template. The part that enforces approval is small. The real effort came before that, in building a system that had a fixed place for this approval from the start.
I did not need external advice for it. I am a deployer and not a provider, I run no high-risk system and publish no deepfakes. In that position the AI Act is readily understandable. Anyone offering their own models or embedding a system in a regulated product has considerably more obligations and should seek professional advice.
All in all, the AI Act cost me little, because I made an architectural decision early that I considered right for other reasons anyway. Anyone who built a system on full automation is now retrofitting and paying considerably more for it. The price of this regulation depends almost entirely on when you price it in.
The AI inventory: the underrated first step
The least glamorous part of the whole exercise is the list of which AI runs where in the business, and it is the only one you cannot start without. You can only judge what is regulated once you know what you are using.
My list has four entries. First, the agents that research and draft. Second, the generator that produces cover images and data charts. Third, a translation step for the English versions, because localisation here is a work stage of its own. Fourth, an analysis step that turns public sources into topic suggestions.
What was most interesting was what surfaced while writing the list. Two of those four I had until then seen as tools rather than as AI. That is where the gap opens up in most companies. Anything tucked inside a menu item that simply works appears in no inventory until somebody asks the question differently. The right question is at which point in our processes a machine makes a decision.
The inventory is also the basis for the second obligation that applies to every deployer, AI literacy under Article 4. It has applied since February 2025 and requires that everyone in the business who works with AI systems has a sufficient level of AI literacy. In practice this means that anyone working with agents knows their strengths and limits and handles the approval step with confidence.
Where the real effort lies: reliable AI agents
By far the largest share of the work went into something no authority asks for, namely making sure the agents work reliably.
An agent reports success as soon as its step has technically run. Whether the result is right for the reader is a second question, and that is exactly what we built fixed checks for. Every publication is checked on the finished page, cover images are measured before they go online, and a weekly run checks the entire archive. What these guardrails look like in detail is set out in my piece on the escapes in the labs of OpenAI, Anthropic and Meta.
After a year, it is clear to me that the regulation demands almost nothing a careful operator would not do anyway. Anyone who works cleanly from the start has little effort with the AI Act.
Implementing the EU AI Act: three recommendations for deployers
First, write the AI inventory before anything else. The list of which AI runs where in the business is the basis for every further assessment. Creating it regularly surfaces systems that were previously seen as mere tools.
Second, build the approval requirement into the interface. A rule that lives in a process holds for as long as somebody remembers it. Once it lives in the interface, it holds by itself.
Third, read the postponed deadlines correctly. The Digital Omnibus pushed the strict obligations for high-risk systems back, in parts to August 2028. The transparency obligations have nonetheless applied since 2 August 2026, and the duty to train your own team in the use of AI has applied since February 2025. Anyone who has done both is well placed as a deployer.
What applies from 2 August 2026, to whom, and what the Digital Omnibus postponed, is in my piece The EU AI Act from August 2026. How the division of labour between people and agents works here is described in The Autonomous Organization. And for companies introducing agents that want to build approval in properly from the start, I am glad to make time, and you can book an appointment here.
Frequently Asked Questions
What has applied since 2 August 2026?
Two things. The transparency obligations under Article 50 are applicable, and the European Commission can genuinely enforce the AI Act against providers of general-purpose AI models, meaning it can demand information, order audits and impose sanctions.
Do I have to label AI-generated text?
Not across the board. The obligation bites where AI-generated text is published on matters of public interest. It falls away if a human reviewed the text before publication and took editorial responsibility. Artistic, satirical and fictional works have their own exemption.
How high are the fines for transparency breaches?
Up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher.
Am I a provider or a deployer?
A provider develops an AI system or places it on the market under its own name. A deployer uses an AI system in a business context. Most self-employed people and mid-sized companies are deployers. Heavily adapting someone else's model, or offering it under your own name, can however make you a provider.
What did compliance cost on this site?
Little. The legal side was a small fraction of all the work on this site, and no external advice was needed. The reason is an early architectural decision, namely that nothing is published without human approval. The larger effort goes into the checks that make sure the agents work reliably.
What is an AI inventory and why do I need one?
An AI inventory is the list of every point in the business where AI is used, from text agents and image generators to translation and analysis steps. It is the basis for judging which obligations under the AI Act apply. It often surfaces systems that were previously seen as ordinary tools.
Warm regards,
Dennis Weidner
Note: AI tools supported me in writing this article, and some images were edited with AI. I stand behind its content and every statement with my name.
