Since 2 August 2026, the EU AI Act's transparency rules apply. The high-risk rules have been postponed. Here is what applies today, what comes later, and a practical checklist for a municipality's AI assistant.

Introduction

"Hi! I'm Giulia, your virtual assistant at the City of Foggia. How can I help you today?"

A friendly name. A smiling avatar. A warm, natural tone. For many citizens, especially older ones, it's not obvious whether "Giulia" is a person in the municipal office or a piece of software.

Since 2 August 2026, that ambiguity has a legal answer. Article 50 of the EU AI Act requires that people are informed when they are interacting with an AI system, unless it's already obvious.

At the same time, the Digital Omnibus postponed most of the high-risk rules. So the summer of 2026 left many public administrations with a confusing picture: what applies now, and what can wait?

This post tries to answer that question clearly, from the point of view of the most common AI use case in the public sector: the citizen-facing assistant of a Comune (an Italian municipality).

Disclaimer

I'm an engineer and a sales professional, not a lawyer. This article is an educational overview and does not constitute legal advice. Summaries of the AI Act are simplified and my own; dates and interpretations reflect publicly available sources as of October 2026 and may change. Commission guidelines are non-binding, and only the Court of Justice of the EU can give an authoritative interpretation of the AI Act. Always check the official texts (EUR-Lex, Gazzetta Ufficiale) and consult your legal, DPO and compliance teams before designing or deploying AI in public services. The views expressed are my own and do not represent those of my employer.

The Timeline: What Applies Now, What Comes Later

The AI Act applies in stages, and the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) changed some of those stages. Here is the picture that matters for public services:

Date What applies
2 February 2025 Prohibited AI practices (art. 5). AI literacy obligation (art. 4), later softened by the Omnibus into a duty to take measures to support staff AI literacy.
10 October 2025 Italy's Law 132/2025 enters into force, including art. 14 on AI in the Public Administration.
2 August 2026 Article 50 transparency obligations apply.
2 December 2026 Deadline for generative AI systems already on the market before 2 August 2026 to comply with the machine-readable marking duty (art. 50(2)).
2 December 2027 High-risk obligations for stand-alone systems listed in Annex III (e.g. access to essential public services and benefits).
2 August 2028 High-risk obligations for AI embedded in regulated products (Annex I).
2 August 2030 Outer deadline for high-risk systems used by public authorities that were already on the market or in service before the high-risk rules started to apply.

A common misreading of "2030"

You may have read that public authorities have until 2030. That's only partly true.

The 2030 date comes from Article 111(2), a transitional rule for legacy systems: high-risk AI systems intended for public authorities that were placed on the market or put into service before the high-risk rules apply must be brought into compliance by 2 August 2030 at the latest.

A new high-risk system put into service after the high-risk rules apply doesn't get that grace period. And none of this affects Article 50, which already applies today.

Article 50 in Plain Language

Article 50 isn't a single rule. It's five different duties, assigned to different actors:

  1. AI that talks to people (art. 50(1), providers). Systems that interact directly with people must be designed so that people know they are interacting with AI, unless it's obvious to a reasonably well-informed, observant person in that context.
  2. AI that generates content (art. 50(2), providers). Synthetic audio, images, video and text must be marked in a machine-readable way and be detectable as AI-generated, as far as technically feasible. Assistive editing that doesn't substantially change the input is excluded.
  3. Emotion recognition and biometric categorisation (art. 50(3), deployers). People exposed to these systems must be informed.
  4. Deepfakes and public-interest text (art. 50(4), deployers). AI-generated or manipulated images, audio or video that look authentic must be disclosed. AI-generated text published to inform the public on matters of public interest must also be disclosed, unless it has gone through human review or editorial control and someone holds editorial responsibility.
  5. How to inform (art. 50(5)). The information must be clear and distinguishable, given at the latest at the first interaction or exposure, and must meet accessibility requirements.

The Commission has also published guidelines on Article 50 (non-binding), and a voluntary Code of Practice on the transparency of AI-generated content.

Provider or Deployer? Why It Matters for a Comune

The AI Act splits obligations between the provider (who develops the AI system or has it developed and puts it on the market under their name) and the deployer (who uses it under their authority).

For a typical municipality:

  • If the Comune buys an assistant from a vendor, the vendor is usually the provider and must build in the disclosure (art. 50(1)) and content marking (art. 50(2)). The Comune is the deployer.
  • If the Comune builds its own assistant on top of a general-purpose model and puts it into service under its own name, it may itself become the provider, with the design obligations that come with it.

In practice, the Comune should not treat this as "the vendor's problem". The citizen sees the Comune's logo, not the vendor's. And as a deployer, the Comune is directly responsible for the art. 50(4) duties, for example when it publishes AI-generated content.

My suggestion: write the Article 50 responsibilities into the contract, and test them yourself before going live.

Is a Comune's Assistant "High-Risk"?

Usually, not on its own. An assistant that answers questions about opening hours, documents required for an ID card, or how to book an appointment is generally a transparency case, not a high-risk one.

It changes when the AI starts to influence decisions about people. Annex III includes, among others, AI systems used by or on behalf of public authorities to evaluate eligibility for essential public assistance benefits and services, or to grant, reduce, or revoke them. An assistant that pre-screens applications for housing support or social benefits could fall into this category, with the full high-risk regime applying from 2 December 2027 for new systems.

Classification depends on the specific use, so it must be assessed case by case. But a good design rule is: keep information and decisions separate. The assistant informs and guides; eligibility decisions follow a procedure with a human decision-maker, as Italy's Law 132/2025 already requires.

Designing the Disclosure

The law says what to achieve. Here is how I would do it in practice.

Don't rely on "it's obvious"

The "obvious" exception exists, but for public services I would never rely on it. A human name, a photo-like avatar, and a natural tone are exactly what makes it not obvious. Citizens of every age and digital skill level use public services.

Say it first, say it clearly

The disclosure belongs in the first message, not in the footer or in the privacy policy. An example:

"Hi, I'm the virtual assistant of the City of [Name]. I'm an artificial intelligence system, not a person. I can give you information about services and procedures, but I don't make decisions on your requests. You can ask to speak to a member of staff at any time."

In Italian, for an Italian Comune:

"Ciao, sono l'assistente virtuale del Comune di [Nome]. Sono un sistema di intelligenza artificiale, non una persona. Posso darti informazioni su servizi e pratiche, ma non prendo decisioni sulle tue richieste. Puoi chiedere in qualsiasi momento di parlare con un operatore."

This one message does three jobs: it meets the Article 50 disclosure, it supports the knowability principle of Law 132/2025, and it sets the right expectations.

Keep it visible

A first message can scroll away. Keep a persistent label ("AI assistant") in the chat header and next to the assistant's messages.

Make it accessible

Article 50(5) requires accessibility, and Law 132/2025 (art. 3) guarantees full access to AI systems for people with disabilities. That means: readable by screen readers, sufficient contrast, plain language, not only an icon or colour.

Don't forget the other channels

  • Phone and voice assistants: disclose at the start of the call, before the conversation begins.
  • Emails or messages sent by an AI agent: say so in the message.
  • News and announcements on the municipal website or social media written with AI: either disclose, or make sure there is real human review and editorial responsibility (art. 50(4)).
  • Images and videos: no synthetic "spokesperson" or realistic AI-generated images of real places or events without a clear label.

What About Penalties?

Article 50 violations fall into the AI Act's tier of fines of up to €15 million or 3% of worldwide annual turnover for undertakings. For public authorities, the AI Act leaves it to each Member State to decide to what extent administrative fines can be imposed on them (art. 99(8)).

But I would not frame this as a fines question. For a public institution, the real cost of getting transparency wrong is trust. A citizen who discovers that "Giulia" wasn't a person, after sharing personal details as if she were, will not trust the next digital service either.

Checklist: Article 50 for a Comune's AI Assistant

Roles and contracts

  • [ ] We know who is the provider and who is the deployer of each AI system.
  • [ ] The contract assigns responsibility for disclosure, content marking and accessibility.
  • [ ] We have an inventory of all AI systems that interact with citizens or generate public content.

Disclosure

  • [ ] The assistant says it is an AI system in the first message, in plain language.
  • [ ] A persistent label stays visible during the conversation.
  • [ ] We do not rely on the "it's obvious" exception.
  • [ ] Voice channels disclose at the start of the call.
  • [ ] Messages and emails sent by AI agents say so.
  • [ ] The disclosure is accessible (screen readers, contrast, plain language).

Content

  • [ ] AI-generated images, audio and video are labelled, and the provider's machine-readable marking is in place.
  • [ ] Public-interest texts written with AI are disclosed or go through documented human review with clear editorial responsibility.

Boundaries

  • [ ] The assistant informs and guides but doesn't decide on eligibility, benefits or sanctions.
  • [ ] Any use that could fall under Annex III has been assessed for the 2027 high-risk regime.
  • [ ] Citizens can reach a human at any time, and the handover keeps the context.

Governance

  • [ ] Staff managing the assistant have received AI literacy training.
  • [ ] Privacy information about AI processing is written in clear, simple language (as Law 132/2025 also requires).
  • [ ] We have tested the whole experience with real citizens, including older people and people using assistive technology.

Conclusion

The postponement of the high-risk rules created a dangerous illusion: that the AI Act can wait. For citizen-facing AI, it can't. Article 50 is live, and its core requirement is simple: don't let people believe they are talking to a person when they are talking to a machine.

For public services, this isn't a burden. It's the foundation of trust that every digital service needs.

Telling citizens they're talking to an AI isn't a weakness of the service. It's a promise about how the service treats them.

Sources: