Since 2 August 2026, the transparency obligations of the EU AI Act have applied, even though the high-risk rules were pushed back. For companies that use AI to write or send emails, one question keeps coming up: do you now have to disclose that a message was written by AI? The answer mostly depends on one thing: does a human review the message before it goes out?
What happened
The AI Act scheduled several sets of obligations for 2 August 2026. In June 2026, the European Parliament and the Council approved the so-called Digital Omnibus package, which delays the high-risk rules: to 2 December 2027 for Annex III systems (hiring, credit, education, essential services) and to 2 August 2028 for systems embedded in regulated products.
As this analysis by law firm Jones Walker explains, Article 50, which covers transparency, was not delayed. Among other things, it requires AI systems that interact directly with people to tell them they are dealing with AI, unless that is obvious, and requires providers of generative AI to mark their output in a detectable way. The only relief: systems already on the market before 2 August have until 2 December 2026 to implement that technical marking. Breaches can be fined up to €15 million or 3% of worldwide turnover.
What it means for professionals
For a typical business email, drafted with AI help and then reviewed and sent by an employee, Article 50 does not appear to create a labeling obligation. The duty to disclose AI-generated text targets text published to inform the public on matters of public interest, and it does not apply when a human has reviewed the content and holds editorial responsibility for it. A sales exchange or a reply to a customer does not fall into that category.
Fully automated exchanges are a grayer area. If an AI answers your customers on its own, with no review, it comes closer to a system interacting directly with people, and telling them becomes basic prudence. The technical marking duties fall on the providers of AI systems, not on the businesses using them. Finally, the AI Act adds to the GDPR rather than replacing it: where your emails are processed is still a central question. That is why Scribarius saves its replies as drafts by default, hosts its databases in France and runs its servers in the EU.
What to do now
- List the tools that send emails without human review: AI auto-replies, conversational agents, automated sequences.
- For those sends, add a clear note that the reply is AI-generated, or bring back a validation step.
- Ask your AI vendors how they comply with Article 50 and where your data is processed.
- Have your legal counsel or DPO confirm your analysis: this article describes the general framework and is not legal advice.
The next date to watch is 2 December 2026, the marking deadline for systems already in service. For the personal data side, read our analysis of GDPR and AI email assistants.
Tags
