On August 2, Article 50 of the EU AI Act, also known as the transparency rules, took effect. It introduces labeling requirements for certain AI systems and AI-generated or manipulated content, requiring startups that fall within its scope to change how they present AI-powered features and synthetic content to users.
The consequences of non-compliance are significant — companies can face fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher. For startups, the lower of the two applies.
To see what Article 50 means for tech businesses in practice, Vestbee spoke to three startups approaching AI from different angles: VerbaFlo, which builds conversational AI for residential property operators; Chainloop, which provides governance infrastructure for engineering teams using AI; and Reggy, a newly launched European regulatory compliance platform.
Founders shared where they are struggling with compliance with new transparency rules, what remains unclear under Article 50, and what companies need to tackle before the transition period for certain marking requirements ends in December 2026.
VerbaFlo: disclosure in the interface
VerbaFlo's conversational AI interacts with potential tenants and current residents across WhatsApp, SMS, email, webchat, Instagram, Facebook Messenger, and voice, supporting more than 200 languages. “As AI infrastructure for the residential lifecycle where trust with our customers is crucial, we built transparency into our model from day one. Disclosure was already part of our thinking, but Article 50 sharpened exactly how and where it needed to show up,” the company says to Vestbee.
Before 2 August, VerbaFlo treated the requirement as a cross-functional exercise. Product and engineering teams reviewed every point where AI directly interacts with end users. The principle is consistent across channels: disclosure should appear at the first point of contact, in simple and understandable wording and in the language the customer is using.
The implementation varies by medium. In chat and messaging, the first AI-generated message carries a short disclosure. In voice interactions, the assistant identifies itself as AI before the configured greeting begins. The company also argues that transparency does not necessarily come at the expense of a natural user experience, but its approach is to keep disclosure short and limited to moments where it adds clarity: the start of a session and after a handoff between AI and a human agent. According to VerbaFlo, “The more sophisticated the AI system, when properly disclosed, can actually increase trust and engagement with customers.”
The company sees a potential misconception around the Act's “obvious to a reasonable person” exception, as it may seem narrower under scrutiny. A human-like persona or natural-sounding voice does not necessarily make AI obvious to a user,, “which cuts against how a lot of conversational AI has traditionally been designed,” VerbaFlo highlights.
For the company, the rules of Article 50 were quite clear, especially supported by the Commission's Guidelines and the Code of Practice.
“It's reinforced something we already believed: disclosure and human oversight work best when they're part of the architecture from the start. We've leaned further into designing disclosure at the platform level, so it becomes a default rather than something each client configures individually, and we've become more deliberate about where human review sits in workflows involving generated content or higher-stakes decisions, like affordability or referencing.”
For other startups going through the same process, VerbaFlo recommends mapping every point where AI interacts with people, and looking beyond the obvious chatbot use cases to tools such as referencing and screening, which can carry greater regulatory exposure. Companies should also train every team using AI on Article 50’s transparency requirements, so compliance becomes part of everyday operations rather than an afterthought.
Chainloop: challenges lie beyond just Article 50
For Chainloop, implementation was more straightforward on the user-facing side. The team audited every interface through which users interact with its AI features, including a chat interface over governance data and an agent that analyses coding sessions, labelling them at the point of use. The harder question comes from Article 50(2), which requires generated output to be marked in a machine-readable format rather than simply labelled for a human reader. Chainloop's AI features analyse a customer's own data and return a verdict rather than producing standalone content. Whether that kind of output falls within the machine-readable marking requirement remains unsettled.
“We take the view that our features fall outside it and that the labeling handles the transparency the Act is after, but any vendor claiming certainty here is guessing. This is the question the Commission's guidance needs to answer, and it matters far more than most of what is being written about Article 50,” the company says.
Chainloop points out another issue misunderstood by the regulators — the work of AI agents that go beyond grammar checking and assisting an editor. “Coding assistants belonged in that category two years ago. They do not now. An agent that reads a ticket, writes a module, runs the tests, and opens a pull request is not assisting with editing; it is authoring. Nobody has redrawn that line, and until somebody does, an entire category of software development sits in an exemption written for spellcheck.”
The problem becomes even clearer when companies try to govern what an agent actually does. As Chainloop argues, regulators need to look beyond the output when governing autonomous AI agents. Two agents can produce the same code while operating under very different levels of access and control, meaning that reviewing the final result is necessary, but not enough. Companies also need evidence of what the agent was permitted to access and what it actually did: “Reviewing the output is necessary, and it is not sufficient. What you need is the session: what the agent was permitted to do, and what it actually did. That is what Chainloop collects, signs, and checks against policy before the merge.”
This example illustrates a broader problem for companies deploying increasingly autonomous AI systems: the compliance evidence may need to cover not only the output, but the permissions, context, and actions that produced it.
Chainloop also points out that the challenge lies beyond just Article 50 — Articles 11 and Annex IV require companies to document how an AI system was built, including its third-party components, testing and approvals, while Article 17 requires a governed development lifecycle — which makes compliance an engineering problem.
“Article 17 is the one teams underestimate. A quality management system covering design control, development and verification is a description of a governed development lifecycle. Most organisations have that written in a policy document and not running in their pipelines,” the company says.
Article 25 is also worth looking at, as it effectively makes AI compliance a supply-chain problem. Few companies build a high-risk AI system entirely in-house, yet the provider putting the finished system on the market remains responsible for compliance. Companies need suppliers to provide evidence on models, training data, and evaluation, but unlike software bills of materials, there is no standard format yet, and so much of this still happens over email.
Reggy: compliance starts outside the product
Reggy entered the compliance market in August 2026, right when Article 50 came into effect. The startup’s team is mapping how the companies and startups are adapting to the new transparency and labeling regulations. The first step is usually an AI inventory. Companies are inventorying their use across products, support, sales, and marketing, often finding twice as many use cases as expected. From there, they are adding upfront disclosures, adjusting interfaces for AI agents, and training staff on the rules.
“The practical checklist is straightforward: map AI use, determine whether the company is a provider, deployer or both, fix disclosures, confirm output marking with model vendors, document any exemptions, and keep the evidence. For companies with good records, Reggy estimates this can take a week. For those without them, it can take a quarter.”
The harder part is to determine the company's role under the Act. As Reggy says, many companies follow the risk tiers, so they think that a low-risk product is exempt from Article 50, but it already applies — regardless of the risk classification. The challenge is also a technical one:
“The genuinely difficult technical requirement is machine-readable marking. Marking is further along for images and video than for text. Getting a mark on text to survive copying, editing and reformatting is still an open problem, and the Commission itself says no single method meets all four of its criteria, which is why the Code of Practice asks for two layers rather than one. The Commission acknowledges that gap, but the obligation applies now, so companies are building against a standard that is still being defined.”
Reggy stresses that the difficult part in adjusting to the regulations is invisible — behind that small interface change sits the harder machinery: provenance metadata, detection, vendor assurances and records showing who made each compliance decision. Reggy says startups often stop at the human-readable label, missing the separate requirement that machines must also be able to detect the marking. The same blind spot appears in how companies define the rules’ scope. “We’re not an AI company, we just use a model” does not necessarily get them off the hook. Nor does being based outside the EU. And while Article 50 is manageable in isolation, startups are having to absorb it alongside GDPR, NIS2 and other regulations, often without anyone whose job is to make sense of all of them.
What should companies do by December 2026?
The next key deadline is 2 December 2026. By then, providers of generative-AI systems placed on the EU market before 2 August 2026 must comply with the Article 50(2) requirement to mark synthetic audio, images, video, and text in a machine-readable format and make that marking detectable.
The advice from all three companies is to start by finding where AI is actually deployed. That means looking beyond the product to support, sales, marketing, translation, and internal workflows, then establishing whether the company is acting as a provider, deployer or both in each case.
From there, startups need to trace where AI meets users, how generated content is marked, and where human review changes the compliance picture. VerbaFlo also flags referencing and screening tools as an area worth scrutinizing, as their exposure can differ from the chatbot interfaces most teams focus on. Where compliance depends on a model vendor, companies should get written confirmation; where they rely on an exemption, they should document the decision rather than leave it to individual judgment.
Compliance cannot sit solely with legal and product teams. Employees who deploy AI or publish AI-generated material need to understand when the EU AI Act requires user disclosures or content labeling.
