Compliance \u00b7 14 August 2026<\/p>\n
On 31 July 2026, a list of about 190 organisations that had signed a voluntary transparency code circulated. On the model-provider side, it includes Anthropic, Google, Meta, Microsoft, Mistral and OpenAI. On 2 August, Article 50 of the AI Act entered into application, and the AI Office was able to investigate providers of general-purpose models. For an integrator SME, the temptation is twofold: stick the code logo on a commercial proposal, or believe that the provider has \u201csigned, so we are covered\u201d. Both readings are false. A code is not the regulation. Signing is not deploying.<\/p>\n
A code of practice is a voluntary commitment, useful for aligning large providers on methods (marking, documentation, cooperation). It does not, on its own, create your deployer obligations. It does not replace Article 50: information for the user talking to AI, machine-readable marking of synthetic content, visible labelling of professional deepfakes, a mention on certain lightly reviewed texts of public interest. It does not replace Article 4, applicable since 2 February 2025 to providers and deployers. It does not bring forward by a day the high-risk postponed to 2 December 2027 (Annex III) or 2 August 2028 (Annex I, Regulation EU 2026\/1744).<\/p>\n
Fines on the transparency strand go up to \u20ac15 million or 3% of worldwide turnover. Those for prohibited practices, already applicable, up to \u20ac35 million or 7%. The code caps nothing, exempts nothing, is not a certificate you can annex to a public tender in place of a real disclosure on the client\u2019s chatbot.<\/p>\n
Anthropic has announced an invisible text watermark in Claude from 2 August; the detector is not public. OpenAI uses SynthID for image and audio. These building blocks do not configure your client\u2019s French banner, nor their register of uses, nor the training of their team.<\/p>\n
If you put agents in at your clients (site, CRM, workshop, hotel), you touch three possible roles, sometimes in the same job: deployer on your own site; contractor who configures the client\u2019s system; and, if you brand a solution in your name and place it on the market, a shift toward the provider role. The code signed by Microsoft or Mistral does not say which box you fall into.<\/p>\n
The client is almost always the deployer: it is they who must inform their users. If you deliver a widget without an information sentence, you deliver a breach. Your contractual liability is added to theirs. A slide that says \u201cour partners have signed the code\u201d helps neither party.<\/p>\n
Systems already on the market before 2 August 2026 have until 2 December 2026 for the machine-readable marking under Article 50(2). If you maintain agents installed in the spring, that deadline concerns you. User information, for its part, does not benefit from that stay. Correct the wording now; plan machine-readable marking by December.<\/p>\n
\u201cAI Act compliant solution because based on a model from a code signatory.\u201d That sentence is inaccurate. The model may be transparent at provider level; your integration may remain opaque. \u201cHigh-risk compliant\u201d is just as hazardous: that regime is not yet applicable (2027\/2028) and, for most VSE\/SME agents, it is not the right qualifier.<\/p>\n
Write instead what you do: user information from the first message; log of tools called; ring-fencing of data; marking plan by 2 December 2026; operator training. That is readable. It is verifiable. It is what an SME director can put to a customer or a controller.<\/p>\n