On 2 December 2026 the AI Act's marking grace period ends and two new prohibitions apply. Irish organisations should check what they built, what vendors confirm and what staff policy says.
On 2 December two parts of the EU AI Act start to apply, both set by the Digital Omnibus, Regulation (EU) 2026/1744. Generative AI systems that were on the market before 2 August must now mark their output as AI-generated in a machine-readable way. And two new prohibitions take effect, covering AI systems that produce non-consensual intimate imagery and AI systems that produce child sexual abuse material.
For most Irish organisations this is about a week of work. There are 18 days left to do it.
Most of the coverage since the summer has been about what the Omnibus pushed out: high-risk obligations to December 2027 and August 2028. Leadership teams heard "delayed" and moved on. This date went the other way. Marking got a four-month extension for existing systems only, and the prohibitions are new law.
What changes on 2 December
Marking. Article 50(2) requires providers of AI systems that generate text, images, audio or video to make sure the output is marked in a machine-readable format and detectable as artificially generated. That has applied since 2 August to anything launched from that date. Systems already on the market were given until 2 December to catch up, and that is the allowance that ends.
The standard is not a mystery. The Commission's Code of Practice on marking and labelling was finalised on 10 June, and the Commission and the AI Board have confirmed it as an adequate way to show compliance. About 190 organisations had signed it by the end of July. The large model providers know exactly what is expected of them.
Prohibitions. Two new points in Article 5 ban AI systems that generate or manipulate realistic intimate images or video of an identifiable person without their consent, and systems that generate child sexual abuse material. For providers, the ban reaches past tools built for that purpose. It also catches systems where that output is reasonably foreseeable and adequate safeguards are missing. For deployers, the ban is on using a system that way. Article 5 sits in the Act's top penalty tier: up to €35 million or 7% of worldwide turnover.
You may be a provider without knowing it
Most Irish firms are deployers. The marking duty sits with providers, so "we only use the tools" is the right answer for most of them.
Check it anyway. Under the Act, a provider is whoever develops an AI system, or has one developed, and puts it on the market or into service under its own name. Licensing the underlying model from somebody else does not change that.
Think about the proposal generator your IT team built on a licensed model and put on the client portal. The property description writer on an estate agent's website. The report-drafting assistant a consultancy offers to clients under its own brand. If something like that went live before 2 August and is still running, the 2 December date may be yours and not your model vendor's.
The Commission's final Article 50 guidelines, published on 20 July, narrow the scope sensibly. As Reed Smith summarises them, translations, source code, short outputs and machine-to-machine outputs are excluded. So are systems whose output stays inside the organisation, in a controlled environment, with safeguards against misuse. Public-facing and consumer-facing systems do not get that carve-out. An internal drafting tool is likely out. Anything a customer can touch is likely in.
Three checks to run before the date
List what you built. Anything generative, offered under your name, that a customer or member of the public can reach. For each one, write down when it went live, whose model sits underneath and whether the output carries a machine-readable mark. If nobody in the building can tell you whether the output is marked, assume it isn't.
Email your vendors. One paragraph to each supplier of a generative tool: confirm in writing that output from the product is marked in line with Article 50(2), and tell us whether you have signed the Code of Practice. Keep the replies. Then look at your own publishing pipeline. Plenty of content systems strip metadata from an image when they resize or compress it. A vendor's mark that disappears on upload to your website is something you want to find yourself.
Name the prohibition in your acceptable-use policy. Sharing intimate images without consent is already a criminal offence in Ireland under the Harassment, Harmful Communications and Related Offences Act 2020. From 2 December, using an AI system to create that material is also a prohibited practice under the AI Act, with the top-tier fine attached. Your policy should say in plain words that using any AI tool to create intimate or sexual imagery of a real person is forbidden, and it should connect to your dignity at work and disciplinary procedures. If it ever happens on a tool you licensed, the first two questions will be what your policy said and what safeguards the tool had. Ask your image and video tool vendors the second question now.
None of this needs a consultant or a project team. It needs somebody to own it for a week.
What this date tells you about the rest
Organisations with a working AI inventory can answer all three checks in an afternoon. Organisations without one start by walking the floor asking who built what. That gap is the real finding, and it will show up again at every date still to come.
The same register is what you need for the Article 50 disclosure duties that have applied since August, for the chatbot notices your customers already see, for AI literacy, and for high-risk classification before December 2027. It is also the first thing a regulator will ask for, whichever regulator turns out to be yours.
Directors have one question for the December board meeting: which generative systems do we offer under our own name, and can we show the output is marked? A one-page answer is fine. No answer tells you the inventory does not exist.
The Acuity AI position
We start every AI Act engagement with the inventory, because every obligation in the Act depends on knowing what you run, who built it and who it touches. Diagnose before prescribe. The 2 December date is a small test of that discipline: three checks that take days if the register exists and weeks if it doesn't. Our fixed-fee, vendor-neutral EU AI Act readiness review builds that register and classifies what is on it, so the next date is an afternoon's work too. If the three checks above turn up more questions than answers, talk to us.