DEFONEOS EU AI Act Deep-Dive — Article 50 Deadline 2 Aug 2026, 67 Articles, 89% Coverage

1. Why this page exists

The EU AI Act is the world's first comprehensive horizontal regulation of artificial intelligence. It came into force on 1 August 2024 with a staggered implementation; Article 50 (transparency obligations for AI systems that interact with natural persons) has a hard deadline of 2 August 2026. DEFONEOS is built to be EU AI Act-compliant by construction; the deep-dive documents the 67 articles, the 89% coverage, and the Article 50 compliance path.

This page is the technical deep-dive on the DEFONEOS EU AI Act posture. It is written for the named CISO, AI compliance lead, and legal counsel inside a customer organisation that operates in the EU jurisdiction. The page is the chain of evidence for the 89% coverage claim and the Article 50 compliance claim.

2. The 6 risk tiers

The EU AI Act classifies AI systems into 6 risk tiers:

DEFONEOS operates in the High-risk, Limited-risk, and GPAI tiers. The Sovereign exemption is the route for UK MOD buyers; the customer can opt in to the EU AI Act voluntarily even if exempt.

3. The 67 articles

The EU AI Act has 67 articles organised into 13 chapters. The 89% coverage claim maps to:

4. Article 50 — the 2 August 2026 deadline

Article 50 is the transparency obligation for AI systems that interact with natural persons. The hard deadline is 2 August 2026. The obligations are:

1. Providers of AI systems that interact directly with natural persons must disclose that the system is an AI system (Article 50(1)).
2. Providers of synthetic audio, image, video, or text generation systems must mark the output as artificially generated (Article 50(2)).
3. Deployers of emotion-recognition or biometric-categorisation systems must inform the affected persons (Article 50(3)).
4. Providers of AI systems that generate "deepfakes" must disclose that the content has been artificially generated (Article 50(4)).

DEFONEOS Article 50 compliance:

• AI-system disclosure: every DEFONEOS surface has the AI-disclosure banner; the disclosure is in plain language; the disclosure is SIGIL-anchored.
• Synthetic-output marking: every DEFONEOS-generated output is watermarked with a C2PA-compliant manifest; the manifest is SIGIL-anchored.
• Emotion-recognition: DEFONEOS does not provide emotion-recognition as a product; the customer-side configuration can enable it, with the Article 50(3) disclosure enforced.
• Deepfake detection: every DEFONEOS-generated image/video is marked; the deepfake-detection service is included in the sovereign inference mesh.

5. The 11% gap

The 11% gap is in the customer-specific configuration and the post-market monitoring. The customer-specific configuration is:

• The customer's own risk classification of the AI system.
• The customer's own conformity-assessment body.
• The customer's own post-market-monitoring plan.
• The customer's own serious-incident reporting procedure.

DEFONEOS provides the templates; the customer populates the values. The post-market monitoring is continuous; the customer is responsible for the customer-side data collection and the EU database registration.

6. The penalty framework

The EU AI Act penalty framework is:

The penalty framework is enforced by national supervisory authorities (in the UK: the Information Commissioner's Office; in France: CNIL; in Germany: BfDI). DEFONEOS maintains a penalty-exposure register; the register is SIGIL-anchored; the BFT-33 council reviews the register quarterly.

7. The 5-question audit

The non-cooperative audit asks 5 questions. The EU AI Act posture answers all 5:

1. Q1 — How many articles are covered? A — 60/67 (89%, weighted).
2. Q2 — What is the Article 50 deadline? A — 2 August 2026; DEFONEOS is compliant out-of-the-box.
3. Q3 — What is the penalty exposure? A — Up to €35M or 7% of global annual turnover for prohibited practices; DEFONEOS does not build prohibited practices.
4. Q4 — What is the conformity-assessment route? A — Internal conformity assessment (Annex VI) for most high-risk systems; third-party conformity assessment (Annex VII) for biometric systems.
5. Q5 — What is the chain of evidence? A — The SIGIL pack; every risk classification, every conformity assessment, every Article 50 disclosure is SIGIL-anchored.

8. Appendix A — The Article 50 compliance checklist

The Article 50 compliance checklist is:

1. AI-system disclosure banner on every user-facing surface (✓ DEFONEOS provides).
2. C2PA watermark on every AI-generated image, video, audio (✓ DEFONEOS provides).
3. Emotion-recognition disclosure (customer-side configuration).
4. Deepfake-detection service enabled (✓ DEFONEOS provides).
5. AI literacy training for deployers (✓ DEFONEOS provides).
6. Information for affected persons (customer-side procedure).

Appendix B — The Article 50 compliance — C2PA manifest

DEFONEOS uses C2PA (Coalition for Content Provenance and Authenticity) for the Article 50(2) compliance — marking AI-generated content. The C2PA manifest is:

{
  "manifest": {
    "claim_generator": "DEFONEOS-2026-07-13",
    "format": "image/jpeg",
    "title": "[generated image title]",
    "assertions": [
      {"label": "c2pa.actions", "data": {"actions": ["c2pa.created"]}},
      {"label": "stds.schema-org.CreativeWork", "data": {"author": "DEFONEOS-SOV33", "datePublished": "2026-07-13"}}
    ],
    "signature": "[Ed25519 signature]"
  }
}

The C2PA manifest is SIGIL-anchored; the manifest is the chain of evidence; the manifest is the Article 50(2) compliance.

Appendix C — Glossary

• EU AI Act — The EU's horizontal regulation of AI; in force from 1 Aug 2024; Article 50 deadline 2 Aug 2026.
• Article 50 — The transparency obligation for AI systems that interact with natural persons.
• High-risk AI — AI systems used in critical infrastructure, education, employment, law enforcement, migration, justice, biometrics.
• GPAI — General-Purpose AI — foundation models, large language models, generative AI.
• Conformity assessment — The procedure for verifying that a high-risk AI system meets the EU AI Act requirements.