Today, 2 August 2026, the EU AI Act’s Article 50 transparency obligations became applicable. Any AI system that identifies or infers emotions from a natural person’s biometric data now has to inform the person that it is doing so. Any AI system that classifies a natural person into a category based on biometric data has the same obligation. That covers a small cluster of consumer neural-wearable products currently on sale in the EU.
Sixteen months from today, on 2 December 2027, the same category of products becomes subject to a much heavier regime under Annex III: conformity assessment, risk management, data governance, technical documentation, human oversight, quality management. That was originally supposed to apply today as well. It got deferred by the Digital Omnibus, Regulation (EU) 2026/1744, adopted by the Council on 29 June 2026, published in the Official Journal on 24 July, and in force since 27 July.
Most compliance framings appearing in trade press this week are treating today as “the AI Act being delayed.” That framing misses which layer of the Act was moved. Article 50 transparency applies today unchanged. Annex III high-risk obligations are what got pushed to 2027.
What Article 50 requires today
Article 50 sits in Chapter IV of the AI Act. It is a transparency layer that applies independently of risk classification. Providers of AI systems intended to interact directly with natural persons have to design them so that users know they are dealing with AI, unless obvious from context. Deployers of emotion recognition systems and biometric categorisation systems have to inform natural persons exposed to them of the operation of the system.
The two definitions matter. Article 3(39) defines an emotion recognition system as “an AI system for the purpose of identifying or inferring emotions or intentions of natural persons on the basis of their biometric data.” Article 3(40) defines a biometric categorisation system as “an AI system for the purpose of assigning natural persons to specific categories on the basis of their biometric data, unless it is ancillary to another commercial service and strictly necessary for objective technical reasons.”
The Commission’s Article 5 Guidelines (draft published 4 February 2025) treat attention-state inference from EEG as emotion recognition. Fatigue inference is treated as a physical state and falls outside the definition. That distinction matters for consumer BCI products.
Article 50(3), the emotion-recognition and biometric-categorisation notice, applies today. Article 50(2) covers watermarking of AI-generated content. For systems placed on the EU market on or after 2 August 2026, Article 50(2) applies today. For generative AI systems already on the market before that date, the Digital Omnibus extends the machine-readable marking deadline to 2 December 2026, a four-month grace window.
Non-compliance with Article 50 carries a penalty of up to €15 million or 3 per cent of global annual turnover under Article 99, whichever is higher.
What the Digital Omnibus actually deferred
Regulation (EU) 2026/1744 is the legal instrument. It amended Regulation (EU) 2024/1689 (the AI Act) along with the Basic Aviation Regulation and the Machinery Regulation. Political agreement was reached between Council and Parliament on 7 May 2026, Parliament endorsed on 16 June (423 in favour), Council formal adoption on 29 June, publication in the Official Journal on 24 July, entry into force on 27 July.
The Omnibus deferred two categories of obligation:
Article 6(2) standalone high-risk systems classified under Annex III moved from 2 August 2026 to 2 December 2027, a sixteen-month deferral. Emotion recognition sits in Annex III point 1(c), biometric categorisation in point 1(b). This deferral moves the full Annex III obligation suite: risk management (Article 9), data governance (Article 10), technical documentation (Article 11), record-keeping (Article 12), transparency to deployers (Article 13), human oversight (Article 14), accuracy and robustness (Article 15), quality management (Article 17), and conformity assessment.
Article 6(1) embedded high-risk systems classified under Annex I moved from 2 August 2027 to 2 August 2028, a twelve-month deferral.
Article 50 transparency obligations and Article 4 AI literacy obligations were explicitly excluded from the deferral. The Omnibus also added a new Article 5 prohibition covering AI-generated non-consensual intimate imagery and AI-generated CSAM, on its own timeline.
The three-layer scope split
The same emotion recognition product now faces three separate layers of obligation, each with its own timeline:
Article 5(1)(f) prohibits emotion recognition AI in workplace and educational institutions, with medical and safety exceptions. That prohibition has been in force since 2 February 2025 and carries the top-tier penalty of up to €35 million or 7 per cent of global annual turnover. If an EU-based employer wanted to use a BCI product to infer employee emotional state at work, it would have been already illegal for eighteen months. This is not what Article 50 does today.
Article 50(3), which applies from today, is a transparency notice obligation. Deployers of emotion recognition or biometric categorisation systems have to inform the natural persons exposed to them of the system’s operation. This applies in all contexts where emotion recognition is not otherwise prohibited under Article 5. For a consumer BCI wearable sold in the EU, that means user-facing disclosure at onboarding and in-app notification when the emotion or attention classification is operating, in clear and accessible form. Non-compliance penalty: up to €15 million or 3 per cent of global annual turnover.
Article 6(2) and Annex III point 1(c), which was supposed to apply today but was moved by the Omnibus to 2 December 2027, is the high-risk regime. Full conformity assessment, quality management systems, human oversight, technical documentation, data governance, risk management. That regime does not apply for another sixteen months.
One emotion recognition product now sits under three distinct regimes on separate clocks. The Omnibus moved the third.
Which BCI operators this covers
The verified list of consumer neural wearables in the EU market whose function includes emotion or attention-state inference from biometric data:
Muse (Interaxon) sells consumer EEG meditation and focus-tracking hardware through eu.choosemuse.com, with EUR pricing. Emotiv sells EPOC and adjacent EEG headsets with emotion-metric features in the EU. Neurable’s MW75 Neuro and MW75 Neuro LT focus-state EEG headphones ship via Master & Dynamic distribution. Muse, Emotiv and Neurable all infer attention or emotional-state categories from biometric data captured through consumer neural sensors, sell in the EU, and fall within Article 50(3) scope today.
Meta’s Neural Band is not in scope for Article 50 emotion recognition. It reads surface EMG at the wrist for gesture control, which does not meet the emotion recognition definition in Article 3(39). Any framing that includes Meta Neural Band as an EU AI Act emotion-recognition compliance target is wrong.
Oura, WHOOP and Fitbit sit in a grey zone. HRV-derived stress inference may qualify under Article 3(39), but wearable vendors have taken the position that this is wellness insight rather than emotional classification. Expect this to be tested by a national data protection authority within the first year of enforcement.
Neuralink, Synchron, Paradromics and Precision Neuroscience are investigational medical devices not on the EU market for consumer use. The Article 50 transparency regime does not apply to them in their current clinical-trial posture.
Enforcement risk and precedent
Enforcement is uneven across the twenty-seven Member States. Only a minority have advanced national competent authority designations as of today, with Ireland furthest along at fifteen designated authorities. First-year enforcement gaps are likely.
The most useful precedent for consumer-BCI operators is not European. On 9 August 2023, the Chilean Supreme Court ordered Emotiv to delete a claimant’s brain data, ruling that brain electrical activity is constitutionally protected under Chile’s 2021 neurorights amendment. That remains the only constitutional neurorights ruling against a named consumer BCI operator worldwide. Regulators given a legal hook will act on consumer neural-data operators, and Article 50 hands the twenty-seven EU Member States that hook from today.
No verified EU enforcement action against a BCI operator exists to date.
The four-jurisdiction posture, updated
Issue 01’s four-jurisdiction analysis placed the EU in the horizontal-regulator category, marked by cross-sector AI plus GDPR obligations. This week the horizontal-regulator posture becomes operational for consumer BCI at the transparency layer.
The US posture remains state-patchwork. Connecticut SB 1295, the neural data amendment to CTDPA, came into force on 1 July 2026, joining Colorado (2024), California (2025) and Montana (2025). No federal instrument. Chile’s Rights-First posture is anchored by the 2021 constitutional amendment (Law 21.383) and implementing bill 13.828-19, which has passed the Chilean Senate and is pending in the Chamber of Deputies. China’s Industrial Builder posture continues to accelerate around NMPA approvals and NHSA pricing categories, with no analogue to Article 50 transparency for consumer neural wearables. The UK sits between the EU and US postures with the MHRA’s draft Medical Devices (Amendment) Regulations 2026 published, expected in force mid-2027 per the MHRA timeline, with a three-year transition.
What to watch
Two near-term milestones matter through the next sixteen months.
First, whether any national competent authority in the EU takes early Article 50 enforcement action against a named consumer neural wearable operator. Muse, Emotiv or Neurable are the most exposed by market presence. First-year enforcement will indicate whether Article 50 becomes an actual chokepoint or a paper obligation. The Chilean Emotiv precedent is the reference case for what a first action looks like in this category.
Second, whether the 2 December 2027 Annex III high-risk regime holds its new date or gets deferred again. The Omnibus was a compressed political process (agreement 7 May, in force 27 July), and further deferrals would indicate EU enforcement capacity is not catching up with the AI Act’s original timetable. If the December 2027 date holds, consumer BCI operators selling into the EU have sixteen months to build out the full Annex III compliance regime from what for most is a standing start.
The compliance framing to hold going forward: Article 50 transparency applies today; Article 5 prohibitions have applied since February 2025; Annex III high-risk obligations apply from 2 December 2027. Anyone framing today as “the AI Act was delayed” is missing all three layers.