2026-07-10 · Dominion Observatory
Since the Digital Omnibus agreement (Council approval 29 June 2026), much coverage has read as "the EU AI Act is delayed." For most agent and MCP builders, that reading is wrong in the way that matters. Article 50 transparency obligations still apply from 2 August 2026.
So the headline “delayed” applies to the heavy high-risk regime. The transparency layer that touches almost every consumer-facing AI product bites in weeks, not years.
On 10 June 2026 the European AI Office published the final Code of Practice on Transparency of AI-Generated Content. Signing is voluntary but carries a real benefit: signatories are presumed to comply with their Art. 50(2) and 50(4) obligations, shifting the evidentiary burden toward regulators. To appear on the initial signatory list published before 2 August, the completed form is due by 18:00 CEST on 22 July 2026. You can still join later, but not as an initial signatory.
Article 50 is about disclosure to end users. That is a product-and-UX obligation, and no scanner (including this one) can sign off on it for you. But if your product is an agent, its transparency and accountability posture depends on parts you did not write: the MCP servers and tools it calls at runtime.
That runtime layer is where the evidence is thin. In our own index of 40,000+ MCP servers, only a fraction expose a live endpoint that can be independently verified at all; and independent research across 9,695 servers found that popularity and directory “verified” badges do not predict security. A one-time code scan cannot see a tool description that changes after you approved it — the tool-poisoning pattern Microsoft warned Copilot customers about in June 2026.
What an agent operator can actually hold as evidence is a continuous, signed record: the tool manifests your agent relies on, re-checked on a schedule, with a tamper-evident attestation trail when they change. That is the audit artifact a reviewer wants, not a badge and not a scan from last quarter.
Dominion Observatory does not verify Article 50 disclosure or content-labeling compliance; that is your product's responsibility and we will not pretend otherwise. What we provide is the runtime tool-trust half of the picture: continuous behavioral verification and drift monitoring of the MCP servers an agent calls, with signed, hash-chained attestations you can put in front of an auditor. Servers we cannot measure are shown unrated, never given a fabricated score.
Baseline and monitor a server: continuous drift monitoring. Check any server free: trust score lookup. How the signed record works: methodology.
Not legal advice. Dates reflect the Digital Omnibus political agreement and the Commission's published Article 50 timeline as of July 2026; confirm against the Official Journal text once published.
Check any MCP server's trust score: dominionobservatory.com/check
Browse all 40,000+ servers: Server Directory