Already in effect: EU AI Act transparency duties
If your app uses generative AI — chatbots, image generation, text completion, anything a user might mistake for human output — the EU AI Act's transparency obligations (Article 50) became enforceable on August 2, 2026. That's within the last 45 days, so if you haven't touched this yet, it's time.
In practice, this means two things for most vibe-coded apps:
- Disclose the interaction. If users are chatting with an AI system, they need to be told they're not talking to a human.
- Label generated content. Text, images, audio, or video your app generates needs to be identifiable as AI-made.
This applies to any provider or deployer offering AI systems in the EU, regardless of where your company is based. Full details: EU AI Act and our ficha.
Coming up: the labeling grace period ends
Here's the part builders tend to miss. The EU AI Act includes a transitional carve-out under the digital Omnibus: AI systems that were already on the market before August 2, 2026 got extra time before they had to add machine-readable labeling to generated content. That grace period ends on December 2, 2026.
Translation: if you shipped your AI feature before August, you have until December to add the machine-readable marking required under Article 50.2. If you're launching after August, this already applies to you — there's no grace period to lean on. Either way, the deadline is close enough (well within the next six months) that it's worth building the labeling into your roadmap now rather than scrambling in November.
If you have users in India: DPDP Act
India's Digital Personal Data Protection Act, 2023 (DPDP Act) has been on the books for a while, but the enforcement rules — the practical detail that tells you what "compliant" actually looks like — take effect on November 1, 2026.
Two things matter here for small teams:
- It's extraterritorial. The law applies to processing digital personal data in India, or outside India if you're offering goods or services to people in India. If your app has Indian users, this is relevant even if your company has no presence there.
- Verifiable consent is central. The rules that kick in this November flesh out consent mechanics and the obligations of "data fiduciaries" (roughly, anyone who determines the purpose of processing personal data — likely you, if you run the app).
If you have users in Chile: Ley 21.719
Chile is replacing its old data protection law (Ley 19.628) with Ley 21.719, which enters into force on December 1, 2026. This introduces a new dedicated data protection authority and a more modern regulatory framework, closer in spirit to what you'd find in the EU or other recent Latin American reforms.
If your app serves Chilean users — even as a small side project that happened to pick up traction there — this is a law worth having on your radar now, since it lands the same month as the AI Act labeling deadline above.
Reference: Ley 21.719 · ficha.
Why this cluster matters for solo builders
None of these four items exist in isolation for a builder shipping fast with tools like Lovable, Bolt, or v0. The common thread: if your app touches AI-generated content or personal data, and you have users outside your home country, obligations are increasingly popping up from directions you didn't plan for. You don't need a legal team to notice this — you need your compliance docs and disclosures to update automatically as these dates arrive.
That's the whole point of watching a radar like this one: not to panic about hypothetical fines, but to know which of the next 180 days actually require you to do something — add a label, update a consent flow, or check whether a law even applies to your user base.
Check where your app stands
Not sure whether any of this touches your app? Run a free check — no signup required — at golexvibe.com/check. It looks at what your app actually does (AI features, data collected, regions served) and tells you which of these rules are relevant, so you're not guessing from a list of acronyms.