On May 7, 2026, the Council and Parliament reached provisional agreement on a Digital Omnibus on AI. Most WooCommerce store owners read the resulting “EU AI Act delayed” headlines and concluded they had until 2027 to think about it. That is not what the deal says. Annex 3 high-risk AI rules slid 16 months to December 2, 2027. The Article 50 transparency obligation covering watermarking of AI-generated content slid only 6 months — landing on December 2, 2026. That is less than seven months from today.

What the May 7 Deal Actually Changed

The Digital Omnibus on AI splits the AI Act timeline into uneven tracks. Annex 3 high-risk AI rules — covering employment, education, essential services, law enforcement, migration and democratic processes — were pushed from August 2, 2026 to December 2, 2027, a 16-month delay (Slaughter and May / Consilium provisional agreement, May 2026).

Annex 1 high-risk AI — industrial and sectoral systems like lifts, toys, and medical devices — was pushed from August 2, 2027 to August 2, 2028, a 12-month delay. The AI regulatory sandboxes deadline for Member States moved from August 2, 2026 to August 2, 2027 (Consilium press release, May 7, 2026).

The Article 50 transparency obligation got a different treatment. The Commission’s original Omnibus proposal pushed watermarking to February 2, 2027. The co-legislators granted only six months of relief and locked the new effective date at December 2, 2026. The Council’s own press release confirms the grace period for providers to implement transparency solutions was reduced from 6 months to 3 months, with watermarking effective December 2, 2026.

The headline framing — “AI Act delayed” — is technically accurate and substantively misleading. The high-risk classification rules that almost no SMB WooCommerce store would have triggered moved a year or more. The watermarking obligation that almost every SMB WooCommerce store will trigger moved less than four months.

Why Watermarking Applies to Product Descriptions, Not Just Deepfakes

The most common misread of Article 50 is that it only covers deepfake images and synthetic audio. That is not what the text says. Article 50 transparency obligation applies to providers and deployers of AI systems that generate or manipulate content — text, image, audio, or video — and requires outputs to be detectable as AI-generated through machine-readable means.

For a WooCommerce store, in-scope content typically includes:

• AI-generated product descriptions produced by ChatGPT, Claude, Gemini, Jasper, or any other generative tool
• SEO blog posts written end-to-end by an AI system or substantially drafted before human editing
• On-site Q&A and FAQ copy generated to answer search-driven queries
• Recommendation copy and personalized product blurbs rendered from a model at request time
• Email subject lines, abandoned-cart messages, and ad creative variants generated in bulk by AI

The carve-out from the obligation, drawn from the Commission’s draft Article 50 implementing guidelines released for consultation on May 7-8, 2026, is content that is reviewed and edited by a human, where the provider takes editorial responsibility. That is the practical exit — and the documentation of the editorial review chain is the part most WooCommerce content workflows do not have.

This sits alongside other compliance regimes already tightening on the same content surface. UK readers will find the same narrowness in our analysis of DUAA’s five new cookie exceptions and why they don’t cover GA4 or Meta Pixel — different jurisdiction, same pattern of regulators leaving the consumer-facing layer exposed.

The “Human Reviewed and Edited” Test

Whether AI-generated copy on your WooCommerce store needs watermarking after December 2, 2026 turns on whether the editorial chain meets the human-review threshold. The Commission’s draft guidelines, released for consultation on May 7-8, 2026, frame the test around three elements:

1. Substantive review. A human actually reads and assesses the AI output for accuracy, tone, and appropriateness — not a glance, not a spell-check.
2. Editorial intervention where needed. The reviewer can and does change AI output, not merely rubber-stamp it.
3. Documented responsibility. The provider takes editorial responsibility for the final published version, and the chain is documentable on request.

None of these are unreasonable for a careful SMB content workflow. The problem is that most WooCommerce content stacks do not record any of it. AI-generated product descriptions are produced in batch, dumped into the CMS, and published without a record of who reviewed which version against which model output on which date.

The 65-Day Pre-Dec 2 Inventory

The practical task between now and December 2, 2026 is an inventory. There are four questions worth answering store-wide:

1. Where on the site is AI generating customer-facing content? Product copy, blog posts, FAQs, recommendation widgets, transactional emails, ad creative, on-site chat. Most WooCommerce owners under-count by half because batch-produced content runs through plugins they have not audited.

2. Which AI outputs go through human review before publication, and which do not? Be honest. Recommendation widgets that render copy at request time are almost never human-reviewed. SEO blog posts produced from a topic queue may be reviewed casually rather than substantively.

3. Is the review chain documentable? If a regulator asked tomorrow which human reviewed your March product descriptions, could you answer? The answer for most stores is no — not because the review did not happen, but because no record was kept.

4. For content that does not pass the human-review test, is watermarking technically achievable in your CMS? WordPress has no native AI-content watermarking standard yet. C2PA-style content credentials, machine-readable provenance metadata, and on-page disclosure language are emerging options that need to be planned, not bolted on the week of Dec 2.

Penalties under the AI Act mirror GDPR’s structure. Fines reach the higher of EUR 35 million or 7% of global turnover for prohibited practices, and EUR 15 million or 3% of turnover for other violations including Article 50 transparency breaches (Legal Nodes 2026 analysis). For the EU-facing SMB WooCommerce store, the absolute numbers matter less than the turnover percentage, which scales down to be enforceable against small businesses.

This is not the only legal floor moving under WooCommerce tracking and content stacks. The companion analysis Trump v. Slaughter Could Pull the Legal Floor From WooCommerce Pixels covers a parallel exposure on the transatlantic data side — different geography, same pattern of regulatory ground shifting under e-commerce operators who assumed they were not the target.

What the Architecture Has to Support

Article 50 compliance is a content-governance problem, not a tracking problem. But the architectural discipline is the same: clean, documentable data flows where you control the chain of custody. Stores that already run first-party infrastructure tend to find content provenance easier to bolt on because the operational habits — auditable logs, server-side processing, clear domain boundaries — transfer directly.

Transmute Engine™ is Seresa’s dedicated Node.js server that runs first-party on your subdomain (for example, data.yourstore.com), with the inPIPE WordPress plugin sending events via API to your server before they route onward. It is not an Article 50 watermarking tool — but the same first-party architecture pattern that gives your tracking stack auditability is the pattern your content compliance work will lean on when December 2 lands.

Key Takeaways

• The May 7 deal did not delay the AI Act for SMB e-commerce. It delayed Annex 3 by 16 months and watermarking by only 6.
• December 2, 2026 is the binding date for AI-generated content. Less than seven months out.
• Article 50 covers AI-generated text — product descriptions and SEO blog posts are in scope unless they pass the human-review test.
• The human-review carve-out requires documentation — substantive review, editorial intervention, provider takes responsibility.
• Inventory AI usage across the site before October. Two months is the minimum to plan provenance changes, not implement them on the deadline.
• Penalty exposure scales by turnover. EUR 15 million or 3% of global turnover for non-prohibited violations.

Frequently Asked Questions

Inventory your AI content surface before September — the lead time for provenance changes on a WordPress stack is longer than most owners think. Start at seresa.io.