EU AI Act Article 50: Transparency Obligations Explained

Article 50 of the EU AI Act sets four transparency obligations, applicable since 2 August 2026: providers must tell people they are talking to an AI and machine-mark synthetic content, while deployers must disclose emotion recognition, biometric categorisation, deepfakes and unreviewed AI-generated public-interest text. Breaches carry fines up to €15 million or 3% of worldwide turnover.

It is the practical compliance focal point for most organizations deploying AI systems that aren’t otherwise high-risk. The obligations look light on the surface and have considerable operational weight on closer reading.

Article 50 at a glance

The article’s official title is “Transparency obligations for providers and deployers of certain AI systems” (Article 50 text). Its paragraphs break down as follows:

When Article 50 applies

Article 50 has applied since 2 August 2026, the AI Act’s general date of application under Article 113. The AI Omnibus, Regulation (EU) 2026/1744, took effect on 27 July 2026 (NicFab) and deferred the high-risk rules to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products, but the chatbot disclosure duty in Article 50(1) kept its 2 August 2026 start (FPF).

One transition applies. Article 111(4), added by the Omnibus, gives providers of generative AI systems that were placed on the market before 2 August 2026 until 2 December 2026 to apply the machine-readable marking in Article 50(2) (NicFab). It covers only that marking duty: a generator placed on the market from 2 August 2026 must mark from launch, and the deployer duties in Article 50(4) have no grace period. Content generated before 2 August 2026 needs no retroactive label, though the Commission encourages one (Commission Q&A).

The 2026 sequence:

• 10 June: final Code of Practice on AI-generated content published.
• 8 July: the Commission finds the code adequate; the AI Board follows a day later.
• 20 July: Article 50 guidelines published.
• 27 July: AI Omnibus enters into force.
• 2 August: Article 50 applies.
• 2 December: marking deadline for generators already on the market.

Article 50 does not depend on a high-risk classification. A chatbot or content generator outside Annex III still carries these duties, and Article 50(6) leaves the Chapter III requirements untouched, so a high-risk system that also talks to people or generates content carries both sets.

The four obligations, mapped to AI system types

Article 50 imposes distinct obligations on four categories of AI system. Two sit with providers (paragraphs 1 and 2) and two with deployers (paragraphs 3 and 4); one organisation often holds both roles.

Obligation 1: Chatbots and conversational AI

Article 50(1) requires providers of AI systems intended to interact directly with natural persons to ensure that those persons are informed they are interacting with an AI system, unless this is obvious from the circumstances or the system is authorized by law for the prevention of criminal offenses.

The Commission’s Article 50 Q&A sets four cumulative criteria for “interact directly”: an AI system, a genuine two-way exchange, the AI itself communicating rather than a human intermediary, and a natural person on the other side. Chatbots, AI agents and avatars qualify; background and machine-to-machine systems do not.

Operational implications:

• First-contact disclosure is required when the system is a chatbot, voice agent, or any text-based AI that an end user interacts with.
• The disclosure must be before the substantive interaction, not buried in terms or footers.
• “Unless obvious” is read narrowly. The test is whether an average, reasonably well-informed and observant person would see it. A customer service chat widget on a corporate website is not “obviously” AI to most users; that the user might guess does not exhaust the obligation.

The “authorized by law” carve-out is narrow and primarily covers law-enforcement use.

A company that wraps a third-party LLM in its own branded assistant is the provider of that assistant, since the Q&A defines a provider as whoever puts a system into service under its own name. The privacy side of such deployments is covered in AI chat assistant privacy risks.

Obligation 2: Synthetic content generation

Article 50(2) requires providers of AI systems generating synthetic audio, image, video, or text content to mark outputs as artificially generated or manipulated in a machine-readable format. Deployers of such systems generating deepfakes have additional disclosure obligations under 50(4).

Operational implications:

• Outputs must carry a machine-readable marker — watermark, signed metadata, or equivalent.
• The marker must be robust against routine modification (compression, format conversion).
• The standard is “interoperable” — multiple providers’ systems must be capable of reading each other’s markers.
• The Q&A excludes short strings of numbers, symbols or letters, source code, machine-to-machine outputs, and assistive standard-editing functions.
• C2PA and similar specifications are the working interoperability target. The Act itself names no standard: Article 50(7) instead provides for Union-level codes of practice on detecting and labelling AI-generated content. The Omnibus removed the Commission’s power to approve such a code by implementing act, but the Commission can still impose common rules by implementing act if it finds a code inadequate (NicFab). That code now exists: the Commission published the final Code of Practice on Transparency of AI-generated Content on 10 June 2026. It is voluntary, with one section for providers of generative AI systems on marking and detecting AI-generated content, and one for deployers on labelling deepfakes and AI-generated text published on matters of public interest.

The marker requirement applies to the provider; the deployer labelling duties in 50(4) layer on top.

Obligation 3: Emotion recognition and biometric categorization

Article 50(3) requires deployers of emotion-recognition systems and biometric-categorization systems to inform the natural persons exposed to them about the system’s operation and to process the personal data in accordance with GDPR.

Operational implications:

• The disclosure must reach persons being categorized, not only persons who explicitly interact.
• “Exposed to” includes passive exposure (CCTV with biometric analysis, voice analysis during phone calls), in real time or after the fact.
• The disclosure is in addition to GDPR transparency requirements; both apply.

Obligation 4: Deepfakes and public-interest text (deployer obligation)

Article 50(4) requires deployers generating or manipulating image, audio, or video that constitutes a deepfake to disclose that the content has been artificially generated or manipulated.

The Q&A reads the Article 3(60) definition as three cumulative tests: high resemblance to the subject, a subject that exists or plausibly could, and content that could falsely appear authentic. Special effects and standard post-production usually fail the third.

Operational implications:

• Applies to anyone using a generator commercially or in a public context, not just the generator’s provider. Purely personal, non-professional use is out of scope.
• The provider’s machine-readable mark does not satisfy this duty; the label must be perceivable without special tools.
• Where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the duty shrinks to disclosing that generated or manipulated content is present, in a way that does not hamper the display or enjoyment of the work.
• The duty does not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences.

The second subparagraph of Article 50(4) adds a text duty. Deployers of an AI system that generates or manipulates text published with the purpose of informing the public on matters of public interest must disclose that the text was artificially generated or manipulated. The exception is AI-generated content that has undergone human review or editorial control, where a natural or legal person holds editorial responsibility for the publication; uses authorised by law to detect or prosecute criminal offences are also exempt.

Per the Q&A, spell-checking or grammar correction is not human review; editorial control means a responsible person, such as an editor-in-chief, can approve, alter or reject the text on substance, including fact-checking.

What counts as “informed”

Article 50(5) sets the baseline: the information must be given “in a clear and distinguishable manner at the latest at the time of the first interaction or exposure” and must conform to the applicable accessibility requirements. In practice that means:

1. Timing: no later than the first interaction (chatbots) or first exposure (synthetic media, emotion recognition and biometric categorization).
2. Clarity: clear and distinguishable, in language understandable to the average person in the relevant audience. Technical jargon does not satisfy.
3. Persistence: as good practice, keep the disclosure available for review rather than showing it once.
4. Accessibility: the disclosure must meet the applicable accessibility requirements.

A pop-up that the user dismisses without reading is not “informed.” A footer with a link to an AI policy is not “informed.” A welcome message that says “Hi, I’m an AI assistant” before the user types is.

The machine-readability requirement in practice

For synthetic-content generation, machine-readable marking has emerged as the most technically demanding obligation. The standards landscape:

• C2PA Content Credentials: cryptographically signed metadata embedded in image/video files. Major model providers and content platforms have adopted.
• SynthID (Google DeepMind): a perceptual watermark in images and text. Not yet broadly interoperable.
• Hidden watermarks in audio (e.g., AudioSeal, WavMark): various academic proposals, limited production adoption.
• Provenance metadata in EXIF/IPTC: insufficient on its own; trivially stripped.

Operational pattern for compliance:

1. Implement at least one robust machine-readable marker at the point of generation.
2. Document the standard used.
3. Maintain a public reference allowing third parties to verify markers.
4. Map your controls to the Code of Practice and to the Commission’s Article 50 guidelines, adopted on 20 July 2026 under Article 96(1)(d). The guidelines are non-binding, since only the Court of Justice can give a binding reading of the Act. Watch for any implementing act setting common rules.

The Code of Practice and the EU icons

The Commission and the AI Board found the code adequate for Article 50(2), (4) and (5) in July 2026 (Commission opinion). Non-signatories must show equally adequate means (Commission Q&A). About 190 organisations had signed by the end of July, including Anthropic, Google, Meta, Microsoft, Mistral and OpenAI (Commission). Deployers may label with three optional EU icons: a basic icon, “Fully AI-Generated” and “Partially AI-Modified”.

Article 50 vs the AI Act’s other transparency obligations

Article 50 is not the AI Act’s only transparency duty. The others differ in audience and timing:

High-risk dates follow the Omnibus deferral; the Article 53 date is from FPF. Article 50 alone reaches the public regardless of risk tier, and Article 26(11) applies without prejudice to it.

Article 50 in Dutch, Swedish and Danish

The duties are identical in every language version. The Dutch text heads Article 50 “Transparantieverplichtingen voor aanbieders en gebruiksverantwoordelijken van bepaalde AI-systemen”, the Swedish “Transparensskyldigheter för leverantörer och tillhandahållare av vissa AI-system”, and the Danish “Gennemsigtighedsforpligtelser for udbydere og idriftsættere af visse AI-systemer”. The deployer (gebruiksverantwoordelijke, tillhandahållare, idriftsætter) is the organisation using the system, not the end user. All three keep “deepfake” untranslated.

Deployer responsibilities most often missed

Several Article 50 obligations apply to deployers rather than providers, and these are most often missed:

• Chatbot disclosure when an organisation integrates a third-party model into its own product: it becomes the provider of that chatbot under 50(1) and cannot point to the model vendor.
• Deepfake disclosure under 50(4) for any content shared in commercial or public contexts.
• Public-interest text under 50(4): AI-generated text published to inform the public on matters of public interest needs a disclosure unless a person or organisation holds editorial responsibility after human review.
• Emotion-recognition disclosure when integrating biometric analysis into deployed systems.

A common compliance mistake: assuming the provider’s terms cover the deployer’s obligations. They do not. Deployer obligations attach to the act of deployment.

Sanctions and enforcement

Article 99(4)(g) sets the fines for Article 50 breaches (Article 99):

• Up to €15M or 3% of global annual turnover for general non-compliance (whichever is higher).
• Up to €7.5M or 1% for supplying incorrect or misleading information to authorities.
• For SMEs and start-ups, the lower figure applies (Article 99(6)).
• Up to €750,000 for EU institutions, bodies and agencies (Quick Facts).

Member-state market-surveillance authorities do most of the enforcing. The AI Office covers systems built on a provider’s own general-purpose model and systems in DSA-designated very large platforms (Commission Q&A).

Practical compliance checklist

For an organization deploying any of the in-scope AI systems:

1. Inventory: enumerate every chatbot, generator, emotion-recognition, or biometric system.
2. Classify: identify which Article 50 obligations attach (provider, deployer, or both).
3. Implement disclosure: design and deploy first-contact disclosures for chatbots and machine-readable markers for synthetic content.
4. Choose a route: sign the relevant section of the Code of Practice, or document equally adequate measures of your own.
5. Document: maintain a compliance register documenting which obligations apply, what controls are in place, and what evidence of compliance exists. The DPIA template for LLM deployment is a natural home for the Article 50(3) analysis.
6. Audit: include Article 50 compliance in internal audit cycles.
7. Monitor: track AI Office guidance, interoperability standards, and enforcement actions.

Cross-references

For the Article 53 and 55 obligations on general-purpose AI model providers that operate above Article 50, see the Articles 53 and 55 GPAI provider checklist. For the GDPR overlay on chatbot interactions (lawful basis, transparency, automated decision-making), see GDPR Article 22 and LLM-driven decisions. For the engineering controls that make consistent disclosure tractable across deployments, mlobserve.com’s observability patterns cover the relevant infrastructure layer.

The shape of the obligation

Article 50 is the EU AI Act’s bridge to ordinary users. It’s the regulation that ensures the typical European interacting with AI in commerce, media, or public services knows they are doing so. The technical lift is modest. The institutional lift — making sure every deployment in an organization implements the disclosures — is where the work actually is.

FAQ

does article 50 apply to a chatbot built on a third-party llm?

Yes. Article 50(1) binds the provider of the chatbot system, and an organisation that builds an assistant on a third-party model and runs it under its own name is that provider. It must tell users they are talking to an AI from the first interaction, unless that is obvious to a reasonably well-informed person.

is there a grace period for article 50 of the ai act?

Only one. The AI Omnibus did not postpone Article 50, which has applied since 2 August 2026. Generative systems placed on the market before that date have until 2 December 2026 to apply machine-readable marking under Article 50(2). Deployer labels have no grace period, and content generated before August 2026 needs no retroactive label.

is the code of practice on ai-generated content mandatory?

No. Signing the Code of Practice on Transparency of AI-generated Content is voluntary, but the Article 50 duties it implements are not. The Commission and the AI Board assessed it as adequate in July 2026, so signatories can rely on its measures, while non-signatories must prove equally adequate alternatives and may face more information requests.