The Article 50 transparency obligations, explained
Article 50 is the EU AI Act's transparency article: if an AI system talks to people, generates content, produces deepfakes or reads emotion or biometrics, somebody has to say so. It is not a high-risk-only rule. It reaches everyday systems most executives assume are exempt, and it is the one obligation a regulator can verify from the outside, without ever accessing your systems.
Applied since 2 August 2026. A permanent obligation, not a deadline that passed.
This page is the briefing. The working version, with the disclosures, the vendor clauses and the evidence pack, is the Article 50 Readiness Pack.
Who Article 50 applies to
Providers and deployers of certain AI systems, not just high-risk ones. If your organisation builds, brands or uses an AI system that talks to people, generates content, produces deepfakes, or reads emotion or biometrics, Article 50 likely reaches you. Systems released under free and open-source licences are not exempt.
Four duties follow, in duty order. Two sit with providers, two with deployers, and one delivery standard runs across all of them.
What each paragraph of Article 50 requires
Systems that interact with people must disclose they are AI
Providers must design systems that interact directly with people (chatbots, virtual assistants, voice bots, AI agents, avatars) so that the person is informed they are dealing with an AI system. The Commission's Guidelines set four cumulative criteria: it must be an AI system; designed for genuine two-way exchange rather than merely collecting data or returning automated responses; interacting directly rather than through a human intermediary; and with natural persons. Systems operating in the background or machine-to-machine fall outside.
There is an exception where the interaction is obvious, judged from the standpoint of a reasonably well-informed, observant and circumspect person. The Commission states it should be interpreted restrictively, because it removes transparency from the individual.
Synthetic content must be marked in a machine-readable format
Providers of generative AI systems, including general-purpose ones, must mark synthetic audio, image, video and text in a machine-readable format so it is detectable as artificially generated or manipulated.
Several categories fall outside: short sequences of numbers, symbols or letters; source code; outputs communicated exclusively machine-to-machine and processed automatically with no human exposure; and outputs used only in closed-loop industrial and product-development environments, such as film production, unless they are the final output. The obligation also does not apply where the system performs an assistive function for standard editing, or does not substantially alter the input data provided by the deployer or its semantics. A narrow exemption for business-to-business and industrial contexts is envisaged on conditions. Technical feasibility, the specificities of the content type, cost of implementation and the acknowledged state of the art are all relevant.
People exposed to emotion recognition or biometric categorisation must be informed
Deployers of emotion recognition and biometric categorisation systems must inform the people exposed to them that the system is operating. The duty is to disclose the operation of the system, not to explain its purpose. It applies whether the system runs in real time or after the fact.
Check Article 5 first. Emotion inference in the workplace or in education is a prohibited practice save for narrow medical and safety exceptions, and recording a transparency position for a system you are not permitted to run at all documents the wrong conclusion.
Deepfakes and AI-written public-interest text must be labelled
Deployers must disclose deepfake content, and clearly label AI-generated or manipulated text published to inform the public on matters of public interest. A deepfake is defined at Article 3(60) and turns on three cumulative criteria: a high level of resemblance to the subject; a subject that exists, plausibly exists or could plausibly have existed; and content that would falsely appear to a person to be authentic or truthful.
Two exceptions matter. Where a deepfake forms part of an evidently artistic, creative, satirical or fictional work, the disclosure need only be made in a manner that does not hamper enjoyment of the work. And published text that has undergone genuine human review or editorial control does not need labelling. That means deliberate examination of the substance by someone with relevant professional judgement, or control by a responsible editorial entity with authority to approve, alter or reject on substantive grounds. Spell-checking and formatting do not qualify, and a natural or legal person must hold editorial responsibility for the publication.
There is no transition period for this duty.
How the disclosure has to be delivered
Article 50(5) sets the standard for all of them: clearly and distinguishably, at the latest at the point of first interaction or first exposure, and in line with accessibility requirements. It must be understandable and perceivable without the person needing special tools or taking any particular action. A deployer therefore cannot rely on the machine-readable marking a provider embedded under Article 50(2) to satisfy its own disclosure duty: a mark a person cannot see does not inform them.
What applied when, and the one transitional that exists
A limited one, and only for the marking duty. Under Article 111(4), inserted by Regulation (EU) 2026/1744, providers of generative systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the Article 50(2) marking and detection obligation. Three conditions have to hold together: marking only, providers only, and systems already on the market before that date. Anything launched from 2 August onwards carried the duty from day one, and a system that is partly interactive and partly generative takes the extension for its marking limb alone; the Article 50(1) disclosure was due on 2 August regardless.
Content generated before 2 August 2026 does not need retroactive labelling, although the Commission encourages it where feasible. Note the other significance of 2 December 2026: two new Article 5 prohibitions begin that day, at a higher tier of up to €35 million or 7% under Article 99(3), which applies to Article 5 alone and is never combined with the Article 50 tier.
How Article 50 treats AI agents
Yes. The Commission's Guidelines confirm that agentic systems, AI agents, avatars, chatbots and coding agents can all fall within Article 50(1). Where you cannot know in advance whether a person will be on the other end, the Guidelines direct that the system be instructed to disclose itself as AI in every situation where interaction with a person is likely, which makes this an architectural decision rather than an interface one. Traditional closed industrial systems, recommender algorithms, spam filters and automated translation tools are given as examples that do not fall within.
The Code of Practice, and the Guidelines it sits beside
The Code of Practice on Transparency of AI-Generated Content, published 10 June 2026, is a voluntary tool letting providers and deployers demonstrate compliance with the marking and labelling obligations under Article 50(2), (4) and (5). It has been assessed as adequate by both the Commission and the AI Board, so signatories gain legal certainty and predictability regardless of where they are established or which authority supervises them.
It is not conclusive proof of compliance. Recital 41 of Regulation (EU) 2026/1744 records that such codes have limited legal effect and, in particular, do not grant a presumption of conformity. The duty to demonstrate compliance stays with you either way. Organisations that decide not to adhere must demonstrate compliance by alternative adequate means, and the Commission notes they may face more requests for information, since there is less transparency about how they comply. For the other duties, Article 50(1) and 50(3), you determine adequate measures yourself, taking the Guidelines into account.
Do the Guidelines change what you have to do?
They tighten the reading. The Commission approved their content on 20 July 2026. They narrow the obviousness exception, publish disclosure methods that do not count (burial in terms and conditions, a machine-readable signal alone, a generic “assistant” label, a site-wide notice), and confirm a deployer cannot rely on a provider's marking to satisfy its own labelling duty.
They are formally non-binding, issued under Article 96(1)(d), and only the Court of Justice of the European Union can give an authoritative interpretation of the Act. In practice national market surveillance authorities are expected to follow them closely, so the sensible position is to treat them as the standard you will be measured against while recording that they are guidance rather than law.
Who enforces Article 50, and what it costs to get wrong
Mainly your national market surveillance authority, holding the standard product-safety powers under Regulation (EU) 2019/1020. They can act on their own initiative or on a complaint. The AI Office has a narrower competence: AI systems built on a general-purpose AI model where the same entity provides both the system and the model, and systems integrated into a very large online platform or search engine designated under the Digital Services Act. The European Data Protection Supervisor enforces against EU institutions and bodies. Regulation (EU) 2026/1744 also gave the AI Office new powers including on-site inspection, sealing of premises, and periodic penalty payments.
The penalty
Up to €15 million or 3% of total worldwide annual turnover, whichever is higher, under Article 99(4). For SMEs and start-ups Article 99(6) inverts that to whichever is lower; Article 99(6a) applies the same inversion to small mid-cap enterprises. Fines are ceilings, not tariffs; the authority still applies the proportionality factors in Article 99 and its own national procedure.
Knowing the duties is the smaller half
Everything above tells you what Article 50 requires. It does not tell you which of your systems trigger it, which role you hold for each one, what your disclosures should say, or what to have on file for the day an authority asks. That determination work is what the Article 50 Readiness Pack does: scope and role determination, paste-ready disclosures, vendor and contract clauses, the Code of Practice decision and an audit-ready evidence pack, self-serve inside the platform.