Article 50 of the EU AI Act sets transparency duties for AI that talks to people or creates content. From 2 August 2026, providers must make chatbots identify themselves and mark synthetic output in machine-readable form, and deployers must disclose emotion recognition, biometric categorisation, deepfakes and AI-written public-interest text. The Digital Omnibus did not delay these rules.
Key takeaways
- Article 50 has four core duties: AI interaction disclosure (50(1)), machine-readable marking of generated content (50(2)), notice of emotion recognition and biometric categorisation (50(3)), and labelling of deepfakes and AI-generated public-interest text (50(4)).
- Paragraphs 1 and 2 fall on providers; paragraphs 3 and 4 fall on deployers. Many organisations are both.
- The duties apply from 2 August 2026. Only providers of generative systems already on the market before that date get extra time, until 2 December 2026, for machine-readable marking.
- A voluntary Commission Code of Practice on marking and labelling AI-generated content was published in June 2026; signing it is optional, compliance with Article 50 is not.
- Breaches can cost up to €15 million or 3% of worldwide annual turnover, whichever is higher (the lower figure for SMEs).
What Article 50 is for
The AI Act sorts AI by risk. Most chatbots, image generators and writing assistants are not high-risk, but they can still mislead people. Article 50 is the rulebook for that middle band, often called "limited" or "transparency" risk. If you need a refresher on where this sits among the four tiers, see the EU AI Act risk classification explained, and for the regulation as a whole, read our EU AI Act guide.
Article 50 runs in parallel with other rules. Paragraph 6 states that it does not replace the high-risk requirements in Chapter III or any other transparency duty under EU or national law, so a high-risk HR chatbot must meet both sets. The legal text is in Regulation (EU) 2024/1689 on EUR-Lex; a readable version of the article is on artificialintelligenceact.eu.
The quickest way to find out which of your AI uses trigger these duties is to list them and answer a structured set of questions. Opsio's free EU AI Act readiness assessment does exactly that and turns your answers into an AI acceptable use policy and an AI risk assessment you can edit.
Need help with cloud?
Book a free 30-minute meeting with one of our cloud specialists. We'll analyse your situation and provide actionable recommendations — no obligation, no cost.
The four Article 50 duties at a glance
| Paragraph | Duty | Who | Main exceptions |
|---|---|---|---|
| 50(1) | Design AI that interacts with people so they know they are dealing with AI | Provider | Obvious from context to a reasonably well-informed person; systems authorised by law for criminal investigation (unless open to the public for reporting crimes) |
| 50(2) | Mark synthetic audio, image, video and text in a machine-readable, detectable way | Provider (including providers of general-purpose AI systems) | Assistive standard editing; output that does not substantially alter the input; law-enforcement use authorised by law |
| 50(3) | Inform people exposed to emotion recognition or biometric categorisation | Deployer | Uses permitted by law to detect, prevent or investigate crime, with safeguards |
| 50(4) | Disclose deepfakes; disclose AI-generated or manipulated text published to inform the public on matters of public interest | Deployer | Lighter disclosure for evidently artistic, satirical or fictional work; text that has had human review and sits under someone's editorial responsibility; law-enforcement use |
Paragraph 5 adds the "how": the information must be clear and distinguishable, given at the latest at the first interaction or exposure, and meet applicable accessibility requirements.
Article 50(1): tell people they are talking to AI
If you build or place on the market an AI system that interacts directly with people, you must design it so that users are told they are dealing with AI. The duty sits with the provider, meaning the company that develops the system or has it developed and puts it on the market under its own name.
Example: a website chatbot. A retailer builds a customer-service assistant on top of a large language model API and deploys it on its own website under its own brand. Because the retailer puts the system into service under its name, it is the provider of that chatbot for Article 50 purposes, not just a deployer. A first message such as "You are chatting with an AI assistant. You can ask for a human at any time" handles the duty. Burying the notice in the terms of use does not, because it must reach the user at the first interaction.
The "obvious from context" exception is narrow. A talking robot in a museum might qualify; a text chat window that looks like every human live-chat tool will not. When in doubt, disclose. Whether you count as provider or deployer turns on whose name the system carries, not whose model sits underneath.
Article 50(2): machine-readable marking of AI output
Providers of systems that generate synthetic audio, images, video or text must mark the output in a machine-readable format so it can be detected as artificially generated or manipulated. The technical solution must be effective, interoperable, robust and reliable, as far as technically feasible, taking account of content type, cost and the state of the art. Watermarks, metadata, cryptographic provenance and fingerprinting are the usual building blocks.
This duty explicitly covers providers of general-purpose AI systems, which is why model and platform providers are investing in provenance standards. For how this interacts with the separate GPAI model rules, see general-purpose AI (GPAI) obligations.
Legacy grace period. The Digital Omnibus on AI (Regulation (EU) 2026/1744) kept 2 August 2026 as the start date for Article 50 but gave providers of generative systems placed on the market before that date until 2 December 2026 to implement machine-readable marking. New systems launched on or after 2 August 2026 get no grace. The wider package of changes is covered in what the Digital Omnibus changed.
Article 50(3): emotion recognition and biometric categorisation
Deployers who use an emotion recognition system or a biometric categorisation system must inform the people exposed to it about how the system works, and process the personal data in line with the GDPR and related EU law. Typical cases are call-centre sentiment analytics or in-store cameras that estimate age bands.
Two cautions. First, emotion recognition in the workplace and in education is prohibited under Article 5 except for medical or safety reasons, so a notice cannot rescue it. Second, many biometric systems are high-risk under Annex III, which brings far heavier duties on top of this notice. Article 50(3) is the floor, not the full answer.
Article 50(4): deepfakes and AI-generated public-interest text
Deployers that generate or manipulate image, audio or video content constituting a deepfake must disclose that it is artificially generated or manipulated. A deepfake, in the Act's terms, is content that resembles real people, objects, places, entities or events and would falsely appear authentic or truthful.
Example: a marketing team generating images. A product shot of a sofa in a generated living room is usually not a deepfake, because it does not falsely depict a real person or event. A generated video of your real CEO announcing a price cut, or a "customer testimonial" voiced by a cloned voice, is. Those need a clear label. Where the work is evidently creative or satirical, the disclosure can be limited to stating that generated content exists, in a way that does not spoil the work.
The second limb covers text. A deployer that publishes AI-generated or manipulated text to inform the public on matters of public interest must disclose it, unless the text has undergone human review or editorial control and a natural or legal person holds editorial responsibility for the publication.
Example: a newsroom. A local news site uses AI to draft summaries of council meetings. If an editor reviews each piece and the publisher takes editorial responsibility, the exception applies. If the site auto-publishes AI summaries with no human check, each one needs a disclosure. The same logic applies to a corporate blog about public policy or a public body's information page.
These rules are easiest to follow when your internal policy states them plainly. Our AI acceptable use policy template includes sample clauses on labelling generated content.
The Code of Practice on transparency of AI-generated content
Article 50(7) asks the Commission to encourage codes of practice on detecting, marking and labelling AI-generated content. The AI Office ran that process through 2025 and early 2026, and the Commission published the final Code of Practice on marking and labelling AI-generated content in June 2026.
As of October 2026, the position is:
- The Code has two sections that can be signed separately: one for providers (marking and detection) and one for deployers (labelling deepfakes and certain AI-generated text, including a common set of EU icons).
- Signing is voluntary. Not signing is not a breach, but non-signatories must show compliance with Article 50 by other means.
- The Commission and the AI Board have confirmed the Code is an adequate voluntary tool for demonstrating compliance, and about 190 organisations had signed it by the end of July 2026.
- Draft Commission guidelines on Article 50 were published for consultation on 8 May 2026; check the Commission page for the final version.
Timeline and penalties
| Date | What happens |
|---|---|
| 2 August 2026 | Article 50 applies to all providers and deployers in scope |
| 2 December 2026 | End of the marking grace period for generative systems placed on the market before 2 August 2026 |
Non-compliance with Article 50 falls in the middle penalty band of Article 99: up to €15 million or 3% of total worldwide annual turnover, whichever is higher, and the lower of the two for SMEs and start-ups. National market surveillance authorities enforce it. See the full EU AI Act timeline for how this date sits among the other deadlines, and EU AI Act penalties and fines for how authorities set amounts.
A five-step Article 50 checklist
- List every system that talks or generates. Chatbots, voice bots, copilots, image and video tools, writing assistants, analytics using voice or face.
- Assign the role per system. Did you build it or brand it as your own (provider), or are you using someone else's tool (deployer)?
- Map each to a paragraph. 50(1) for interactive systems, 50(2) for generators you provide, 50(3) for emotion or biometric analytics, 50(4) for published deepfakes and public-interest text.
- Write the disclosure and the workflow. First-message chatbot notices, label wording and icons, editorial review steps for published text, and vendor contract clauses on marking.
- Keep evidence. Screenshots of notices, vendor statements on watermarking, editorial sign-off records. Authorities will ask how you comply, not whether you meant to.
Frequently asked questions
What is Article 50 of the EU AI Act?
Article 50 is the AI Act's transparency article. It requires providers to make AI that interacts with people disclose itself and to mark synthetic content in machine-readable form, and requires deployers to inform people about emotion recognition or biometric categorisation and to label deepfakes and AI-generated text published on matters of public interest. It applies from 2 August 2026.
Was Article 50 delayed by the Digital Omnibus?
No. The Digital Omnibus (Regulation (EU) 2026/1744) moved the high-risk deadlines but kept 2 August 2026 for Article 50. The only relief is for providers of generative systems already on the market before that date, who have until 2 December 2026 to put machine-readable marking in place.
Do I need to label every AI-generated image my marketing team creates?
Not necessarily. The deployer labelling duty in Article 50(4) targets deepfakes: content that resembles real people, places or events and would falsely appear authentic. A generated illustration usually is not one. The provider of the image tool must still mark its output in machine-readable form under Article 50(2), so check that your vendor does.
Does a website chatbot need to say it is AI?
Yes, unless that is obvious from the context to a reasonably well-informed user, which is rare for text chat. The notice should appear at the first interaction, be clear and be accessible. If you built the chatbot and run it under your brand, the duty is yours as provider; if you embed a vendor's assistant unchanged, check that the vendor has designed it in.
Is signing the Code of Practice on AI-generated content mandatory?
No. The Code is voluntary and has separate sections for providers and deployers. The Commission and the AI Board have confirmed it is an adequate tool, so signatories can rely on it to demonstrate compliance. Organisations that do not sign must still meet Article 50 and be ready to show how they do it.
Check your transparency duties in 40 minutes
Most organisations discover Article 50 exposure they did not expect: a vendor chatbot nobody listed, a marketing video with a cloned voice, an auto-published newsletter. Opsio's AI Act gap assessment walks you through 14 steps of questions, scores your maturity across ten governance areas and writes four editable Word documents from your answers: an AI governance framework, an AI acceptable use policy, an AI vendor due diligence checklist and an AI risk assessment template. It is free, needs no card and the documents are yours.
This article is general information, not legal advice. Check the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Date-sensitive statements are correct as of October 2026.
Written By
Country Manager, India
Praveena leads Opsio's India operations, bringing 17+ years of cross-industry experience spanning AI, manufacturing, DevOps, and managed services.
Editorial standards: This article was written by cloud practitioners and reviewed by our engineering team. We revise it when the technology or regulation it covers changes; the dates on this page show the latest update. Opsio maintains editorial independence.