Home › AI Governance Insights › EU AI Act Article 50: Transparency Duties and the Controls That Meet Them
EU AI Act Article 50: Transparency Duties and the Controls That Meet Them
By F. Jay Hall and Stephan Pochet, AI Governance Essentials · November 4, 2026 · 10 min read
In short: Article 50 of the EU AI Act sets transparency duties for certain AI systems. Providers must tell people when they are talking to an AI system and must mark AI-generated content in a machine-readable way. Deployers must tell people when emotion recognition or biometric categorization is used on them, and must disclose deepfakes and AI-generated text published to inform the public on matters of public interest. Article 50 applies from August 2, 2026. Generative AI systems already on the market before that date have until December 2, 2026 to meet the marking duty in Article 50(2).
Last checked against the official texts on November 4, 2026. This is a practical explainer, not legal advice. Sections are marked The law or Our suggested workflow so you can tell a legal requirement from a working method.
The law: what Article 50 requires
The duties come from Article 50 of Regulation (EU) 2024/1689, the AI Act. Paragraph 7 was replaced by the Digital Omnibus on AI, Regulation (EU) 2026/1744. The table summarizes the paragraphs; the official text controls.
| Paragraph | Who | Duty | Main exceptions |
|---|---|---|---|
| 50(1) | Providers of AI systems that interact directly with people | Design the system so people are told they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person. | Systems authorized by law to detect, prevent, investigate or prosecute criminal offences, unless they are available for the public to report a crime. |
| 50(2) | Providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text | Mark outputs in a machine-readable format and make them detectable as artificially generated or manipulated, using technical solutions that the Act requires to be “effective, interoperable, robust and reliable” as far as technically feasible. | Assistive functions for standard editing; systems that do not substantially alter the input data or its meaning; uses authorized by law for criminal offences. |
| 50(3) | Deployers of emotion recognition or biometric categorization systems | Inform the people exposed to the system that it is operating, and process personal data under the GDPR and related EU data protection law. | Uses permitted by law to detect, prevent or investigate criminal offences, with safeguards. |
| 50(4) | Deployers of AI that creates deepfakes, or that generates or manipulates text published to inform the public on matters of public interest | Disclose that the content was artificially generated or manipulated. | For evidently artistic, creative, satirical or fictional works, disclosure may be limited so it does not spoil the work. Text is exempt if it has had human review or editorial control and someone holds editorial responsibility. Uses authorized by law for criminal offences. |
| 50(5) | All of the above | Give the information clearly and distinguishably, at the latest at the first interaction or exposure, and in line with accessibility requirements. |
Paragraph 6 adds that these duties sit alongside the high-risk rules in Chapter III and any other EU or national transparency law. They do not replace them. Paragraph 7, as amended, asks the Commission to encourage codes of practice on detecting, marking and labeling AI-generated content, to assess whether they are adequate, and allows it to set common rules by implementing act if a code falls short.
The law: the dates
- August 2, 2026. The AI Act's general date of application under Article 113, which covers Article 50.
- July 27, 2026. Regulation (EU) 2026/1744, adopted on July 8, 2026 and published in the Official Journal on July 24, 2026, entered into force on the third day after publication.
- December 2, 2026. New Article 111(4), added by Regulation (EU) 2026/1744: providers of generative AI systems placed on the market before August 2, 2026 must comply with Article 50(2) by this date.
The Commission's Article 50 FAQ adds that content generated before August 2, 2026 does not have to be labeled after the fact, although the Commission encourages deployers to do so where possible. That is guidance, not text in the Regulation.
Who is a provider and who is a deployer
Article 3 defines a provider as whoever develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, paid or free. A deployer is whoever uses an AI system under its authority, except for personal, non-professional use. One organisation can be both: a company that builds its own chatbot is the provider of that chatbot and the deployer of an image generator it licenses for marketing.
The Commission's FAQ explains three points that often come up. Employees acting for their employer are not separate deployers; the employer is. A legal person stays the deployer even when contractors operate the system for it. And a person who uses AI in a personal capacity is outside the Act, but someone who earns from that activity on a regular basis is treated as a deployer.
| Duty | Provider | Deployer |
|---|---|---|
| Tell people they are interacting with AI (50(1)) | Yes: design the system to do it | Not under 50(1), though deployers often own the channel where the notice appears |
| Machine-readable marking of outputs (50(2)) | Yes | No marking duty |
| Inform people about emotion recognition or biometric categorization (50(3)) | No | Yes |
| Disclose deepfakes and certain public-interest text (50(4)) | No | Yes |
Visible disclosure and machine-readable marking are different things
Marking under Article 50(2) is technical and aimed at detection tools. Disclosure under Article 50(4) is aimed at people. The Commission's FAQ says deployers cannot rely on a provider's embedded marking to meet their disclosure duty: the label has to be perceivable by a person, for example a visible or audible label, without special tools.
To help, the EU has published a set of icons that deployers may use to label AI-generated content. They form part of Section 2 of the Code of Practice and come in four variations: black, white, and each at 50 percent transparency.
What the Commission's guidance clarifies
The Commission published guidelines on the Article 50 transparency obligations and a FAQ that summarizes them. Among the points the FAQ sets out:
- Interacting systems. Article 50(1) applies when four criteria are met together: it is an AI system, it is designed for a genuine two-way exchange, the interaction is direct rather than through a human, and the other party is a natural person. Systems running only in the background or machine to machine are outside it. The exception for cases where AI interaction is obvious is to be read narrowly.
- Marking scope. Some outputs fall outside the marking duty, such as a short sequence of numbers, symbols or letters, code exchanged only between machines without human exposure, and outputs used only inside closed industrial or production loops unless they are the final output. The FAQ also describes a narrow exemption for certain business-to-business or industrial uses, subject to conditions in the guidelines.
- Deepfakes. Three criteria must be met together: resemblance, to something that exists or plausibly could, and a false appearance of being authentic or truthful. The guidance lets deployers weigh the context and the expected audience.
- Public-interest text. The text must be published, informative to the public, and on a matter of public interest. Human review means a deliberate check of substance by someone with relevant knowledge. Spell-checks and formal checks do not count.
The Code of Practice
The Code of Practice on Transparency of AI-generated Content was published in June 2026. It has two sections: one for providers on marking and detection, and one for deployers on labeling deepfakes and AI-generated text. On July 8, 2026 the Commission concluded that the code adequately covers the obligations in Article 50(2), (4) and (5), and the AI Board adopted its own adequacy assessment the following day.
Signing is voluntary. The legal obligations are not. The Commission states that adherence to the code is not conclusive evidence of compliance, and that providers and deployers who do not sign must show compliance through other adequate means, which may bring more requests for information. For Article 50(1) and (3), organisations decide their own measures, taking the guidelines into account.
The law: enforcement
According to the Commission's FAQ, national market surveillance authorities enforce Article 50 for most systems. The AI Office has a limited role for AI systems built on a general-purpose AI model by the same provider, or integrated into a very large online platform or search engine designated under the Digital Services Act. The European Data Protection Supervisor covers EU institutions. The FAQ states that fines can reach 15 million euros or 3 percent of total worldwide annual turnover, with proportionality for SMEs and small mid-caps.
Our suggested workflow (not a legal requirement)
This is the working method we suggest to teams putting Article 50 into practice. It is not required by the Act or the guidance. Adapt it to your organisation and your legal advice.
- Make an applicability decision for each system. Record which role you hold for the system, which paragraphs apply, and any exception you rely on with your reasoning. Have counsel confirm the close calls.
- Name an owner for each duty. Typically the product owner for disclosure in the interface and for marking, the communications or editorial lead for labels on published content, and the privacy lead for emotion recognition and biometric categorization notices.
- Write the control. For example: an AI disclosure at the start of every session on every channel; marking turned on for every output type, with a detection test; a label placed where a viewer first sees a deepfake; a logged editorial review for public-interest text that relies on the exemption.
- Keep evidence. Screenshots of live notices by channel, marking configuration and detection test results, label placement, editorial sign-off records, and, if you signed it, your Code of Practice signature.
- Test what users actually see. Check the notice on every channel, including mobile and voice; check it is accessible; check a label can be seen without any tool; add these checks to release testing so a redesign cannot quietly drop them.
- Set review triggers. A new channel, a model or vendor change, a new content type, or new guidance from the Commission should send the system back through step 1.
Who does this work
Article 50 work usually lands with AI compliance analysts, who map the duty to controls and keep the evidence, and AI governance analysts, who record the applicability decision for each system. For the wider Act, see The EU AI Act, Explained and our EU AI Act hub. Open roles are on our EU AI Act jobs page.
Sources
- Regulation (EU) 2024/1689 (AI Act), Articles 3, 50 and 113, EUR-Lex: eur-lex.europa.eu/eli/reg/2024/1689/oj
- Regulation (EU) 2026/1744 (Digital Omnibus on AI) of July 8, 2026, Article 1 points (20) and (39) to (40) and Article 4, EUR-Lex: eur-lex.europa.eu/eli/reg/2026/1744/oj
- Guidelines on transparency obligations for providers and deployers of certain AI systems, European Commission (page last updated August 6, 2026)
- Transparency obligations under Article 50 of the AI Act, Commission FAQ (last updated July 24, 2026)
- Code of Practice on Transparency of AI-generated Content, Commission page (last updated October 19, 2026), and the Commission Opinion on its assessment (last updated July 31, 2026)
- EU icons for AI-generated content, Commission page (last updated October 13, 2026)
Frequently Asked Questions
When does Article 50 of the EU AI Act apply?
From August 2, 2026. Providers of generative AI systems that were already on the market before that date have until December 2, 2026 to meet the marking duty in Article 50(2), under Article 111(4) as added by Regulation (EU) 2026/1744.
Does Article 50 apply to chatbots?
Yes, when the chatbot interacts directly with people. Article 50(1) requires providers to design it so people are told they are interacting with an AI system, unless that is obvious from the context.
Do deployers have to watermark AI-generated content?
No. Machine-readable marking under Article 50(2) is a provider duty. Deployers have a different duty under Article 50(4): to disclose deepfakes and certain AI-generated text in a way people can see or hear. The Commission says deployers cannot rely on the provider's embedded marking for that.
Is signing the Code of Practice on Transparency of AI-generated Content mandatory?
No. Signing is voluntary, but the Article 50 obligations are legal requirements. The Commission says those who do not sign must show compliance through other adequate means.
- Founder of ExecSearches and GRC Careers
- Executive search across corporate, higher education, financial services, and nonprofit sectors
- Focus on AI governance and GRC hiring
- More than a decade in risk advisory and internal audit in financial services
- Led SOX and regulatory audits for Citi, Goldman Sachs, Morgan Stanley, and McKesson
- Public Accounting Certification, Cornell University
Who's Hiring AI Governance Professionals?
Explore current openings in:
AI Governance Jobs · Responsible AI · AI Risk · AI Compliance · AI Audit · AI Policy · Privacy · Cybersecurity · Public Policy
Search the latest opportunities at GRC Careers › · nonprofit GRC jobs ›