EU AI Act Article 50 Transparency Requirements: What Applies on 2 August 2026

Standpoint is a self-assessment and readiness tool. Nothing on this page is legal advice, a certification, or an audit opinion.

What is Article 50 of the EU AI Act?

Article 50 of the EU AI Act is the transparency chapter: it requires that people be told when they are dealing with an AI system, and that AI-generated content be marked as artificially generated. It applies from 2 August 2026, and unlike the Act's high-risk rules it is not limited to a narrow list of sensitive use cases — it reaches almost any system that talks to a person, writes for a person, or shows a person synthetic media.

That is the single most important thing to understand about the current moment. The Digital Omnibus — Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026 — postponed the heavy high-risk obligations under Annex III to 2 December 2027 (and Annex I embedded-AI products to August 2028). Article 50 did not move. It lands on schedule this August, and it is the obligation most likely to touch an ordinary software company.

Who does Article 50 apply to — providers or deployers?

Both, but not for the same things. This is the distinction most summaries blur, and getting it wrong is how a company concludes "we just use a vendor's model, so this isn't ours."

A "provider" develops an AI system and places it on the market under its own name. A "deployer" uses one under its own authority. A SaaS company that wraps a third-party model in its own product and sells it is, for that product, a provider — building on someone else's model does not make you a deployer.

And note the asymmetry: even a pure deployer still owes 50(3) and 50(4). "We only use a vendor's AI" clears you of nothing if you publish AI-written text on matters of public interest, or run emotion recognition on staff or customers.

Does Article 50 apply to my chatbot?

Almost certainly yes, with one narrow escape hatch.

Article 50(1) carves out systems where the AI nature is obvious "from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use." That is a real exemption, but it is a high bar and it is judged from the user's perspective, not yours. A widget branded "AI Assistant" in a developer console probably clears it. A support chat on a consumer site that opens with a human-sounding name almost certainly does not.

The practical test: if a reasonable customer could finish the conversation still believing they spoke to a person, you owe the disclosure.

When must the disclosure be given?

Article 50(5): clearly and distinguishably, at the latest at the time of first interaction or exposure — and in a form that meets applicable accessibility requirements.

This is the cheapest requirement in the whole article and the most commonly failed, because teams put the disclosure in the terms of service instead of in the interface. "At first interaction" means the opening of the conversation, not page 14 of a document nobody opens.

What does "machine-readable marking" actually mean?

Article 50(2) requires generative systems to mark their output so it is detectable as artificially generated or manipulated, using solutions that are "effective, interoperable, robust and reliable as far as this is technically feasible," accounting for content type, cost of implementation, and the acknowledged state of the art.

In practice that points at provenance metadata and watermarking standards — C2PA-style content credentials for images and video, and metadata or statistical watermarking for text and audio. The feasibility qualifier is genuine flexibility, not a loophole: it means the obligation scales to what the state of the art supports for your content type, but it does not excuse doing nothing.

If you build on someone else's model, you inherit their gap. Ask your model vendor, in writing, what provenance marking their output carries and whether it survives your pipeline. Many marking schemes are stripped by re-encoding, resizing, or copy-pasting text.

What are the exemptions to Article 50?

Five, and they are narrower than they look:

1. Obviousness (50(1) only) — the AI nature is obvious to a reasonably well-informed, observant and circumspect person.
2. Law enforcement — systems authorised by law to detect, prevent, investigate or prosecute criminal offences. (Note: for 50(1) this does not extend to systems available to the public for reporting an offence.)
3. Assistive editing (50(2) only) — the system performs an assistive function for standard editing, or does not substantially alter the deployer's input data or its semantics. Spellcheck and grammar correction sit here. A tool that rewrites a paragraph does not.
4. Artistic, creative, satirical or fictional works (50(4)) — the duty is reduced, not removed: you must still disclose that generated or manipulated content exists, in a way that does not hamper enjoyment of the work.
5. Human review with editorial responsibility (50(4) text) — AI-generated text published to inform the public is exempt where it has undergone human review or editorial control and a natural or legal person holds editorial responsibility.

That fifth one is worth reading twice if you publish an AI-assisted blog on regulatory or public-interest topics. Editorial responsibility must actually be held by someone, not assumed.

What did the Commission's Article 50 guidelines change?

On 20 July 2026 the European Commission adopted the final Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 — less than two weeks before the obligations apply. Alongside them sits the Code of Practice on Transparency of AI-Generated Content, which the Commission has assessed as adequate under Article 50(7); the deadline to join as an initial signatory closed 27 July 2026, with Google among those signing.

Two things to hold onto:

• The Guidelines are non-binding. Only the Court of Justice of the European Union can authoritatively interpret the Act. But national market surveillance authorities and the AI Office can be expected to follow them, so in practice they set the operating standard.
• The Code of Practice is voluntary. Signing it is a route to demonstrating compliance with the 50(2) and 50(4) content duties — it is not the obligation itself. Not signing does not put you in breach; ignoring Article 50 does.

Is there a grace period for Article 50?

Partially, and only for one duty. Under the Omnibus arrangement, generative AI systems already placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking requirement in 50(2).

There is no grace period for the disclosure duties. First-interaction disclosure under 50(1), emotion-recognition notice under 50(3), and deepfake/public-interest-text disclosure under 50(4) all apply from 2 August 2026.

What are the penalties for breaching Article 50?

Non-compliance with Article 50 sits in the Act's middle penalty tier: up to €15,000,000 or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(4)).

One founder-relevant detail that rarely gets mentioned: Article 99(6) provides that for SMEs, including start-ups, the fine is capped at the lower of the two figures, not the higher. For a small company that changes the realistic exposure from "3% of turnover" to "up to €15M" — still serious, but a different order of risk than the headline number implies. National authorities also weigh size and the nature of the breach in setting fines.

How do I scope Article 50 in an afternoon?

A four-step scoping pass that a founder or first security hire can run without counsel:

1. Inventory every surface where your product speaks to a user or produces content. Chat, email drafting, summarisation, voice, image generation, autocomplete. That list is your Article 50 scope. One spreadsheet, twenty minutes.
2. Label each row provider or deployer. If you place it on the market under your name, you are the provider — regardless of whose model is underneath.
3. Map each row to the paragraph it triggers (50(1), (2), (3), (4)) using the table above, then check whether an exemption genuinely applies. Write down why, in one sentence.
4. Check the disclosure surface for each row. Visible at first interaction, not in the terms. Accessible. This is the cheapest gap to close and the most frequently open one.

The output isn't compliance. It's the ability to answer a customer's question in one paragraph — which, on 2 August, will be more than most companies can do.

FAQ

Does the EU AI Act Article 50 apply to companies outside the EU?

Yes. The Act applies to providers placing AI systems on the EU market or putting them into service in the EU, and to providers and deployers outside the EU where the system's output is used in the EU — regardless of where the company is established. A US SaaS company with EU customers is in scope.

Does Article 50 require me to label every AI-written email or document?

No. 50(2) is a duty on the provider of the generating system to mark output machine-readably, and 50(4)'s text-disclosure duty applies only to text published to inform the public on matters of public interest. Internal drafts and ordinary business correspondence are not caught by 50(4).

Is Article 50 delayed like the high-risk rules?

No. The Digital Omnibus moved Annex III high-risk obligations to 2 December 2027 and Annex I embedded-AI to August 2028. Article 50 applies from 2 August 2026. The only Article 50 concession is the marking grace period to 2 December 2026 for systems already on the market.

Do I have to sign the Code of Practice on Transparency of AI-Generated Content?

No — it is voluntary. Adherence is one way to demonstrate you meet the 50(2)/50(4) content duties, and the Commission has assessed the Code as adequate under Article 50(7). Your legal obligation is Article 50 itself, signed or not.

What is the difference between Article 13 and Article 50 transparency?

Article 13 is a high-risk obligation: providers must give deployers enough information to use a high-risk system properly. Article 50 is a duty owed to the affected person — the end user or the public. Different audience, different trigger, different timeline.