EU AI Act Article 50: the transparency rules, in plain English.
Since August 2, 2026, a chatbot serving EU users must say it is AI, AI-generated media must carry a machine-readable mark, and deepfakes need a visible label. The rules reach businesses outside the EU, the fines reach €15 million, and most SMBs have never read the article. Here is what it actually says, who it applies to, and an EU AI Act compliance checklist you can work through in an afternoon.
- In force since 2 Aug 2026
- Applies to non-EU businesses
- Up to €15M or 3% of turnover
- Not legal advice
Facts verified against the consolidated Act, the Commission’s Article 50 guidelines (July 2026) and the Code of Practice (June 2026): October 2026. We are engineers, not attorneys — confirm your position with counsel.
Article 50 applied on schedule. The Digital Omnibus delayed the high-risk rules — not transparency.
Two for providers (chatbot disclosure, machine-readable marking), two for deployers (emotion recognition, deepfakes and public-interest text).
Maximum fine for Article 50 breaches, whichever is higher. For SMEs and start-ups: whichever is lower.
Deadline for generative systems already on the market before August 2026 to add machine-readable marking.
The four duties in Article 50
Paraphrased from the consolidated text of Regulation (EU) 2024/1689. All four kick in “at the latest at the time of the first interaction or exposure”, in a clear and distinguishable manner (Article 50(5)).
Chatbots must disclose they are AI — Article 50(1)
Who: the provider of any AI system intended to interact directly with people. What: design it so users are informed they are dealing with an AI system. The only exemption is where that is obvious to a “reasonably well-informed, observant and circumspect” person — and the Commission’s guidelines read that narrowly: a coding assistant for professional developers may qualify; a support chatbot on a website serving the general public does not.
AI-generated media must be machine-readably marked — Article 50(2)
Who: providers of systems that generate synthetic audio, image, video or text, including general-purpose systems. What: outputs must be “marked in a machine-readable format and detectable as artificially generated or manipulated”, as far as technically feasible. The Code of Practice translates this into at least two layers: signed, tamper-evident metadata plus an imperceptible watermark. Assistive editing that does not substantially change the input is exempt.
Emotion recognition and biometric categorisation must be announced — Article 50(3)
Who: deployers — the business using the system. What: inform the people exposed to it that the system is operating, and process their personal data under the GDPR. Rare on SMB websites, but “sentiment detection” features in call-centre and video tools can fall here. Note that emotion inference in workplaces and education is outright prohibited under Article 5.
Deepfakes and AI-written public-interest text must be labelled — Article 50(4)
Who: deployers again. What: disclose that image, audio or video constituting a deepfake was artificially generated or manipulated; and disclose AI-generated text “published with the purpose of informing the public on matters of public interest”. Two exemptions: evidently artistic or satirical works need only a disclosure that does not spoil the work, and text that went through human editorial control with a named person holding editorial responsibility is exempt.
Provider or deployer? Decide this first.
The Act attaches duties to roles, not to company size or location. The definitions in Article 3 and the Commission’s guidelines are clearer than most summaries suggest.
Switched on a vendor’s bot unmodified? You are the deployer.
Intercom, Zendesk, Shopify Inbox and similar vendors are the providers of their AI agents and own the 50(1) disclosure design. Your job is to not hide, override or rebrand it away — and to handle any 50(4) content you publish.
Built your own bot on the OpenAI or Anthropic API? You are the provider.
Article 3(3): whoever has an AI system developed and puts it into service “under its own name or trademark” is its provider. OpenAI’s duties as a model provider (Articles 53–55) do not cover your interface. The disclosure has to be designed into your product.
Outside the EU does not mean outside the Act.
Article 2(1)(c): providers and deployers established in a third country are in scope where the output of the AI system is used in the Union. A US SaaS with EU customers is in. Incidental, unauthorised use by someone in the EU is, per the guidelines, not enough on its own.
“Everyone knows it’s a bot” will not fly.
The July 2026 guidelines say the obviousness exemption applies only where “there is almost no doubt left”, calibrated to the foreseeable audience — and it cannot be relied on where minors, older people or persons with disabilities may be among the users. That describes every public website.
Generic labels do not count as disclosure.
Naming the bot “Assistant”, writing “this system uses LLMs”, burying the notice in the terms, or making it machine-readable only — the guidelines list all of these as insufficient. The system must also admit it is AI whenever a user asks.
AI agents must say whose agent they are.
The guidelines (point 31) require agents that may interact with humans to disclose both that they are artificial and on whose behalf they act — each agent independently in a multi-agent setup. Perceptible outputs are marked; API calls and intermediate reasoning are not.
What applies when — after the Digital Omnibus
The Omnibus (Regulation (EU) 2026/1744) was adopted on June 16 and 29, 2026, published July 24 and in force July 27. It moved the high-risk deadlines. It did not move Article 50.
- 2 Feb 2025
Prohibited practices and AI literacy
Article 5 bans (manipulation, social scoring, workplace emotion inference, untargeted face scraping) and the Article 4 AI-literacy duty apply.
- 2 Aug 2025
Governance and general-purpose models
Obligations for general-purpose AI model providers apply; Member States must publish the contact details of their competent authorities.
- 10 Jun 2026
Code of Practice on marking and labelling
Final version published by the Commission; found adequate by the Commission and the AI Board on July 8–9; about 190 signatories by July 31, including OpenAI, Google, Meta, Microsoft, Anthropic and Mistral.
- 20 Jul 2026
Commission guidelines on Article 50
C(2026) 5054: 51 pages on chatbot disclosure, the obviousness test, agents, deepfakes and the editorial exemption. Non-binding, but the reading national authorities will start from.
- 2 Aug 2026
Article 50 appliesNow
Chatbot disclosure, machine-readable marking for new generative systems, emotion-recognition notices and deepfake/public-interest text labels become enforceable by national market surveillance authorities.
- 2 Dec 2026
Marking deadline for existing systems
New Article 111(4): generative systems placed on the market before August 2, 2026 must comply with 50(2) marking. The same day, two new Article 5 prohibitions apply (AI generating non-consensual intimate imagery or child sexual abuse material).
- 2 Feb 2027
Watermark interoperability
Code of Practice signatories committed to an interoperable solution for watermark detection by this date. A commitment, not a statutory deadline.
- 2 Dec 2027
High-risk rules, Annex III
Stand-alone high-risk systems (recruitment, credit scoring, education, essential services) — the deadline the Omnibus moved from August 2026. Annex I product-embedded AI follows on August 2, 2028; public-authority systems on August 2, 2030.
What passes and what does not — per the Commission guidelines
The July 2026 guidelines give examples. Use this as the standard your chatbot is measured against.
| Practice | Verdict | Why |
|---|---|---|
| “Hi, I’m an AI assistant for [brand]. A human can take over any time.” as the first message | Passes | Clear, at first interaction, names the artificial nature and on whose behalf it acts (guidelines point 31 for agents). |
| A bot called “Sarah” with a stock photo | Fails | Actively suggests a human; the guidelines treat concealment as the paradigm breach. |
| Bot named “Assistant”, no further notice | Fails | Listed in the guidelines as a generic label that does not inform users. |
| Disclosure in the Terms of Service only | Fails | Disclosures buried in terms or privacy policies are explicitly insufficient. |
| Disclosure only as a machine-readable flag | Fails | 50(1) is about informing the natural person; 50(2) marking is a separate duty. |
| Bot denies being AI when asked “are you a human?” | Fails | Systems must disclose their AI nature whenever a user asks. |
| Reminder of AI nature during long or emotional conversations | Expected | Guidelines call periodic, context-aware reminders “likely necessary” for children, older people and attachment-prone interactions. |
| AI icon with “AI-generated” descriptor on a synthetic product image | Passes | The harmonised EU “AI” icon from the Code of Practice is sufficient on its own; descriptors are encouraged. |
Examples paraphrase the Commission guidelines C(2026) 5054 and the Code of Practice; wording is ours, not the Commission’s.
Eight steps to Article 50 compliance
The order matters: you cannot pick the right duties until you know which AI systems you run and which role you hold for each. Most SMBs finish steps 1–6 in days, not months.
- 01
Inventory every AI system that touches EU users
Website chatbot, support agent, voice bot, image generator in the marketing stack, AI copywriting, video tools, “sentiment” features in your call software. Include the ones a team member switched on without asking — the inventory is also the first control in the NIST AI RMF and ISO/IEC 42001.
- 02
Assign a role per system: provider, deployer or both
Vendor tool used as shipped: deployer. Built on an API under your brand: provider. Publishing AI-generated media or public-interest text: deployer under 50(4) regardless. Write the answer down next to each system.
- 03
Design the chatbot disclosure in — then test it
First message states it is AI and whose AI it is; a route to a human is always visible; the bot admits it is AI when asked; reminders in long sessions. Test with the literal question “are you a human?”.
- 04
Handle marking (50(2)) if you are a provider
Use a model or platform whose outputs carry signed metadata and a watermark, do not strip them, and pass them through to the user. Systems live before August 2, 2026 must comply by December 2, 2026.
- 05
Label what you publish (50(4)) if you are a deployer
Deepfake-style images, audio and video: visible “AI” icon or equivalent at first exposure. AI-written text on public-interest topics: label it, or run it through documented human editorial control with a named responsible person and public contact details.
- 06
Cover the AI-literacy duty (Article 4)
In force since February 2025, softened by the Omnibus to “take measures to support the development of AI literacy” — no guaranteed level required. A short internal training plus a written AI-use policy, with attendance recorded, is proportionate for an SMB.
- 07
Fix your vendor contracts
Ask each AI vendor in writing which Article 50 duties they cover, whether their outputs are marked, and whether they signed the Code of Practice. If they cannot answer, that is your answer.
- 08
Know your authority and keep records
Enforcement is national: Spain’s AESIA, Italy’s ACN, Ireland’s fifteen sectoral bodies, Germany’s Bundesnetzagentur (pending). Keep the inventory, role decisions, disclosure screenshots and training records in one folder — Article 99(5) separately fines incomplete or misleading answers to authorities.
Similar rules elsewhere
If you serve customers in these places, the EU design usually satisfies them too. One line each, with the status as of October 2026.
California — AI Transparency Act (SB 942)
Operative since August 2, 2026 (delayed from January by AB 853). Covers generative-AI providers with over one million monthly users: free detection tool, manifest and latent disclosures, $5,000 per violation per day. Platforms must detect provenance data from January 1, 2027.
California — B.O.T. Act (2019)
Unlawful to use a bot to mislead people about its artificial identity to incentivise a purchase or influence a vote; safe harbour for a clear, conspicuous disclosure. Applies to platforms with ten million or more monthly US visitors.
Utah — AI Policy Act (amended 2025)
Since May 2025, disclosure that a consumer is talking to generative AI is required on a clear request, plus upfront disclosure for high-risk interactions with regulated professions. Sunset extended to July 2027.
Colorado — repealed and replaced
The 2024 Colorado AI Act never took effect: it was delayed to June 2026, then repealed by SB 26-189 (May 2026) and replaced with a narrower automated-decision notice-and-records regime that applies from January 1, 2027.
United Kingdom — no AI Act
Sector regulators (ICO, FCA, Ofcom, CMA) apply the 2023 white-paper principles; a cross-sector AI bill did not appear in 2025 and looks unlikely in the near term. The GDPR-based transparency duties still apply.
Enforcement so far
No fine under the AI Act had been issued as of October 2026. The first live action is the AI Office’s information requests to OpenAI and Anthropic over agent incidents — under the general-purpose model rules, not Article 50. The GDPR precedent stands: Italy fined OpenAI €15 million in December 2024, partly for transparency failures.
Article 50 is one row on the scorecard.
Our free AI readiness assessment flags exactly which Article 50 duties touch your business and website, alongside data, governance and the rest. Flagged for your lawyer, fixed by our engineers.
Get the free AI readiness assessmentAI use policy template·AI readiness checklist·AI agents we build — disclosed by design
Questions SMBs actually ask
- Does Article 50 apply to a small business outside the EU?
- If the output of your AI system is used in the EU — a chatbot answering an EU visitor, an AI-generated image shown to EU customers — yes, under Article 2(1)(c), regardless of where you are established. Size does not exempt you either: the Act’s SME measures lower the fine cap and promise support, but there is no SME carve-out from Article 50 itself.
- Was Article 50 delayed by the Digital Omnibus?
- No. The Omnibus (Regulation (EU) 2026/1744, in force July 27, 2026) postponed the high-risk obligations to December 2027 and August 2028 and gave generative systems already on the market until December 2, 2026 to add machine-readable marking. Chatbot disclosure, deepfake labels and the other Article 50 duties applied on August 2, 2026 as planned.
- What is the fine for an Article 50 breach?
- Article 99(4): up to €15 million or 3% of total worldwide annual turnover, whichever is higher. For SMEs and start-ups — and, since the Omnibus, small mid-caps — it is whichever is lower. The €35 million / 7% figure you may have seen is the tier for prohibited practices under Article 5, not transparency.
- We use a vendor’s chatbot. Is compliance their problem?
- Partly. The vendor is the provider and must design the disclosure in. You are the deployer: you must not remove or disguise it, you own the labels on anything you publish under 50(4), and you carry the AI-literacy duty for your team. If you built the bot yourself on an API and run it under your brand, you are the provider and the whole of 50(1) is yours.
- What does a compliant chatbot disclosure look like?
- Clear, at the first interaction, stating that the user is talking to an AI and on whose behalf it acts, with a visible route to a human. The Commission guidelines reject generic names like “Assistant”, notices buried in terms, and machine-readable-only flags, and expect the bot to admit it is AI whenever asked. Our own site agent does exactly this.
- Do I have to label every AI-written blog post?
- Only if it is published to inform the public on matters of public interest and has not gone through human editorial control. Marketing copy about your own products is generally outside 50(4). If you run a news-style section, either label it or document a real editorial workflow with a named responsible person — the guidelines say paper policies and cursory approvals do not qualify.
- Is the AI icon from the Code of Practice mandatory?
- No. The Code is voluntary, and the Commission found it an adequate way to comply. Using its harmonised “AI” icon is the easiest way to prove you labelled content in “an appropriate manner”; you can use another clear label, but then you carry the burden of showing it was equally clear.
- Where does our audit fit in?
- The AI readiness assessment includes an EU AI Act exposure check: which systems you run, which role you hold, which Article 50 duties apply and whether your website chatbot passes. It is engineering diligence, not legal advice — we hand the findings to your lawyer in a form they can act on.
Sources: Regulation (EU) 2024/1689, Article 50 (consolidated) · Article 99 — penalties · Article 111 — transitional provisions (as amended) · Article 113 — application dates (as amended) · Digital Omnibus on AI — overview of amendments · Commission guidelines on Article 50 transparency obligations (20 Jul 2026) · Code of Practice on marking and labelling AI-generated content (10 Jun 2026) · Code of Practice signatories (31 Jul 2026) · National implementation tracker · Cooley on the Omnibus deadlines (Aug 2026) · Reed Smith on the Code of Practice adequacy (Jul 2026) · Euronews on first AI Act enforcement (Oct 2026) · A&O Shearman on California SB 942 / AB 853 · Davis Wright Tremaine on Colorado SB 26-189 · Lewis Silkin on the Garante’s €15M OpenAI fine