Article 50 of the EU AI Act has applied since 2 August 2026. It is the requirement that touches the largest number of companies, because it has nothing to do with high-risk systems (those have been postponed) and everything to do with any organisation running a chatbot in front of its customers or publishing AI-generated content.
Here we answer the practical question: who inside your company has to do what, by when, and how you prove it.
In short
Article 50 splits duties across two roles: provider (whoever develops or places the system on the market) and deployer (whoever uses it in their own activity). The obligations differ, and many companies are both.
Providers must make the AI interaction recognisable and mark synthetic content in a machine-readable format.
Deployers must disclose deepfakes, inform people exposed to emotion recognition or biometric categorisation, and disclose AI-generated text published on matters of public interest.
Staggered deadlines: 2 August 2026 application, 2 December 2026 for generative systems already on the market, 2 February 2027 for interoperable detection.
Penalties up to €15 million or 3% of worldwide turnover.
#First things first: are you a provider or a deployer?
Your role decides your obligations, and in SMEs the most frequent answer is "both".
Role | Who you are | Typical example |
|---|---|---|
Provider | You develop an AI system and place it on the market under your own name or brand | A software company selling a conversational assistant to its customers |
Deployer | You use an AI system under your authority in a professional activity | A company putting a chatbot built on a third-party model on its own website |
If you take a third-party model, build your own assistant on top of it and offer it to your customers under your brand, for that system you are a provider, not merely a user. The design obligations land on you, even though the underlying model is not yours.
#The four obligations, translated into actions
1. Users must know they are talking to an AI (Art. 50(1))
This applies to providers of systems intended to interact directly with people: chatbots, virtual assistants, voicebots.
The information must be given at the latest at the time of the first interaction, clearly and accessibly. A line in the privacy notice or the terms of service is not enough: it has to be perceivable where the conversation actually happens.
It is not required where the AI interaction is obvious to a reasonably well-informed person, but treat that exception with care: what looks obvious to the team that built the product rarely is to the end user.
2. Synthetic content must be machine-readable marked (Art. 50(2))
This applies to providers of systems generating synthetic audio, image, video or text, including general-purpose AI systems.
This calls for machine-readable marking: the content must carry a signal that lets software recognise its artificial origin. It is the most technical part of Article 50 and belongs on the product team's roadmap.
3. Emotion recognition and biometric categorisation (Art. 50(3))
This applies to deployers. Anyone using emotion recognition or biometric categorisation systems must inform the people exposed to them, and process the data in line with data protection law.
These systems usually enter the company inside other products: customer care call analytics, candidate screening tools, access control systems.
4. Deepfakes and published text (Art. 50(4))
This applies to deployers who publish content.
- Content constituting a deepfake, meaning generated or manipulated image, audio or video that appears authentic, must be disclosed as artificial.
- AI-generated text published to inform the public on matters of public interest must be disclosed, unless it has undergone human review with editorial responsibility on whoever publishes it.
Two exceptions. First: where the work is evidently artistic, satirical or fictional, the disclosure must be given in a way that does not hamper the enjoyment of the work. Second: human editorial review removes the obligation for text, but it must be documented, because if challenged the burden of showing it is yours.
#How content actually gets marked
On 20 July 2026 the Commission published its final Article 50 guidelines, alongside the Code of Practice on Transparency of AI-Generated Content released by the AI Office on 10 June 2026. The expected technical approach has two layers.
Layer 1: signed metadata. Provenance information is recorded in the content, cryptographically signed and time-stamped so that tampering becomes evident. The market reference is the open C2PA standard (Content Credentials). Known limitation: metadata is lost with a screenshot or a re-encode.
Layer 2: imperceptible watermark. An invisible signal embedded in the content itself, in pixels, in the audio waveform or in token distribution, designed to survive compression, cropping, scaling and format conversion. It exists precisely to cover the cases where metadata disappears.
On top of these you can add fingerprinting, with perceptual hashes recorded in a searchable registry. Optional, but useful for anyone generating content at volume.
The Code also asks signatories to provide an accessible detection tool and to contractually prohibit the removal of markings in the service terms.
Signing the Code is voluntary. Signatories get a recognised route to demonstrating compliance while harmonised standards are still missing; non-signatories remain bound by Article 50 anyway, but have to demonstrate compliance by their own means, facing greater scrutiny.
#What falls outside the obligations
The guidelines clarify the excluded cases. The main ones:
- personal, non-professional use: an individual generating images for themselves is not a deployer;
- scientific research and development: systems developed and used exclusively for research purposes;
- systems authorised by law to detect, prevent or investigate criminal offences;
- standard editing that does not alter meaning: spelling and grammar corrections, touch-ups that leave the informative substance intact;
- text with human editorial review and editorial responsibility on the publisher.
Article 50 has no size threshold. A five-person startup with a public chatbot carries the same transparency duties as a multinational.
#Deadlines to put in the calendar
Date | What is due | Who it concerns |
|---|---|---|
2 August 2026 | Article 50 applies, enforcement powers active | Everyone |
2 December 2026 | Bringing Art. 50(2) marking into compliance | Providers of generative systems placed on the market before 2 August 2026 |
2 February 2027 | Interoperability solution for watermark detection | Code of Practice signatories |
The December window, introduced by Regulation (EU) 2026/1744, covers only the technical marking of pre-existing systems. Everything else, chatbot disclosure included, is already due now (see our AI Act deadlines guide).
#What getting it wrong costs
Breaching the transparency obligations falls in the penalty band of up to €15 million or 3% of annual worldwide turnover, with the lower of the two applying to SMEs and startups.
For anyone selling software, the first request often comes from the enterprise customer before any supervisory authority: their vendor questionnaire asks how you mark content generated by your system and who carries that compliance in the contract.
#Where to start
What to do | Who | By when |
|---|---|---|
Map the AI systems that touch customers or the public and assign each a role: provider, deployer or both | Everyone | Now |
Check that chatbots, in-app assistants and voicebots show the notice at first interaction | Providers | Already due |
Inventory the synthetic content you publish (product imagery, video, text) and the tool behind it | Deployers | Already due |
Ask your AI vendors whether and how they mark content: if the model supports neither C2PA nor watermarking, the problem is yours | Deployers | Already due |
Document editorial review of published text if you want to rely on that exception | Deployers | Already due |
Look for biometric systems inside other products, especially in HR and customer care | Deployers | Already due |
Decide whether to sign the Code of Practice or build equivalent evidence | Providers | As soon as possible |
Put marking on the roadmap for generative systems already on the market | Providers | 2 December 2026 |
#How CertAI helps
CertAI starts from the AI system inventory and from assigning a role to each system, which is exactly where almost every company stalls. From there it builds the compliance documentation and the evidence customers ask for in vendor questionnaires, through to the path towards certifiable standards such as ISO/IEC 42001 (see our ISO/IEC 42001 guide).
Not sure whether your AI systems meet Article 50? CertAI maps the systems, assigns your role and prepares the compliance evidence.
