If your company puts AI in front of people, or uses AI to make content, EU AI Act Article 50 asks one thing of you: be upfront about it. From 2 August 2026, providers and deployers of certain AI systems must meet new transparency obligations, including informing people when they are interacting with AI and labelling specified AI-generated or manipulated content. That is the core of the rule.
The details are where it gets practical. Whether the duty falls on you or your vendor, which content actually needs a label, and what “ready” looks like before the deadline. This guide walks through all of it, so you leave with a decision you can defend rather than another stack of acronyms.
What is EU AI Act Article 50?
Article 50 of the EU Artificial Intelligence Act, Regulation (EU) 2024/1689, sets the transparency obligations for providers and deployers of certain AI systems. You can read the full Article 50 text on the Commission’s own AI Act Service Desk.
In plain terms, it’s the “say so” rule. The AI Act sorts systems by risk, and one of those categories is systems that carry a transparency risk: people might not realise they’re interacting with a machine, or that a piece of content was made or altered by AI. Article 50 closes that gap with four duties, split between the companies that build AI and the companies that use it.
It doesn’t ban anything or reclassify your chatbot as high-risk. It asks you to be clear about when AI is in the room.
When do the Article 50 requirements apply?
The general application date is 2 August 2026. From that day, in-scope AI systems placed on the EU market or put into service have to meet the transparency obligations.
There’s one limited exception, and it’s worth getting right. The machine-readable marking obligation in Article 50(2), which covers synthetic audio, image, video and text, has a grace period to 2 December 2026, but only for systems that were already on the market before 2 August 2026. That extension comes from the recent Digital Omnibus on AI (signed in July 2026 and awaiting publication in the Official Journal), so treat the exact date as firm but still finalising. It applies to that one marking obligation, not to Article 50 as a whole.
Content generated before 2 August 2026 doesn’t need to be labelled retroactively. The Commission encourages deployers to label older content where they can, but it isn’t required. These points are confirmed in the Commission’s Article 50 questions and answers.
| Date | What changes |
| 2 August 2026 | Article 50 transparency obligations start to apply to in-scope AI systems placed on the EU market or put into service. |
| 2 December 2026 | End of the limited grace period for the Article 50(2) marking obligation, for systems already on the market before 2 August 2026. |
| Anything before 2 August 2026 | Content generated before this date doesn’t need retroactive labelling, though the Commission encourages it where possible. |
One thing to note is that December date is not a general reprieve. Most Article 50 duties apply from 2 August 2026, and only the single marking obligation for pre-existing systems gets the extra months.
If you’re already mapping EU deadlines, this sits alongside work many teams have underway. Our guides on preparing for the EUDR compliance deadline and what CSRD reporting now means for SMEs follow the same discipline applied to different regulations.
Who must comply: are you a provider or a deployer?
Article 50 assigns duties to two roles. Before you can do anything useful, you need to know which one you are for each AI system, because the obligations differ.
| Role | What it means in plain terms | Typical examples |
| Provider | You develop an AI system, or have one developed, and place it on the EU market or put it into service under your own name or brand. | A software company, an AI-platform vendor, or a business shipping its own branded AI tool. |
| Deployer | You use an AI system under your own authority in the course of a professional activity. | An employer, publisher, advertiser, retailer, or professional-services firm using AI at work. |
The point most companies miss is that one organisation is often both, depending on the use case. Say you build a customer-service chatbot and put it out under your brand: for that, you’re a provider. The same company uses a third-party image generator to make marketing visuals: for that, you’re a deployer. The role attaches to the activity, not to the company as a whole.
So the useful question is per system: for this particular use, are we the provider or the deployer? You answer it once for each system on your list.
What are the main Article 50 transparency requirements?
This is the core of Article 50: five situations, and for each, who’s responsible and what they actually have to do.
| Situation | Who’s responsible | What you have to do |
| An AI system interacts directly with a person | Provider | Make sure the person is informed they’re interacting with AI, unless that’s already obvious from the context. |
| A system generates synthetic audio, image, video or text | Provider | Mark the output in a machine-readable format so it’s detectable as AI-generated, where Article 50(2) applies. |
| Emotion recognition or biometric categorisation is used | Deployer | Inform the people exposed to the system that it’s operating. |
| Deepfake content is published | Deployer | Clearly disclose that the content was artificially generated or manipulated. |
| AI-generated text is published to inform the public on matters of public interest | Deployer | Label it, unless a human reviewed the content and someone holds editorial responsibility for it. |
The exceptions matter as much as the rules. A few things to hold onto.
The “obvious” exception is narrow. You can skip the chatbot disclosure only where a reasonable person would already know they’re dealing with AI. When in doubt, disclose. The Commission’s transparency guidelines read these carve-outs tightly.
Not every AI-generated text needs a public-interest label. That final row applies only when content is published to inform the public on matters of public interest: political, social, economic, cultural or scientific topics that shape opinion. Your AI-drafted internal memo or product description isn’t the target. And even for in-scope text, the label falls away when a person has genuinely reviewed it and a named party takes editorial responsibility.
An AI-assisted edit is not the same as a deepfake. Touching up lighting or trimming a clip is a different thing from generating or materially manipulating content designed to look real. Over-labelling everything dilutes the disclosures that actually matter, so aim for accuracy, not blanket caution.
Does Article 50 apply to companies outside the EU?
Potentially, yes. This one is easy to overlook.
The Commission is clear that providers established outside the EU can still fall within scope where the output of their AI system is used in the EU. So a US or UK company whose AI produces content or interactions consumed by people in the EU may carry Article 50 duties, even with no EU office.
That said, it isn’t automatic. Being a non-EU company doesn’t put you in scope on its own; the trigger is whether your system’s output is actually used in the Union. If you sell into the EU, serve EU users, or your content reaches EU audiences, this is worth a proper look rather than an assumption either way.
What should your business do now to prepare?
You don’t need a task force to start. You need a clear sequence, and you can begin this month.
1. Inventory your AI systems and current AI use cases. You can’t classify what you haven’t listed.
2. For each use, decide whether you’re the provider or the deployer.
3. Map the specific Article 50 obligation that attaches to each.
4. Review your existing notices, disclosures and content-labelling practices against those obligations.
5. Assign legal, technical and operational owners, so nothing sits in the gap between teams.
6. Test your machine-readable marking and your visible disclosure methods before you rely on them.
7. Set up approval and substantive human-review controls, especially for public-interest content.
8. Document your decisions, exceptions and the evidence behind them.
9. Train the employees and contractors who build, buy or publish with AI.
10. Monitor how the rules and the technical standards develop, because both are still moving.
If that list makes it clear you’d rather not run this alone, our compliance, risk and due diligence solution is built for exactly this kind of mapping. And for the team’s training , our marketplace course on using AI in ESG integration and reporting is a practical way to get teams comfortable with responsible AI use.
Who should own Article 50 compliance in your business?
This is where a regulation becomes a set of business controls, and where most companies quietly fall down. A duty that sits with everyone sits with no one. We’ve written before about why ownership is the missing link in ESG audit results, and the same logic applies here: give each function a defined job.
| Function | What they own under Article 50 |
| Legal and compliance | Interpreting scope, confirming provider/deployer status, tracking regulatory change. |
| Technology and product | Building disclosure into interfaces and embedding machine-readable marking in outputs. |
| Information security | Making sure marking and provenance methods are sound and can’t be trivially stripped. |
| Marketing and communications | Labelling deepfakes and public-interest content, and getting the visible disclosures right. |
| Human resources | Disclosure where emotion recognition or biometric tools touch staff or candidates. |
| Procurement | Getting provider commitments into vendor contracts, so bought-in AI arrives compliant. |
| Operations | Running the day-to-day controls and keeping the evidence current. |
| Executive oversight | Owning the risk decision and signing off the approach. |
Put a named person against each row. That is what turns “we read the guidance” into “we can show we acted on it.”
What evidence should you keep?
If a market surveillance authority, a customer or an auditor asks how you comply, you want the answer documented and ready to show. Keep the trail as you go, not after the fact.
Useful records include: your AI-system inventory; your provider or deployer classification for each system; the applicability decision behind it; copies of the user notices you show; your labelling and marking specifications; testing records; your human-review procedures; editorial approvals for public-interest content; training records; the responsibility matrix; the rationale for any exception you relied on; and your monitoring and review logs.
This is the same evidence discipline that carries teams through ESG audit preparation: decisions written down, owners named, proof attached.
The VECTRA perspective: transparency as a trust advantage
It’s tempting to treat Article 50 as one more compliance burden. We see it differently.
The companies that pull ahead will be the ones that treat “we tell you when it’s AI” as part of how they earn trust, with customers, regulators and their own people. Clear labelling and honest disclosure signal a business that has its house in order. Handled well, that clarity becomes a commercial asset rather than a compliance cost.
This is also why we keep coming back to human-centred AI: keeping a person in the loop, and being straight about where the machine ends and the human begins. It’s the thinking behind our AI Pledge, and it’s the same instinct Article 50 now writes into law.
So start where it matters most: know your systems, name your owners, and get the disclosures right on the content that reaches the public. If you’d like help mapping your obligations before 2 August 2026, book a free consultation with our team. We’ll help you get from “we think we’re compliant” to “we can prove it.”
Frequently asked questions
Does Article 50 apply to my customer-service chatbot?
If it interacts directly with people, then generally yes: the person needs to know they’re dealing with AI, unless that’s already obvious. The duty sits with the provider of the system. If you built and branded the chatbot yourself, that’s you.
Do I have to label every AI-generated blog post or piece of text?
No. The labelling duty for AI-generated text applies to content published to inform the public on matters of public interest, and even then it falls away when a human has reviewed the content and someone holds editorial responsibility for it. Routine AI-assisted copy isn’t covered.
Can a company be both a provider and a deployer?
Yes, and many are. You might be a provider for an AI tool you build and sell, and a deployer for third-party AI you use internally. Classify each system on its own; the role follows the use case, not the company.
Does Article 50 apply to us if we’re based outside the EU?
It can. Providers outside the EU fall within scope where their AI system’s output is used in the EU. It isn’t automatic, but if you serve EU users or your AI’s output reaches EU audiences, it’s worth checking rather than ruling out.
What happens if we don’t comply?
Enforcement runs mainly through national market surveillance authorities, and breaches of the transparency obligations can carry fines of up to €15 million or 3% of total worldwide annual turnover, whichever is higher. The practical answer is simpler: map your obligations early, assign owners, and keep the evidence.
View Related Posts
How Can Businesses Close the Innovation Gap with Human-Centric AI
From “Chat” to “Audit”: The Rise of Agentic AI in Supplier Risk Assessment
VECTRA International is a trusted Business Resilience & Operational Capability Building Partner. Through our ecosystem of integrated solutions, we help organizations transform operational complexity into resilient performance, measurable business impact, and sustainable growth.
Chaussée de Wavre 1517B, 1160 Brussels, Belgium.
A Note on Our Visuals: At VECTRA, we combine human expertise with advanced technology. Some of the supportive imagery in this article was generated using artificial intelligence tools like Google Gemini. We ensure all conceptual AI assets align with our brand standards and accurately reflect our data.
