AI Act Article 50: What the New Transparency Rules Require

AI Act Article 50 obligations went live on August 2, 2026, and they reach almost every business that touches the EU market: if you run a chatbot, publish AI-generated content, or use AI that reads faces, voices, or emotions, specific disclosure duties now apply to you. Enforcement is no longer theoretical either — the European Commission’s AI Office issued its first formal information demands to AI companies in late August, Italy’s implementing decree put inspectors and fines into motion in October, and the first public penalties are a matter of when, not whether. This article breaks the obligations down into plain language and a checklist you can actually run.

Key Takeaway

• 📢 Four disclosure duties are live now: chatbots must identify themselves as AI, emotion and biometric systems must tell exposed people, deepfakes must be labeled, and AI-written public-interest text must be disclosed — all since August 2, 2026 under AI Act Article 50.
• 🏷️ Marking is the provider’s job: companies that build AI generators must mark outputs in a machine-readable format that detection tools can find; some providers have until December 2, 2026 to complete that work under the limited transition.
• ✍️ Human editorial review is an escape hatch — not a loophole: AI-generated text is exempt from disclosure only when real editorial review happens and a named person holds responsibility for the publication.
• ⚖️ The enforcement machine is running: the AI Office can inspect and fine up to €15 million or 3% of global turnover for transparency breaches; Italy added dawn raids, a €1 million band for explanation failures, and public posting of every penalty decision.
• ✅ Signing the Code of Practice is the low-friction path: roughly 190 organizations had signed by late July 2026, and signatories get an EU-wide recognized way to demonstrate compliance.

What AI Act Article 50 Covers: the Four Disclosure Duties

AI Act Article 50 lays four distinct transparency obligations on providers and deployers of AI systems. The distinction matters because your duties depend on your role: a provider builds or markets the AI system; a deployer uses an AI system under its own authority — often the role a company or agency lands in when it merely uses tools someone else built.

Timing is part of the rule, not a detail: Article 50(5) requires the disclosure to land in a form that is clear and distinguishable, no later than the moment of first interaction or exposure, and it must satisfy accessibility requirements. A disclosure buried in a footer, delayed until after the exchange, or formatted in a way assistive technologies cannot read does not meet the standard. Article 50(6) preserves all other EU and national transparency rules, so the AI Act duties stack on top of whatever already applies in your sector or country.

Who Must Comply: the Provider and Deployer Test for AI Act Article 50

AI Act Article 50 reaches businesses far beyond Brussels: the AI Act applies globally in a specific sense — it covers providers, deployers, importers, and distributors who place AI systems on the EU market or whose AI output is used within the European Union. A chatbot service operated from Manila, Singapore, or Kansas City that serves EU users is inside the scope. The Commission’s July 2026 guidelines on the scope of the transparency duties flesh out the boundary cases, and the practical test for most organizations is this: does AI output you produce or operate reach people in the EU? If yes, the duties attach.

Common situations, mapped:

• Customer-service chatbots for EU customers — deployer duty (Art. 50(1)) to identify the assistant as AI, unless obvious. A clearly branded “AI Assistant” header satisfies it; a bare chat widget that mimics a human agent does not.
• Agencies publishing AI-assisted copy for EU audiences — for ordinary marketing content, Art. 50(4) applies only when the text informs the public on civic matters; for that class, disclosure is avoided only with substantive human review and a named editorial responsibility holder.
• HR tech or retail analytics using emotion recognition in the EU — deployer duty (Art. 50(3)) to inform the people exposed, with a lawful basis for the underlying personal-data processing.
• Video, audio, or image generators — as provider, machine-readable marking duties; as deployer, deepfake disclosure whenever output resembles real people, places, or events.

There is also a narrow carve-out worth knowing: the interaction-disclosure duty does not apply to AI systems authorized by law for detecting, preventing, investigating, or prosecuting criminal offences, and the marking duty excludes AI that performs an assistive editing function without substantially altering the input — spellcheck-style assistance stays outside, generative transformation stays inside.

The Code of Practice: the Recognized Path to Compliance

For marking and labeling duties, the Commission published a voluntary Code of Practice on Transparency of AI-Generated Content, drafted by independent experts in a multi-stakeholder process run by the AI Office. The Commission and the AI Board assessed the code as an adequate voluntary tool — which is the important part: signatories can point to its measures when demonstrating that their AI Act Article 50 duties are met, while organizations that choose other routes must individually convince each market surveillance authority that their approach is adequate. By late July 2026, roughly 190 companies and organizations had signed.

The code has two sections matching the two roles: Section 1 sets rules for providers on marking and detection of AI-generated content; Section 2 sets labelling rules for deployers covering deepfakes and AI-generated text. The EU also published a set of icons deployers may use to label AI-generated content, plus guidelines on the scope of the obligations. Signatories join task forces that share implementation practices — a concrete benefit that comes from following the recognized route rather than inventing a bespoke scheme.

The strategic read for smaller organizations: the code converts a fuzzy legal obligation into a documented process with standard icons and EU-wide recognition. For a BPO serving EU clients, an agency publishing at scale, or a SaaS company with AI features, signing up is usually cheaper than defending a custom approach.

Enforcement Is Live: RFIs, Inspectors, Dawn Raids, and Fines

Transparency duties used to sound like paperwork. Three events in the last ten weeks changed that.

1. August 2, 2026 — powers switched on. The AI Office’s investigative and sanctioning powers for general-purpose AI models and the relevant systems provisions of the AI Act became applicable, alongside the Article 50 duties themselves.
2. August 29, 2026 — first formal RFIs. The AI Office issued its first Requests for Information to GPAI providers, in two categories: safety and security practices, and transparency/copyright compliance. More than 30 AI companies that had not published detailed training-data summaries received RFIs requiring them to explain their copyright compliance. Fines can attach to incorrect, incomplete, or misleading responses.
3. October 8-23, 2026 — Italy switched on national enforcement. Italy’s second implementing decree designated the market surveillance authorities, published the penalty bands, opened a national regulatory sandbox, and — the part compliance teams least expected — authorized unannounced on-site inspections, with the cybersecurity agency able to call on the financial police. It entered into force on October 23, 2026.

SMEs and start-ups face the lower of the two figures in each band under the AI Act’s rules — but Italy adds a non-financial penalty that often costs more than the fine: every penalty decision is published on the authority’s website, naming the infringement and the company. For a consumer brand, that publication is the real sanction.

The 6-Step Article 50 Readiness Drill

Your AI Act Article 50 position can be produced in an afternoon if the inventory is honest. Run it in order:

1. Inventory your AI touchpoints. List every chatbot (support, sales, internal), every generative feature in your product, any emotion or biometric analysis, and every place AI-generated content reaches an audience — including marketing output produced with AI tools. Providers get one list; deployers get another.
2. Determine each touchpoint’s disclosure duty. For each item, apply the table: interaction disclosure, machine-readable marking, emotion/biometric notification, deepfake labeling, or public-interest-text disclosure. Record the exact paragraph it falls under.
3. Check the exemptions honestly. Obviousness for chatbots, assistive editing for marking, artistic/satirical scope for deepfakes, substantive human editorial review for public-interest text — document why each claimed exemption holds, with a named person for editorial responsibility.
4. Fix timing and format. Disclosures must land at first interaction or exposure, clearly and distinguishably, with accessibility conformance. Move any disclosure that currently lives in a footer, a terms page, or an after-the-fact banner.
5. Decide your compliance route. Assess the Code of Practice against your stack. If it fits, sign; if not, document your alternative measures as if a market surveillance authority will review them, because one may.
6. Build the inspection file. Keep a current inventory, your duty map, exemption rationale, disclosure implementations with screenshots, codes signed, and the named internal owner contactable the day an inspector arrives unannounced — Italy’s decree made that scenario real.

The Enforcement Calendar Ahead

AI Act Article 50 is the live tranche, but the calendar behind it is crowded:

• December 2, 2026 — end of the limited transition for certain provider marking obligations; new-prohibition duties on systems generating non-consensual intimate material and AI-generated CSAM take effect.
• December 2, 2027 — Annex III high-risk system obligations apply (the main high-risk tranche, including employment and essential-services systems).
• August 2, 2028 — high-risk AI embedded in regulated products applies.
• Ongoing — AI Office RFIs, model evaluations, and the first published penalty decisions, which will set the market’s expectations the way early GDPR fines did.

One adjacent date belongs in your governance calendar even though it predates this cycle: the AI literacy duty (Article 4) has been in force since February 2025 — the Digital Omnibus amendments softened its formulation, but the duty to build staff AI literacy remains, and the same inspection that arrives for Article 50 can ask for it.

Frequently Asked Questions About AI Act Article 50

What is AI Act Article 50?

Article 50 of the EU AI Act sets transparency obligations that bind providers and deployers of certain AI systems: chatbots must tell users they are talking to AI, synthetic-content generators must mark outputs as machine-readable and detectable, emotion recognition and biometric categorisation systems must inform exposed people, and deepfakes plus AI-generated public-interest text must be disclosed. The obligations apply since August 2, 2026.

When did Article 50 take effect?

The core obligations applied from August 2, 2026, per Article 113 of the AI Act. The Commission adopted scope guidelines on July 20, 2026. A limited transition for certain provider marking duties ends December 2, 2026.

Does Article 50 apply outside the EU?

Yes. The AI Act reaches providers, deployers, importers, and distributors who place AI systems on the EU market or whose AI output is used within the EU. A support chatbot serving EU customers counts, regardless of where the operating company is based.

How does AI Act Article 50 classify a deepfake?

As an AI-generated or manipulated image, audio, or video that resembles real persons, objects, places, entities, or events while falsely appearing authentic or truthful. Deployers must disclose it — with a lighter-touch option for genuinely artistic, satirical, or fictional works, where disclosure must not hamper the work’s display or enjoyment.

Is AI-generated text always labeled?

No. The disclosure duty covers AI-written text placed before the public so citizens can follow civic matters — news-style reporting being the core case. That duty does not apply where the content passed substantive human review or editorial control and a person holds editorial responsibility for the publication. Ordinary marketing copy is not public-interest text — but sector regulators and platform rules may add duties on top.

What are the fines for breaching Article 50?

Transparency breaches under AI Act Article 50 fall in the €15 million or 3% of worldwide annual turnover class. Giving authorities incorrect or misleading information risks €7.5 million or 1%. Italy additionally fines failures on the fundamental-rights impact assessment and the right to explanation at up to €1 million or 0.5% — and publishes every penalty decision on its authority website.

Is signing the Code of Practice mandatory?

No — the code is voluntary, and the Article 50 obligations are not. Signing gives signatories an EU-wide recognized way to demonstrate compliance with the marking and labeling duties plus task-force participation; non-signatories must individually demonstrate adequate alternatives to each market surveillance authority.

What should a small business do first?

Run the inventory: list every AI touchpoint your customers and staff meet, map each against the four duties, fix timing (disclosure at first interaction), and build a one-page file recording the analysis with a named owner. If you serve EU clients from outside the EU, do not skip this — scope follows the users, not your registration address.

Sources

Legal text and phasing: the AI Act Article 50 explorer text and the Commission’s AI Act framework page. Code of Practice, icons, and signatory counts: the Commission’s Code of Practice page (updated October 12, 2026). Enforcement timeline: the Commission’s enforcement framework page, Legal 500’s analysis of the first AI Office RFIs (August 29, 2026), Italy’s October 2026 enforcement decree analysis, and the Legislative Decree 179/2026 gazette review. Scope and duties cross-checked against Cooley’s Article 50 alert and Morgan Lewis’s transition analysis. For related WorldNgayon coverage, see our AI data privacy ledger, the Singapore shadow-AI breach case, and our content credentials explainer on how provenance marking works in practice.

Financial Disclaimer

This article is general information about AI regulation compliance, not legal or financial advice. Enforcement rules, penalty levels, and timelines evolve — Italy’s decree is in force October 23, 2026 and future guidance may change interpretations. Verify obligations against the official texts and consult qualified counsel for your specific situation. WorldNgayon is not a legal or financial adviser.