EU AI Act Article 50 Transparency Rules Take Effect

From 2 August 2026, the European Commission and national market surveillance authorities begin enforcing Article 50 of the EU AI Act. The rules apply to any provider or deployer whose AI system interacts directly with people, generates synthetic content, produces deepfakes, or uses emotion recognition and biometric categorisation. This post explains what changed, the four obligations and practical gaps for engineering teams.

What changed on 2 August 2026

The screenshot confirms the enforcement trigger: the Commission’s AI Office and national authorities begin applying the AI Act on 2 August 2026, and the same date starts the new transparency obligations.

The published guidelines clarify that the obligations apply to providers and deployers along the value chain. A provider places the AI system on the market or puts it into service under its own name; a deployer uses it under its own authority. The obligations are horizontal: they apply to any AI system in one of the four Article 50 situations, not only to systems classified as high-risk elsewhere in the Act. That makes disclosure banners, machine-readable metadata and provenance pipelines new compliance surface area for engineering teams.

The four transparency obligations

Article 50 splits the obligations into four areas. The first scoping question is whether your team is a provider, a deployer, or both.

1. AI disclosure for interactive systems. Article 50(1) requires providers of AI systems intended to interact directly with natural persons to design them so that users know they are dealing with AI. The exception is narrow: disclosure can be skipped only if it is obvious to a reasonably well-informed person. The Commission’s draft guidelines make clear that AI agents fall within this obligation, so agent runtimes should treat disclosure as a first-class system call. My earlier AI agent stacks and plugins post covers the same runtime discipline.

2. Machine-readable marking for synthetic content. Article 50(2) requires providers of generative AI systems that produce synthetic audio, image, video or text to mark outputs in a machine-readable format and make them detectable as artificially generated. The technical standards are being developed through the Code of Practice and EU standardisation work. Carve-outs apply to assistive standard editing and to systems authorised by law for criminal offence work.

3. Notice for emotion recognition and biometric categorisation. Article 50(3) requires deployers to inform individuals exposed to such systems. This is distinct from the Article 5 prohibition on emotion recognition in workplaces and schools, which is already in force. Outside those prohibited settings, deployers must still give notice and comply with GDPR and other EU data protection law.

4. Labels for deepfakes and public-interest text. Article 50(4) requires deployers to disclose when AI-generated or manipulated image, audio or video content constitutes a deepfake. For artistic, creative or satirical works, the disclosure can be lighter but must still reveal the existence of generated content. For AI-generated text published to inform the public on matters of public interest, the deployer must disclose the AI origin unless the text has undergone human review and editorial control and a named person or entity holds editorial responsibility.

The guidelines state that the information must be provided at the time of first interaction or exposure, clearly and distinguishably, and in line with accessibility requirements. A small footer link, a faint label or a one-frame flash in a video will not satisfy the threshold.

Timeline, penalties and the Code of Practice

Article 5 prohibitions took effect on 2 February 2025. Article 50 applies from 2 August 2026. Systems already on the market before that date have until 2 December 2026 to meet the machine-readable marking requirement under Article 50(2). Signatories of the Code of Practice are expected to implement an interoperable watermark detection solution by 2 February 2027. Non-compliance can cost up to €15 million or 3% of global annual turnover, whichever is higher, for breaches of transparency obligations.

The Code of Practice on transparency of AI-generated content is a voluntary framework that the Commission has assessed as a practical way to demonstrate compliance with Article 50(2) and Article 50(4). More than 180 organisations have signed it, according to the Commission’s announcement. The Code splits into two working groups: one for providers focused on marking and detection, and one for deployers focused on labelling deepfakes and AI-generated text.

The Code does not replace the AI Act or the Commission guidelines. Providers and deployers that choose not to follow it must demonstrate that their alternative measures are adequate, assessed individually by market surveillance authorities. For most engineering teams, following the Code is the lower-risk path because it offers a recognised, EU-wide framework.

The Code’s technical work is ongoing. The Commission describes a proposed standardised EU label, a taxonomy distinguishing fully AI-generated from AI-assisted content, and modality-specific labelling for video, images and audio. The standards for watermarking, metadata and provenance tools are still being developed, but the direction is clear: providers need a provenance pipeline that can attach detectable metadata to generated content at scale.

Practical takeaways for developers

Start by inventorying every AI system that touches users or generates content. That includes chatbots, virtual assistants, code-completion tools, image generators, video generators, audio generators and any system that classifies emotion or biometric traits. For each system, ask which of the four Article 50 situations applies.

Then design disclosure as a product feature. For chatbots, the disclosure should appear before or at the start of the first interaction. For generated content, embed it in a machine-readable format and surface it in a human-readable label. For deepfakes, make the disclosure clear and persistent enough to survive sharing. For public-interest text, either label the content or establish a documented human review and editorial responsibility process.

Security teams should treat provenance metadata as a target. Adversaries may strip watermarks, tamper with labels or generate content that mimics legitimate labels. The defences overlap with the controls I covered in file uploads threat model and controls: validate inputs, protect metadata integrity and log provenance at the boundary.

Limitations and open questions

The rules are enforceable, but several details are not final. Technical standards for machine-readable marking are still being developed, and the Commission’s guidelines were released in draft form for consultation. The Code of Practice interoperability deadline is February 2027, so providers will use different provenance formats. There are also jurisdictional ambiguities for SaaS products that serve EU users from outside the bloc, and accessibility questions for screen-reader interfaces and non-visual content. Finally, the carve-outs are not free passes: standard editing, artistic works and law-enforcement authorisations each have specific conditions. Misreading them can create a compliance gap discovered only after a complaint or market surveillance action.

Frequently asked questions

Who is covered by Article 50? Providers and deployers of AI systems in the four situations the article covers: direct interaction with humans, synthetic content generation, emotion recognition or biometric categorisation, and deepfakes or public-interest text. Open-source systems are not exempt.

Do these rules apply only to high-risk AI systems? No. Article 50 applies horizontally to any AI system in the four covered situations, regardless of high-risk classification elsewhere in the AI Act.

What is the deadline for machine-readable watermarking? New deployments must comply from 2 August 2026. Systems already on the market before that date have until 2 December 2026 to implement machine-readable marking under Article 50(2).

What is the Code of Practice? It is a voluntary framework with provider and deployer working groups that defines practical marking and labelling measures. Signatories can rely on it to demonstrate compliance with Article 50(2) and 50(4). Non-signatories must prove their alternative measures are adequate.

What are the penalties for non-compliance? Up to €15 million or 3% of global annual turnover, whichever is higher.

Conclusion and next steps

Article 50 shifts AI transparency from a recommendation into a binding obligation. The effective date is 2 August 2026. For engineering teams, the work is to map AI systems, embed disclosures and provenance into the product pipeline, and follow the Code of Practice as it matures. If your team is shipping chatbots, generative media, or biometric analytics, treat this as a cross-functional release requirement and build a disclosure roadmap before the December 2026 grace period closes.

Sources

• European Commission, AI Act enforcement notice — https://digital-strategy.ec.europa.eu/en/news/commission-starts-enforcing-ai-act-rules-and-new-transparency-requirements-2-august
• European Commission, Code of Practice on AI-generated content — https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content
• European Commission, Transparency guidelines — https://digital-strategy.ec.europa.eu/en/policies/guidelines-transparency-ai-generated-content
• EU AI Act, Article 50 — https://artificialintelligenceact.eu/article/50/
• AI Act Explorer, Article 50 guide — https://artificialintelligenceact.eu/transparency-rules-article-50/