EU AI Act Article 50 transparency obligations have applied since 2 August 2026. Systems placed on the market before then have until 2 December 2026 for machine-readable marking. Deployers should inventory AI touchpoints, record their role, name owners and keep written provider commitments.
Article 50 has applied since 2 August 2026, and its only grace period ends on 2 December. Few companies know which tools it touches.
Article 50 works much like food labelling. The manufacturer prints the ingredients, while the restaurant must tell diners about allergens in the dish it serves. Different parties carry different duties for the same product. This briefing explains what the EU AI Act Article 50 deadline means for your AI tools. It also covers what providers owe you and how to build an evidence file early.
When does the EU AI Act Article 50 deadline apply?
The transparency obligations in Article 50 of the AI Act, Regulation (EU) 2024/1689, have applied since 2 August 2026. There is one narrow extension. AI systems placed on the market before that date have until 2 December 2026 to mark AI-generated content in a machine-readable way, as Article 50(2) requires.
Many teams have misread the Digital Omnibus on AI, Regulation (EU) 2026/1744. It postponed obligations for stand-alone high-risk systems in Annex III to 2 December 2027. High-risk AI embedded in regulated products moved to 2 August 2028. Transparency obligations were not delayed, so any plan that assumes otherwise deserves a review with counsel this week.
What Article 50 requires, paragraph by paragraph
Article 50 divides duties between providers and deployers. A provider develops an AI system or releases it under its own name. A deployer uses an AI system professionally, under its own authority. Most companies deploy many systems and provide a few, often without realising it.
| Paragraph | Duty | Who carries it |
|---|---|---|
| 50(1) | Tell people they are interacting with AI, unless obvious | Provider, built into the design |
| 50(2) | Mark synthetic audio, images, video and text machine-readably | Provider of the generative system |
| 50(3) | Inform people exposed to emotion recognition or biometric categorisation | Deployer |
| 50(4) | Disclose deepfakes; label AI text on public-interest matters | Deployer |
| 50(5) | Give the information clearly, at first interaction or exposure | Providers and deployers |
Two details catch deployers out. The Commission reads the obvious-interaction exception in Article 50(1) narrowly, so a chat window that resembles human support should not rely on it. In addition, a provider's machine-readable watermark does not meet your Article 50(4) duty. A deepfake disclosure must be perceptible without technical tools.
How to map your AI tools in five steps
Most of the work lies in knowing what you run and who answers for it. In practice, most teams can complete this sequence in two to three weeks.
- Inventory touchpoints: list every place AI meets a person or produces content others see, from website chat to campaign video.
- Classify your role: record whether you are provider, deployer or both, and which paragraph applies.
- Name an owner: assign one person, not a team, to each disclosure and its evidence.
- Check the live product: take dated screenshots of each notice or label as a real user sees it.
- Obtain provider commitments: ask in writing how each provider meets Article 50(1) and 50(2).
Ask each provider which outputs are marked, by what method, and whether it has signed the Commission's code of practice on transparency of AI-generated content. That voluntary code gives signatories more legal predictability. A provider that has not signed should explain clearly how it demonstrates compliance instead.
Keep one evidence file per touchpoint, where counsel can reach it. It should hold the role, the paragraph, the owner, dated screenshots and the provider's written answers. Add a short note on any exemption you rely on, such as human editorial review, and revisit the file at least quarterly.
A worked example: one insurer, five touchpoints
Consider a hypothetical online insurer selling to customers in the EU. Its inventory finds five touchpoints that Article 50 may reach. Mapping them takes an afternoon and produces a different action list from the one the team expected.
| Touchpoint | Role | Paragraph | Action |
|---|---|---|---|
| Claims chatbot on a model API, under its own brand | Provider | 50(1), 50(5) | Add an AI disclosure at the start of every chat |
| Support assistant bought as a service | Deployer | 50(1) sits with the provider | Obtain written confirmation; check it is switched on |
| Campaign video with a realistic AI-generated customer | Deployer | 50(4) | Add a visible label; record the source tool |
| AI-drafted public articles on regulatory change | Deployer | 50(4), text | Document human editorial review, or label the text |
| Call-centre tool that infers caller emotion | Deployer | 50(3) | Notify callers; ask counsel whether to continue |
The surprise is that the insurer's own chatbot, not the purchased tools, carries the provider duty. None of these actions is expensive. All of them are easy to miss without a touchpoint inventory.
Common mistakes and the cost of getting it wrong
- Assuming a general delay: the Omnibus moved high-risk deadlines, not transparency.
- Treating bought tools as someone else's concern: deployer duties stay with you, and your configuration can undo a provider's disclosure.
- Relying on watermarks for deepfakes: people must be able to see or hear the disclosure.
- Hiding notices in the terms: information must reach people clearly at first interaction or exposure.
- Assuming non-EU teams are exempt: the Act can reach organisations elsewhere whose AI output is used in the EU.
Breaches of Article 50 can attract fines of up to EUR 15 million or 3% of worldwide annual turnover. Enterprise customers are also raising Article 50 in their own supplier reviews, where a missing disclosure can stall a sale. For teams serving India, the DPDP Rules were notified on 14 November 2025 and phase in over 12 to 18 months. One touchpoint inventory can serve both workstreams.
The bottom line
Conclusion
Like food labelling, Article 50 works only when every party plays its part. Providers build disclosure and marking into their products, and deployers ensure that people see the right notice at the right moment. The last marking grace period ends on 2 December.
The organisations in a sound position know every AI touchpoint, their role for each, its owner and the provider's written answer. This week, list every place AI meets a customer or produces public content, and mark each one provider or deployer.
Frequently asked questions
Did the EU AI Act Omnibus delay Article 50?
No. The Digital Omnibus on AI postponed high-risk obligations to 2 December 2027 and 2 August 2028. Article 50 transparency obligations applied on schedule from 2 August 2026.
What is the Article 50(2) grace period?
AI systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking duty. No other Article 50 obligation received a grace period.
Is my company responsible if it uses a third-party chatbot?
The Article 50(1) disclosure duty sits with the provider. Deployers still carry duties under Article 50(3) and 50(4), and a company releasing a chatbot under its own name can become the provider.
Does AI-generated text on a company blog need a label?
Text published to inform the public on matters of public interest needs a label, unless it has undergone human review with a person holding editorial responsibility.
What are the fines for breaching Article 50?
Fines can reach EUR 15 million or 3% of total worldwide annual turnover, with enforcement mainly by national market surveillance authorities.
References
- European Commission, Transparency obligations under Article 50 of the AI Act
- EUR-Lex, Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), Annex III (2024)
- Gibson Dunn, EU AI Act Omnibus: postponed high-risk deadlines
- ActuIA, AI Act: obligations in force and delays under omnibus Regulation (EU) 2026/1744
- The Week (PTI), Govt notifies DPDP Rules, phased over 12 to 18 months
- Press Information Bureau, DPDP Rules 2025 explainer (PDF)
Disclaimer: General information only, not legal, security, compliance or financial advice. Check the cited sources and seek professional advice. Names belong to their owners; no endorsement implied.