The short answer: from August 2, 2026, if your AI product is available to users in the EU, Article 50 of the EU AI Act requires four things: (1) chatbots and other AI that talks to people must disclose they are AI; (2) synthetic audio, image, video and text must carry machine-readable marking; (3) deepfakes must be visibly labelled; (4) people exposed to emotion recognition or biometric categorisation must be informed. Unlike the high-risk rules — which the Digital Omnibus pushed to 2027–2028 — Article 50 was not delayed.
This guide breaks down who owes what, the exemptions, the fresh Commission guidance, and a realistic three-week compliance plan.
Who this applies to (yes, including US companies)
Article 50 follows the AI Act’s extraterritorial logic: it applies to any company placing an AI system on the EU market or whose system’s output is used in the EU — regardless of where the company is incorporated. A US SaaS with EU users is in scope. So is an Israeli AI startup selling to a German enterprise, and a Singapore app with users in France.
The Act splits duties between two roles:
- Provider — you build or substantially modify the AI system (or have it built and market it under your brand). Most AI startups are providers.
- Deployer — you use an AI system in a professional context. If you build and use your own system, you can wear both hats at once.
The four obligations, one by one
1. AI that interacts with people must say so — Art. 50(1), providers
If your system is designed to interact directly with humans — chatbots, AI support agents, voice assistants, automated phone systems, AI copilots — you must design it so people know they are interacting with AI.
The exemption: disclosure isn’t required where it’s “obvious” to a reasonably well-informed, observant and circumspect person from the context. In practice, founders systematically overestimate what’s obvious. Your power users know your copilot is AI; the procurement manager testing the product does not. The Commission’s draft guidelines read the exemption narrowly — the safe pattern is an explicit notice at the start of the interaction.
What compliant looks like in the UI:
- A persistent or first-message label: “You’re chatting with an AI assistant” — clear, in the interface language, before or at first interaction.
- Voice systems: a spoken disclosure at the start of the call.
- Don’t bury it in the ToS. Article 50(5) requires the information to be provided in a clear and distinguishable manner at first interaction.
2. Synthetic content must be machine-detectable — Art. 50(2), providers
If your system generates synthetic audio, images, video or text (including via a general-purpose model you’ve built on), outputs must be marked in a machine-readable format and detectable as artificially generated — think metadata standards and watermarking. The law asks for solutions that are effective, interoperable, robust and reliable “as far as technically feasible” — a proportionality clause that helps startups, but doesn’t excuse doing nothing.
Exemptions: assistive functions and standard editing — an AI that fixes grammar or removes red-eye, or that doesn’t substantially alter the input the deployer provides, isn’t “generating synthetic content” in this sense. One trap to avoid: the human-editorial-review carve-out you may have heard about belongs to the visible text-disclosure duty under Art. 50(4) (below) — it does not remove the provider’s machine-readable marking duty under Art. 50(2).
Timing nuance from the Digital Omnibus: the machine-readable watermarking piece gets a grace period to December 2, 2026 — but only for systems already on the EU market by August 2, 2026. Launch after that date and you comply in full from day one.
3. Deepfakes and public-interest text must be visibly labelled — Art. 50(4), deployers
Two separate duties here:
- Deepfakes — AI-generated or manipulated image, audio or video that resembles real people, places or events — must be disclosed as artificially generated. For artistic, creative or satirical works the disclosure can be discreet (it must not spoil the work), but it must exist.
- AI-generated text published to inform the public on matters of public interest must be disclosed — unless the text has undergone human review and someone (a person or company) holds editorial responsibility for it. This is the clause your AI-written blog workflow lives or dies by: human editorial review with accountability removes the labelling duty for text.
4. Emotion recognition and biometric categorisation — Art. 50(3), deployers
If you operate systems that infer emotions or categorise people by biometric data, you must inform the individuals exposed (and handle the personal data under GDPR). Remember the harder rule sitting above this one: emotion inference in workplaces and educational institutions is prohibited outright since February 2025, save narrow medical/safety exceptions.
Provider vs deployer: the cheat sheet
| Obligation | Who owes it | Visible to user? | Deadline |
|---|---|---|---|
| Disclose AI interaction (chatbots, agents, voice) | Provider | Yes — UI notice | Aug 2, 2026 |
| Machine-readable marking of synthetic content | Provider | No — metadata/watermark | Aug 2, 2026 (watermark grace to Dec 2, 2026 for systems already on market) |
| Deepfake labelling | Deployer | Yes — visible label | Aug 2, 2026 |
| Public-interest AI text disclosure (unless human editorial review) | Deployer | Yes | Aug 2, 2026 |
| Inform people exposed to emotion recognition / biometric categorisation | Deployer | Yes — notice | Aug 2, 2026 |
All information must be provided clearly, at the latest at first interaction or exposure, and in a manner accessible to the user (Art. 50(5)).
The new official guidance you should actually use
Two documents landed in mid-2026 that most compliance write-ups haven’t caught up with:
- Commission draft Guidelines on Article 50 (published for consultation on May 8, 2026; final version expected before the August deadline). They interpret scope, the “obvious from context” exemption, and definitions. Practical takeaway: the Commission reads exemptions narrowly and expects disclosure design, not disclosure fine print.
- Code of Practice on Transparency of AI-Generated Content (published June 10, 2026). Voluntary, but following it is the cheapest way to show good faith: it includes uniform EU icons and text labels for deepfakes, guidance on label placement, and marking techniques for Art. 50(2), (4) and (5). If you need a defensible default for how your labels should look — start here.
Penalties, and the risk that actually bites first
Non-compliance with Article 50 can draw fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher (for SMEs and startups, the cap is the lower of the two). For an early-stage startup, though, the fine is rarely the first pain point. What arrives sooner: an enterprise customer’s procurement questionnaire asking “describe your EU AI Act transparency measures,” an investor’s DD checklist, or a competitor reporting your unlabelled chatbot. Compliance here is a sales asset — the startups that can answer in one paragraph close faster.
Your 3-week compliance plan
Week 1 — inventory. List every place your product (a) talks to users, (b) generates content, (c) touches biometrics or emotions. Classify each against the four obligations. Decide provider vs deployer per feature.
Week 2 — ship. Add interaction disclosures (first-message label, voice intro); wire machine-readable marking into generation pipelines (follow the Code of Practice defaults); add visible deepfake labels; set up the human-editorial-review workflow for published AI text.
Week 3 — document. Write a one-page transparency memo: what you disclose, where, and why exemptions apply where you rely on them. Screenshot the UI states. Regulators — and enterprise buyers — ask for records.
Full context on how Article 50 fits the broader compliance calendar: see our EU AI Act timeline 2026–2028.
FAQ
When does Article 50 of the AI Act apply?
From August 2, 2026. It was not delayed by the Digital Omnibus. Only the machine-readable watermarking element has a grace period to December 2, 2026, and only for systems already on the EU market by August 2, 2026.
Does Article 50 apply to non-EU companies?
Yes. It applies to any provider or deployer whose AI system is placed on the EU market or whose output is used in the EU, wherever the company is established.
Does my customer-support chatbot need a disclosure?
Almost certainly yes, unless it’s genuinely obvious from context that users are talking to AI. The safe pattern is an explicit notice at the start of the conversation.
Do I have to label all AI-generated text?
No. The visible-disclosure duty covers text published to inform the public on matters of public interest — and even then, human review with editorial responsibility lifts it. Machine-readable marking at the generation layer is the provider-side duty.
What are the penalties for violating Article 50?
Up to €15 million or 3% of global annual turnover, whichever is higher — for SMEs and startups, whichever is lower.
Is there an official standard for how labels should look?
The voluntary Code of Practice on Transparency of AI-Generated Content (June 2026) provides uniform EU icons, text labels and placement guidance. Following it is the simplest defensible default.