EU AI Act Article 50 transparency, in force since 2 August 2026

Article 50 is the part of the EU AI Act that reaches the most organisations, and the part that did not move when the rest of the timetable slipped. It restricts no use of AI. It requires that people be told when AI is involved, and that AI-generated content be marked so it can be detected.

Section one

What does Article 50 actually require, and of whom?

Article 50 imposes four duties. Two sit with the provider, who develops an AI system and places it on the EU market under its own name or trademark. Two sit with the deployer, meaning any organisation using an AI system in a professional capacity. The split matters because a provider can mark content, but only the deploying organisation can label what it publishes.

The duties are risk independent. They attach to any AI system in a covered situation, whatever its risk tier. Article 50(6) of Regulation (EU) 2024/1689 states that these duties sit alongside the high-risk requirements in Chapter III rather than replacing them, so one system can carry both.

Scroll the table sideways to see every column.

Source: Regulation (EU) 2024/1689, Article 50(1) to 50(4) and Article 50(6); European Commission guidelines C(2026) 5054, content approved 20 July 2026.

Section two

Why did the transparency rules ship while the high-risk rules slipped?

Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It deferred the stand-alone Annex III high-risk regime to 2 December 2027 and the Annex I product-embedded regime to 2 August 2028. It left Article 50 on its original date.

The Commission's stated rationale is that generative and interactive systems have made it increasingly difficult to tell AI output from human output, creating risks of misinformation, manipulation, fraud and impersonation at scale. The structural reason is different in kind. A disclosure duty needs no harmonised technical standard to become operable, which is what the high-risk regime is still waiting on from CEN and CENELEC. Disclosure reaches every AI system at once, costs comparatively little, and restricts no use.

1. August 2024The AI Act enters into force

   Regulation (EU) 2024/1689 entered into force on 1 August 2024, with Article 113 setting 2 August 2026 as the general date of application for Article 50.

2. February 2025Prohibitions apply

   The bans took effect on 2 February 2025, including emotion recognition in the workplace and in education, and biometric categorisation inferring sensitive attributes.

3. June 2026The Code of Practice is published in final form

   The final text was published on 10 June 2026 after three drafting rounds, with earlier drafts on 17 December 2025 and 3 March 2026.

4. July 2026The Commission approves its Article 50 guidelines

   The content of guidelines C(2026) 5054 was approved on 20 July 2026, replacing a draft issued for consultation on 8 May 2026. Formal adoption follows once all language versions are available.

5. July 2026The Digital Omnibus on AI enters into force

   Regulation (EU) 2026/1744 was published on 24 July 2026 and entered into force on 27 July 2026, deferring the high-risk regime and granting a single Article 50(2) transition.

6. August 2026Article 50 begins to apply

   The four transparency duties became enforceable on 2 August 2026. California's AI Transparency Act became operative on the same date.

7. December 2026The marking transition ends

   Generative AI systems placed on the market before 2 August 2026 must meet the Article 50(2) marking and detection duty from 2 December 2026. A new Article 5 prohibition on systems generating non-consensual intimate imagery and child sexual abuse material applies from the same date.

8. February 2027Detection must work across providers

   Code of Practice signatories commit to having a watermark-detection interoperability solution in place by 2 February 2027.

Source: Regulation (EU) 2024/1689, Articles 5, 50 and 113; Regulation (EU) 2026/1744; European Commission Code of Practice timeline and guidelines C(2026) 5054.

Section three

Who carries the duty, the vendor or the buyer?

Both, in different places, and the split is the most commonly misread part of the regime. The provider marks the content at the point of generation. The deployer labels what it publishes and discloses the agent it puts in front of a customer. No contract moves the deployer duty back up the chain.

An enterprise can also be a provider without noticing. Where a company builds a customer-facing assistant on a vendor's model and puts it into service under its own brand, it is likely to be the provider of that system for Article 50(1) purposes. Whose name or trademark sits on the product decides who carries the design duty. The same logic applies to IT services firms delivering white-label assistants.

Source: Regulation (EU) 2024/1689, Article 50; Code of Practice on Transparency of AI-generated Content, final text, 10 June 2026, Sections 1 and 2.

On AI agents, the Commission's guidelines go further than the text of the Act, which does not mention agents at all. The guidelines read agents into Article 50(1) where they can interact with people while performing tasks such as making bookings, managing correspondence, negotiating or concluding contracts, and state that such agents should be designed to disclose both their artificial nature and the person on whose behalf they act, at each new interaction and at key operational steps. In multi-agent architectures the expectation extends to every agent capable of reaching a person. This is guidance, not statutory text, and it is not yet formally adopted.

Section four

Which parts of an enterprise are exposed?

Exposure follows function, not sector and not risk tier. An inventory built for the deferred Annex III regime will miss most of it. The functions that publish carry the deployer duties, and the functions that ship product carry the provider duties.

Two exposures are routinely underweighted. Financial services firms run customer-facing assistants and publish commentary on economic and financial developments, which the guidelines list among matters of public interest. Contact centres running voice emotion analytics on customers carry an Article 50(3) notice duty now, and those systems are separately listed as high risk under Annex III from 2 December 2027.

The deepfake definition is where marketing functions are most often caught. The guidelines give AI-generated marketing content that makes a product appear different from reality, digital replicas of real people, and the de-ageing of actors as examples that qualify. Advertising reaches the lighter creative treatment only in narrow circumstances, and most of the advertising examples in the guidelines do not.

Section five

Who has signed the Code, and who has not?

Uptake is broad at the top of the market and thin in the middle. Section 1 includes most frontier model providers selling into Europe, among them Aleph Alpha, Anthropic, Black Forest Labs, Cohere, Google, Meta, Microsoft, Mistral and OpenAI, alongside Synthesia, Resemble.ai, Bria.ai and the voice-agent company Parloa. Section 2 includes Bulgari, Fastweb, Getty Images, Iberdrola, Lenovo, Lufthansa, the National Bank of Romania and the European Court of Auditors.

Several widely used providers of generative image, video and voice tools did not appear on the list as published on 20 August 2026. Absence is not evidence of non-compliance. Every provider remains bound by Article 50 and may demonstrate compliance by other means, assessed case by case. It does mean choosing the route on which the Commission has indicated authorities are more likely to ask questions.

Section six

Does anything similar apply outside Europe?

Three other large jurisdictions now ask the same first question of generative AI output. China's labelling measures took effect on 1 September 2025 and India's synthetic-content rules on 20 February 2026. California's AI Transparency Act became operative on 2 August 2026, a date its legislature chose to align with Article 50.

Scroll the table sideways to see every column.

Filled is a stated requirement, outlined is partial or conditional, a dot is absent from that instrument. The EU detection requirement is a Code of Practice commitment rather than a statutory duty. Source: Regulation (EU) 2024/1689 and guidelines C(2026) 5054; California Business and Professions Code Chapter 25 as amended by AB 853; MeitY G.S.R. 120(E), 10 February 2026; Measures for Labelling AI-Generated Synthetic Content, 2025.

For Indian AI product companies and IT services exporters the two ends meet. Any system whose output reaches people in the EU carries Article 50 duties regardless of where the company sits. A provider that implements the Code's two-layer marking and a clear disclosure standard will already meet much of the technical substance India asks of the platforms distributing its content.

Section seven

What must a buyer settle before the next contract?

• Record, system by system, whether the organisation is the provider, the deployer or both. Whose name is on the product decides it.
• Inventory by function rather than by risk tier. Every system that talks to a person, generates content that leaves the building, or analyses emotion or biometric traits.
• Confirm the placing-on-market date of every generative system in use, because it determines whether the 2 December 2026 marking transition applies.
• Confirm whether the vendor has signed Section 1 of the Code, which marking layers its outputs carry by modality, and how third parties verify them.
• Confirm that disclosure at first interaction cannot be disabled by the organisation's own configuration, and that agents can name the principal they act for.
• Audit the publishing pipeline for provenance stripping. Content management systems, image compressors and social schedulers routinely remove metadata.
• Decide, content line by content line, between labelling public-interest text and operating a documented editorial process with a named accountable editor.
• Ask for the vendor's interoperability plan for 2 February 2027. Most vendors cannot currently answer this.

Derived from Regulation (EU) 2024/1689, Article 50; guidelines C(2026) 5054, 20 July 2026; Code of Practice, 10 June 2026.

Section eight

What breaks first?

Early enforcement will follow what is cheap to prove. An undisclosed chatbot or voice agent can be evidenced by one recorded interaction. An unlabelled advertising deepfake can be evidenced by one screenshot. The robustness of a text watermark cannot be evidenced by either, which is why the Forum expects image, audio and video to be tested before text.

Enforcement capacity is the second constraint. With 9 of 27 Member States recording both designated authorities as at mid-June 2026, identical conduct may draw attention in one Member State and none in another through the first cycle. The practical response is to comply to the strictest national reading rather than the most permissive.

The third pressure point is commercial rather than legal. Code signature is becoming a procurement question, which moves the burden of proof onto non-signatories at exactly the moment enterprise buyers are writing Article 50 clauses into contracts. For voice and agent vendors, a disclosure that must be spoken at the start of every call sits directly against the product goal of sounding human.

Global AI Forum · GAIF-RG-001 · v1.0 Research current as of 10 September 2026 gaiforum.com