Do internal employee copilots need Article 50 AI disclosure?

What Article 50(1) requires, and where employee copilots fit

Article 50 sits in Chapter IV of the AI Act, titled transparency obligations for providers and deployers of certain AI systems. Paragraph 1 is a design-and-development duty on providers. AI systems intended to interact directly with natural persons must be built so that those persons are informed they are interacting with an AI system. The exception applies where this is obvious.

The exception is assessed from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use. That is a contextual test. An employee told in a rollout memo that a tool is an AI assistant, using an interface named and labelled as one, is in a different position from an employee reaching a model through a chat window that resembles a colleague or a service desk.

An employee is a natural person, and a copilot that converses with staff interacts with them directly. The text does not address internal tools expressly. Applying paragraph 1 therefore turns on the phrase interact directly with natural persons and on the obviousness exception, and both call for a reasoned, recorded reading rather than a blanket rule. Because paragraph 1 is a design duty, disclosure is a property of how the system is built or configured, not only of a notice in a policy document.

Which Article 50 paragraphs could apply to an internal copilot

Each paragraph has its own trigger. Start from what the copilot actually does, then read the paragraph text against that function. The table gives the trigger question for each, not a conclusion.

• Article 50(1): AI interaction disclosure: Could apply when the copilot interacts directly with people. Test the obviousness exception against the real employee population and interface.
• Article 50(2): marking of synthetic output: Concerns marking of generated content. Relevant mainly where output leaves the organization. The Commission's voluntary code of practice covers this paragraph.
• Article 50(3): emotion recognition and biometric categorisation: Engaged only if the copilot includes such functions. A text-only assistant with no such features gives a short, documentable answer.
• Article 50(4): deepfake and public-interest text disclosure: Relevant where staff use the copilot to produce content that is published or presented externally. The code of practice also addresses this paragraph.
• Article 50(5): information requirements: The Commission's working groups considered horizontal requirements for information provided to natural persons under this paragraph.

Provider, deployer or both

Paragraph 1 places the duty on providers, so the role analysis decides who must act. An enterprise that builds or configures a copilot on a third-party model may be a deployer, a provider or both, depending on what it does with the system. Record the analysis for each copilot rather than assuming one role across the portfolio.

The Act contains a role-shifting rule for high-risk systems: a distributor, importer, deployer or other third party is considered a provider and subject to Article 16 obligations in specified circumstances. That rule is written for high-risk systems and should not be assumed to carry over to Article 50. Where the model vendor and the enterprise each handle part of the system, allocate responsibility for disclosure and for marking synthetic output in the contract, and keep the allocation with the determination.

If a copilot is also used in a high-risk context, deployer duties for high-risk systems apply separately. Under the Digital Omnibus, which the Commission states entered into force on 27 July 2026, the dates are 2 December 2027 for stand-alone high-risk systems and 2 August 2028 for high-risk systems embedded in products, as of November 2026.

Legal obligation, good practice and open questions

Separate three categories in the decision memo. First, legal obligation: the text of Article 50, which the Commission describes as legal obligations even though adherence to the related code of practice is voluntary. Second, good practice: the Code of Practice on Transparency of AI-generated Content, which is intended to help providers and deployers comply with Article 50(2), (4) and (5), and disclosure on tools where the Act does not require it. Third, open interpretation: whether an internal employee copilot falls within paragraph 1 and when obviousness is met for a given workforce.

Timing also needs a stated basis. A provisional agreement of 7 May 2026 reduced the grace period for providers to implement transparency solutions for artificially generated content from six months to three, with a deadline of 2 December 2026. Date the memo and record which timeline you relied on, as of November 2026.

Technical solutions for marking must be effective, interoperable, robust and reliable as far as technically feasible, taking into account content types, implementation costs and the generally acknowledged state of the art. Content that forms part of an evidently artistic, creative, satirical, fictional or analogous work has a limited disclosure duty that must not hamper display or enjoyment of the work.

Workplace use brings separate duties. Recital 92 states the Act is without prejudice to employers' obligations under Union or national law to inform, or inform and consult, workers or their representatives on decisions to put AI systems into service or use. Informing workers about planned deployment of high-risk systems at the workplace remains necessary where those other instruments' conditions are not fulfilled. Article 4 AI literacy is also a separate duty, and a disclosure decision does not substitute for it.

Where runtime policy enforcement helps

A configured disclosure and a delivered disclosure are different facts. Trussed enforces policy in the execution path across models, agents, tools and coding assistants. It can allow, redact or block individual interactions, and it generates audit-ready evidence mapped to the EU AI Act. For a disclosure decision, that means the record reflects what the interaction path did at runtime, enforced at runtime, not reviewed after the fact.

This supports the evidence step only. Trussed does not provide legal determinations and does not guarantee compliance. Whether a given disclosure satisfies Article 50, and whether the obviousness exception applies, remain determinations for your legal and compliance function.