EU AI Act Article 50 Transparency Obligations: When They Apply and How to Evidence Them at Runtime

What Article 50 covers and when it applies

Article 50 of Regulation (EU) 2024/1689 sets transparency obligations for providers and deployers of certain AI systems. The Commission describes them as addressing risks of deception and manipulation. They apply from 2 August 2026, so for a regulated enterprise they are in force now.

One transitional rule matters. Under the consolidated text of 27 July 2026, providers of AI systems that generate synthetic audio, image, video or text and were placed on the market before 2 August 2026 must take the necessary steps to comply with Article 50(2) by 2 December 2026. This relief covers Article 50(2) only. It does not defer the other Article 50 obligations.

Article 50 also sits alongside the high-risk regime, not inside it. The Digital Omnibus, in force since 27 July 2026, moved high-risk dates to 2 December 2027 for stand-alone systems and 2 August 2028 for systems embedded in products. Those changes do not move the Article 50 start date. A chatbot can therefore owe Article 50 disclosure whatever its high-risk classification, and classification does not remove the transparency duty.

Four obligations, mapped to role and content

Treat each row as a separate question. A single customer journey, such as a support chat that ends with a generated PDF, can trigger more than one of them. Roles can also differ by use case: an enterprise may be a provider for a system it builds and a deployer for a third-party model it uses.

• AI interaction disclosure, Article 50(1): Provider duty. Systems intended to interact directly with people must be designed and developed so the persons concerned are informed they are dealing with an AI system. This does not apply where it is obvious to a reasonably well-informed, observant and circumspect person, given the circumstances and context of use.
• Marking of synthetic output, Article 50(2): Provider duty for systems generating synthetic audio, image, video or text. Technical solutions for marking or detection must be effective, interoperable, robust and reliable as far as technically feasible, taking into account content type, cost and the state of the art.
• Deepfake disclosure, Article 50(4): A labelling obligation that attaches to content the enterprise publishes or delivers. It is addressed by the Code of Practice together with marking. Confirm your role against the operative text.
• AI-generated text published to inform the public, Article 50(4): A separate labelling obligation tied to the purpose of publication, not to the model. A private customer email and a public-facing informational article may fall on different sides of it. Scope is a matter for counsel.

Exceptions and what is still settling

Three exceptions are stated in the text. The first is obviousness under Article 50(1), which is an objective test about a reasonably well-informed person in context. It is assessed per use case, not per model, and an enterprise relying on it should record why interaction with AI was obvious in that setting. The second removes the disclosure duty for AI systems authorised by law to detect, prevent, investigate or prosecute criminal offences, subject to safeguards for third parties. It falls away where those systems are available to the public to report a criminal offence. The third covers evidently artistic, creative, satirical, fictional or analogous works, where the obligations are limited to disclosing the existence of generated or manipulated content in a way that does not hamper display or enjoyment of the work.

The law does not prescribe a specific watermark or metadata format. It frames marking and detection as technical solutions judged against feasibility and the state of the art, as may be reflected in technical standards. The Commission has also published a voluntary Code of Practice on Transparency of AI-generated Content, drawn up by independent experts in a process facilitated by the AI Office. It addresses labelling and marking under Article 50(2), (4) and (5) and gives signatories a recognised framework to demonstrate compliance. It does not replace the Act or the Commission's guidelines on the scope of Article 50. Adoption is a decision for the enterprise, and the legal duties apply either way.

A practical sequence for compliance leaders

Start with an inventory of customer-facing AI use cases covering chatbot replies, emails, documents, images, audio and video. For each, record role, content type and any exception claimed, and let counsel confirm role and scope. Legal determinations should not be delegated to tooling.

Next, flag systems placed on the market before 2 August 2026 that generate synthetic audio, image, video or text, because their Article 50(2) transitional deadline is 2 December 2026. Decide whether to adopt the voluntary Code of Practice, and keep a dated register of regulatory changes, since several dates moved during 2025 and 2026. Cite the consolidated text of 27 July 2026, not earlier versions.

Finally, move each control from policy to enforcement. Where policy is enforced in the execution path, the enforcement itself generates audit-ready evidence that can be mapped to the EU AI Act. Trussed does this in the path, with self-managed deployment in the customer cloud and configurable retention and data residency. The test is whether you can show, for one named interaction, that the disclosure or marking step ran before delivery.