EU AI Act Article 50: Chatbot Disclosure, AI Content Marking, Deepfake Labels, and Who Gets Until December 2, 2026 to Mark Outputs

What does Article 50 of the EU AI Act require?

Article 50 requires providers to build chatbots and other AI systems that interact directly with people so that people are told they are interacting with an AI system, and to mark the outputs of generative AI systems in a machine-readable format so they are detectable as artificially generated or manipulated. It requires deployers to inform people exposed to emotion recognition or biometric categorisation and to disclose deepfakes. Deployers must also disclose AI-generated or manipulated text published to inform the public on matters of public interest, unless it has had human review or editorial control and a natural or legal person holds editorial responsibility. Each duty carries its own exceptions, set out below.

These duties apply whether or not the system is high-risk. Paragraphs 1 to 4 do not affect the high-risk requirements in Chapter III and are without prejudice to other transparency obligations for deployers in Union or national law (Article 50(6)).

Who does Article 50 reach?

It reaches providers and deployers, and the table below shows which paragraph binds which. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge (Article 3(3)). A deployer uses an AI system under its authority, except in the course of a personal non-professional activity (Article 3(4)). One company can hold both roles. The Commission’s Article 50 guidelines (content approved July 20, 2026, not yet formally adopted; see below) give the example of a company that builds a generative system in-house and uses it to make deepfakes.

The Act reaches providers placing AI systems on the EU market or putting them into service there, wherever they are established, deployers established or located in the EU, and providers and deployers in a third country where the output produced by the AI system is used in the EU (Article 2(1)(a) to (c)). The free and open-source exemption does not cover systems that fall under Article 50 (Article 2(12)).

Article 50 by paragraph, as of November 2, 2026

Paragraph	Who	Duty	Exceptions and limits
50(1)	Providers	Design and develop AI systems intended to interact directly with natural persons so that the persons concerned are informed that they are interacting with an AI system	Obvious to a reasonably well-informed, observant, and circumspect person, taking into account the circumstances and the context of use; systems authorised by law to detect, prevent, investigate, or prosecute criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties, unless available for the public to report a criminal offence
50(2)	Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video, or text	Mark outputs in a machine-readable format, detectable as artificially generated or manipulated, with technical solutions that are effective, interoperable, robust, and reliable as far as technically feasible	To the extent the system performs an assistive function for standard editing or does not substantially alter the input data provided by the deployer or its semantics; where authorised by law to detect, prevent, investigate, or prosecute criminal offences
50(3)	Deployers of emotion recognition or biometric categorisation systems	Inform the natural persons exposed of the operation of the system, and process personal data under the GDPR, Regulation (EU) 2018/1725, and Directive (EU) 2016/680, as applicable	Systems permitted by law to detect, prevent, or investigate criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties, and in accordance with Union law
50(4), first subparagraph	Deployers of systems generating or manipulating deepfake image, audio, or video	Disclose that the content has been artificially generated or manipulated	Use authorised by law for criminal offences; for evidently artistic, creative, satirical, fictional, or analogous works, the duty narrows to disclosing the existence of the content in a way that does not hamper the display or enjoyment of the work
50(4), second subparagraph	Deployers of systems generating or manipulating text published to inform the public on matters of public interest	Disclose that the text has been artificially generated or manipulated	Use authorised by law for criminal offences; or human review or editorial control plus a natural or legal person holding editorial responsibility for the publication
50(5)	Providers and deployers under paragraphs 1 to 4	Give the information in a clear and distinguishable manner at the latest at the time of the first interaction or exposure, conforming to the applicable accessibility requirements	None stated
50(7)	The Commission	Encourage and facilitate codes of practice on detection, marking, and labelling, and assess, taking utmost account of the Board’s opinion, whether adherence is adequate for paragraphs 2 and 4	Not applicable
111(4)	Providers of generative systems placed on the market before August 2, 2026	Take the necessary steps to comply with Article 50(2) by December 2, 2026	Covers only the Article 50(2) marking duty

What must a chatbot disclose under Article 50(1)?

That the user is talking to an AI system. Providers must ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant, and circumspect, taking into account the circumstances and the context of use. The duty also does not apply to AI systems authorised by law to detect, prevent, investigate, or prosecute criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties, unless those systems are available for the public to report a criminal offence.

The duty sits with the provider. The guidelines say the means of informing people should be embedded in the design and development of the system, and that the provider remains responsible for people being informed throughout the system’s lifecycle. The Commission’s Q&A says the obviousness exception should be read restrictively and that systems working only in the background or machine to machine fall outside the duty.

What does the Article 50(2) marking duty require of generative AI providers?

Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video, or text content must ensure that the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. Their technical solutions must be effective, interoperable, robust, and reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation, and the generally acknowledged state of the art, as may be reflected in relevant technical standards.

The duty does not apply to the extent the system performs an assistive function for standard editing or does not substantially alter the input data provided by the deployer or the semantics thereof, or where authorised by law to detect, prevent, investigate, or prosecute criminal offences. The guidelines list grammar correction, spellchecking, and AI-generated translations of text among their examples of standard editing and minor alterations that fall outside the marking duty. They also describe a narrow, cumulative exception for strictly technical business-to-business or industrial outputs kept inside the organisation. That exception is the Commission’s reading, not text in the Act.

The voluntary Code of Practice, covered below, is more specific than the Act. Its providers section commits signatories to at least two layers of machine-readable marking, digitally signed metadata and an imperceptible watermark, for audio, images, video, and containerised text, so long as no single technique meets the four Article 50(2) requirements on its own. One layer, the imperceptible watermark, suffices for free-form text, which cannot carry metadata. One layer also suffices for generative systems embedded in physical products whose outputs are kept inside a technically controlled, closed environment.

What must deployers of emotion recognition or biometric categorisation tell people?

Deployers of an emotion recognition system or a biometric categorisation system must inform the natural persons exposed to it of the operation of the system, and must process the personal data in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable (Article 50(3)). The duty does not apply to systems permitted by law to detect, prevent, or investigate criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties, and in accordance with Union law. The Commission’s Q&A says this does not require explaining the purpose of the system, and that it applies whether the system runs in real time or after the fact.

A notice does not make a use lawful. Article 5(1)(f) bans placing on the market, putting into service for this specific purpose, or using AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons. Article 5(1)(g) bans certain biometric categorisation that infers sensitive traits such as race or sexual orientation; the penalties and prohibited practices guide gives its full text and exceptions. Biometric categorisation according to sensitive or protected attributes, and emotion recognition, are also listed in Annex III, point 1, in so far as their use is permitted under relevant Union or national law, so they are high-risk unless the Article 6(3) derogation applies, and the high-risk duties apply to them from December 2, 2027 (Article 113(c)(i)).

When must deepfakes and AI-generated text be labelled?

A deepfake is AI-generated or manipulated image, audio, or video content that resembles existing persons, objects, places, entities, or events and would falsely appear to a person to be authentic or truthful (Article 3(60)). Deployers of a system that generates or manipulates such content must disclose that it has been artificially generated or manipulated, unless the use is authorised by law to detect, prevent, investigate, or prosecute criminal offences. Where the content forms part of an evidently artistic, creative, satirical, fictional, or analogous work or programme, the duty is limited to disclosing the existence of the generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work.

For text, deployers of a system that generates or manipulates text published with the purpose of informing the public on matters of public interest must disclose that it has been artificially generated or manipulated. That does not apply where the use is authorised by law to detect, prevent, investigate, or prosecute criminal offences, or where the content has undergone a process of human review or editorial control and a natural or legal person holds editorial responsibility for its publication. The editorial exception needs both conditions.

The guidelines say spell-checking, the mere existence of an editorial policy, automated review, or cursory sign-off do not count as human review or editorial control, and that substantive AI changes after sign-off void the exception. The Q&A adds that deployers cannot simply rely on the provider’s machine-readable marking to meet their disclosure duty, and that content generated before August 2, 2026 need not be labelled retroactively. The guidelines add that public-interest text generated before that date but published on or after it must be labelled.

When does Article 50 apply, and did the Digital Omnibus change it?

Article 50 applies from August 2, 2026, the general date of application in Article 113. Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since July 27, 2026, did not change that date. It added Article 111(4): providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video, or text content that were placed on the market before August 2, 2026 must take the necessary steps to comply with Article 50(2) by December 2, 2026. Recital 38 of the Omnibus calls this a transitional period of four months.

The grace period covers marking only, and only for systems placed on the market before August 2, 2026. The guidelines apply this to a system that is partly interactive and partly generative: it gets the extra time for marking but had to meet the Article 50(1) disclosure duty from August 2, 2026. The guidelines describe the transitional period as covering systems “placed on the market or put into service” before August 2, 2026; Article 111(4) says only “placed on the market”, and the guidelines are non-binding.

What are the Code of Practice and the Commission guidelines, and are they binding?

Neither is binding, but the Code changes how compliance is shown. The Omnibus rewrote Article 50(7) and removed the Commission’s power to approve codes by implementing act. The Commission now assesses, taking utmost account of the Board’s opinion, whether adherence is adequate to ensure compliance with paragraphs 2 and 4. If it deems a code inadequate, it may adopt an implementing act with common rules. Recital 41 of the Omnibus says these codes have limited legal effect and do not grant a presumption of conformity.

The Code of Practice on Transparency of AI-generated Content has two sections: one for providers on marking and detection, one for deployers on labelling deepfakes and AI-generated and manipulated text, with three common EU icons that signatories may use. In Opinion C(2026) 4839 final of July 8, 2026, the Commission concluded that it adequately covers Article 50(2), (4), and (5) and that providers and deployers may rely on it, while recognising that adherence does not constitute conclusive evidence of compliance. The AI Board adopted its own adequacy assessment the next day. Both assessments were made under the rules in force before the Omnibus; the opinion says they remain valid after the Omnibus applies as long as their conclusions are consistent. The Commission’s Q&A says providers and deployers of generative AI systems that do not adhere will have to show compliance through alternative adequate means and may be subject to more requests for information.

The Commission reported that about 190 organisations had signed by the end of July 2026. Its signatory page, last updated September 24, 2026, shows counts of 95 for Section 1 (providers) and 192 for Section 2 (deployers). Organisations can sign either section or both, so the two counts overlap and are not a total.

The guidelines come from Article 96(1)(d), not Article 50(7). On July 20, 2026 the Commission approved their content in Communication C(2026) 5054 final, which says they will be formally adopted when all language versions are available and are applicable only from that moment. As of November 2, 2026, we found no formally adopted version, although the Commission’s page says it adopted them. The guidelines describe themselves as non-binding.

What can a breach of Article 50 cost, and who enforces it?

Non-compliance with the transparency obligations for providers and deployers under Article 50 is subject to administrative fines of up to €15 million or, if the offender is an undertaking, up to 3% of its total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(4)(g)). For SMEs, including start-ups, each fine is capped at the lower of the two figures (Article 99(6)), and the Omnibus extended the lower figure to small mid-cap enterprises for this tier (Article 99(6a)). Member States lay down the rules on penalties and other enforcement measures, which may also include administrative fines, warnings, and non-monetary measures (Article 99(1)).

The Commission’s Q&A says national market surveillance authorities do most of the enforcing. The AI Office has a limited role, covering systems built on a general-purpose AI model where the same entity provides the model and the system, and systems integrated into a very large online platform or search engine designated under the Digital Services Act.

What should a company do now to meet Article 50?

• List every AI system the company places on the market or puts into service in the EU, uses in the EU, or provides or uses elsewhere where the output is used in the EU, and record the company’s role for each: provider, deployer, or both
• As a provider, design every AI system intended to interact directly with people (chatbots, voice agents, AI agents) so that they are told they are interacting with an AI system, and document any reliance on the obviousness exception
• For generative systems you provide, implement machine-readable marking and detection, and record why the technique meets the Article 50(2) test
• Confirm the placing-on-market date of each generative system; only systems placed on the market before August 2, 2026 get until December 2, 2026 for marking
• Where you deploy emotion recognition or biometric categorisation, first confirm the use is not banned under Article 5(1)(f) or (g), then inform the people exposed to it
• Disclose deepfakes in a clear and distinguishable manner at the latest at first exposure, and use the reduced disclosure only for evidently artistic, creative, satirical, fictional, or analogous works or programmes
• For text published to inform the public on matters of public interest, either label it or document the human review or editorial control and name who holds editorial responsibility
• Decide whether to sign the Code of Practice on Transparency of AI-generated Content; if not, document the alternative means you rely on

How this fits the other guides: the EU AI Act compliance guide covers scope, risk tiers, and the Omnibus dates; the penalties and prohibited practices guide sets out every Article 99 tier and the Article 5 bans; and the EU AI Act compliance checklist lists each duty by role with its article number.

This guide reflects information as of November 2, 2026. It is not legal advice; confirm how Article 50 applies to your systems with counsel or the competent market surveillance authority.

By industry: all 8 industry pages

Latest: EU AI Act news, each entry dated and sourced.