25 October 2026

Article 50 of the EU AI Act: who has to disclose, and what

Something odd happened this summer. The Digital Omnibus postponed the high-risk obligations and a good part of the sector exhaled: it's off, we have until 2027. The headline was true and the conclusion was wrong. Because on that same 2 August 2026, with almost nobody noticing, Article 50 started to apply — and nobody touched that one.

What the Omnibus moved, and what it did not

Regulation (EU) 2026/1744, the AI Digital Omnibus, came into force on 27 July 2026, six days before the date that was meant to switch on half the regulation. What it moved is specific:

Put another way: what has been pushed back is the expensive, document-heavy part — risk management systems, technical documentation, conformity assessments. What already applies is the cheap part, and that is precisely why it is awkward to justify when it has not been done.

The four duties, and whose they are

This is the confusion I run into most often: people talk about "the obligation to label AI content" as if it were one thing that lands on everyone equally. It is not. The article splits four duties between two different roles.

If you use somebody else's tools — which is the case for nearly every small organisation — your duties are 50(3) and 50(4). The technical marking in 50(2) is OpenAI's job, or Google's, or whoever sold you the tool. Not that you can ignore it entirely, because a provider who does not comply leaves you with a problem; but the obligation is not yours.

50(1) — say that it is a bot

The regulation asks that the system be designed so the person knows they are interacting with an AI, unless this is obvious from the point of view of a reasonably well-informed, observant and circumspect person, taking into account the circumstances and the context of use.

That obviousness clause is narrower than people assume. An assistant with a human name, a conversational tone and a face for an avatar is not obvious. And the test is not what you think, but what that reasonably attentive person — who does none of this for a living — would think.

50(2) — the marking that is not yours

Providers of systems generating synthetic audio, image, video or text must mark the outputs in a machine-readable format, detectable as artificially generated or manipulated. The regulation allows a dose of realism here: the solution must be effective, interoperable, robust and reliable as far as is technically feasible, taking into account costs and the state of the art.

And there is an important carve-out: it does not apply where the system performs an assistive function for standard editing or does not substantially alter the input data or its semantics. Your word processor's spell-checker is not in scope.

50(3) — emotions and biometrics

If you deploy an emotion recognition or biometric categorisation system, you must inform the people exposed to it and process their data under the GDPR. Worth remembering that in the workplace and in education, emotion recognition is no longer a transparency question at all: it has been prohibited since February 2025, with narrow safety and medical exceptions. Article 50(3) covers the remaining contexts.

50(4) — deep fakes and text

A deployer of a system that generates or manipulates image, audio or video constituting a deep fake must disclose that the content is artificial. With two qualifications worth knowing:

• Where the content forms part of an evidently artistic, creative, satirical or fictional work, it is enough to disclose the existence of the generated content in a way that does not hamper the display or enjoyment of the work. No caption burned over every shot.
• For text, the duty only reaches what is published with the purpose of informing the public on matters of public interest. Not any text at all.

The exception almost nobody reads

And here is the part I find most interesting in the whole article. The duty to disclose AI-generated text falls away where the content has undergone a process of human review or editorial control and a natural or legal person holds editorial responsibility for the publication.

Read closely, that is not a loophole to slip through: it is a statement about what the legislator actually cares about. It is not troubled by a machine having written a draft. It is troubled by something being published that nobody answers for. If there is a name behind the content that answers for it, the disclosure stops making sense, because the chain of accountability is already closed.

It is the same test any newsroom has used for decades, and it is the one I apply on this blog: whatever tools I use are beside the point as long as I take responsibility for what comes out — and as long as I correct it publicly, with a date, when it turns out to be wrong.

What happens on 2 December 2026

You will see this date circulating as though it were a new general deadline. It is not. From what the published analyses of the transitional regime indicate, 2 December 2026 is the end of the grace period for the machine-readable marking in Article 50(2), for generative systems already on the market before 2 August 2026. Anything placed on the market from that date had to comply from day one.

In other words: it is a date for providers of generative models and systems, not for the companies using them. If you run a small company, 2 December asks nothing new of you. What it is worth knowing is that from then on you should be able to expect the tools you use to mark what they generate — and to ask your vendor if they do not.

There is another date on the horizon, in February 2027, concerning interoperable solutions for detecting that marking. When it gets closer and more is known, I will come back to it.

How you actually comply

Paragraph 5 is short and it is the one most often skipped. It says the information in paragraphs 1 to 4 must be given:

• in a clear and distinguishable manner;
• at the latest at the time of the first interaction or exposure;
• and meeting the applicable accessibility requirements.

All three have practical consequences. "Clear and distinguishable" rules out a notice buried in the terms of use. "At the latest at first interaction" rules out disclosing at the end of the conversation. And accessibility rules out a notice that exists only as an image with no alternative text, or at a contrast nobody can read.

From a governance seat: what to keep on file

So much for what the rule says. Now the part closer to my own trade: complying and being able to show that you comply are not the same job. If someone asks one day — a regulator, a large client in a procurement process, a journalist — what helps is a record, not a recollection.

Four things are enough:

1. An inventory of the points where your systems meet people. Which of them talk to someone, generate published content, or process biometrics. With the role you play in each: provider or deployer.
2. Screenshots of the notices. An image of how the disclosure appears in the chatbot or on the content, dated. If the design changes, a new one. It is the cheapest document there is and the one most often missing.
3. What your vendor says. Ask in writing whether they mark outputs under Article 50(2), and keep the answer. If they give you none, that is information too.
4. Who holds editorial responsibility. If you publish, write down who reviews and who answers for it. That is what activates the 50(4) exception, and it does not work as a retrospective claim.

None of this needs a tool or a budget. It needs the discipline of writing it down while it happens, which is always the hard part.

A concrete example

An online shop with eight people. It has a customer service chatbot with a friendly name, publishes product descriptions drafted with AI help, and at Christmas makes a promotional video with a generated voice.

• The chatbot: the 50(1) notice is needed. Since it is the provider who must design it that way, check that the tool you bought carries it; if not, add a first line that says so yourself.
• The product descriptions: not text published to inform the public on matters of public interest. Outside 50(4). (Which does not mean you should not review them — it means the law does not require you to label them.)
• The video with a generated voice: if the voice imitates a real person in a way that could pass for authentic, it is a deep fake and must be disclosed. A synthetic voice imitating nobody does not trigger the case.
• Training: Article 4 still applies, now in the version softened by the Omnibus. I wrote about that in the piece on mandatory AI training.

And if you do not comply

Breaching Article 50 sits in the penalty tier of up to €15 million or 3% of worldwide annual turnover — and for small companies and start-ups, the regulation expressly provides for the lower of the two. I mention it for completeness, not as the argument: the market surveillance machinery is still being stood up, and the realistic risk for a small organisation today is not a fine.

The realistic risk is a different one: that someone finds out they were talking to a bot without knowing it, or that content presented to them as authentic was not. That is not paid for in money. It is paid for in credibility, which is far more expensive to get back. Seen from here, the transparency in Article 50 is one of the few obligations that protects the person complying as much as the person on the receiving end.

This article is general information, not legal advice. For a specific decision with legal consequences, consult a qualified lawyer. The reference text is Article 50 of Regulation (EU) 2024/1689, in the version in force after Regulation (EU) 2026/1744.