EU AI Act Article 50: what the transparency rules ask of businesses

This page covers Article 50 of the AI Act (Regulation (EU) 2024/1689), the Commission's Guidelines on it, the Code of Practice, and the dates, fines and national laws around them. It is general information, not legal advice. For the other rules, start at the AI disclosure laws overview. For the accessibility law that Article 50(5) points to, see EU accessibility law.

Article 50 at a glance

Only paragraph 7 of Article 50, on codes of practice, was replaced by Regulation (EU) 2026/1744. Paragraphs 1 to 6 are unchanged. The Commission's Guidelines (C(2026) 5054 final, July 20, 2026) say of themselves that they are non-binding, and that only the Court of Justice of the European Union can authoritatively interpret the Act (paragraph 5).

Sources: Regulation (EU) 2024/1689 on EUR-Lex; Regulation (EU) 2026/1744 on EUR-Lex; Commission Guidelines (PDF). Verified October 21, 2026.

Dates that matter

The December 2, 2026 date comes from a new Article 111(4), added by the Omnibus:

"Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026."

The Commission's Q&A adds that "Content generated prior to 2 August 2026 does not need to be labelled retroactively." Systems that are partly interactive and partly generative get the grace only for the marking part: the Guidelines say compliance with the duty to disclose AI that interacts directly with people "must be ensured as of 2 August 2026".

Sources: Regulation (EU) 2026/1744, Article 1(39)(b); Commission Q&A on Article 50; Commission page for the Guidelines; Code of Practice (PDF). Verified October 21, 2026.

Provider, deployer or neither

Article 50 puts different duties on different roles, so the first job is to place yourself.

• Provider. The Guidelines say providers develop AI systems, or have them developed, and place them on the market or put them into service under their own name or trademark, for payment or free of charge. Providers outside the EU are bound where the output of their system is used in the EU, but "incidental, unforeseeable or unauthorised downstream use" does not alone trigger the duties (paragraph 10).
• Deployer. A deployer uses an AI system under its authority, meaning it takes responsibility for the decision to deploy it and for how it is used, including its outputs. It does not need technical control (paragraph 12). A legal person stays the deployer when employees, contractors or freelancers work under its control (paragraph 14).
• Neither. A company that "merely commissions an advertising agency to produce an advertisement, without taking decisions and exercising control over whether and how the advertising agency uses AI in the production process, is not a deployer" (paragraph 14). Hosting providers and platforms that only disseminate third-party content are not deployers, though the Guidelines strongly encourage them to preserve markings and labels (paragraph 16).
• Personal use. The deployer duties exclude use that is both purely personal and non-professional. Gaining an economic benefit on a regular basis, or acting in a business, trade or freelance activity, is professional (paragraphs 19 and 20).

A company can be both. The Guidelines give the example of a company that builds a generative system in-house and uses it to generate deep fakes: it is a provider and a deployer (paragraph 15).

Businesses outside the EU

For deployers, the Guidelines say the duties apply to entities outside the Union "where the deployer itself foresees dissemination and use of the AI outputs in the Union (i.e. by directing or authorising distribution within the Union, including by posting deep fakes on the globally accessible internet)". They add that third-country deployers are not bound where the content reaches audiences in the Union "through channels that are unforeseeable and outside their control" (paragraph 13). A US store that posts AI-generated model imagery on a site open to EU shoppers is therefore plausibly in scope; whether a given case is covered is a question for counsel.

Source: Commission Guidelines (PDF), paragraphs 10 to 16, 19 and 20. Verified October 21, 2026.

Chatbots: Article 50(1)

"Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use."

Source: Regulation (EU) 2024/1689, Article 50(1). Verified October 21, 2026.

The duty sits on the provider, not on every business that uses the system. The Guidelines' own example of a provider is a company that offers an application such as a chatbot "under its own name or trademark" to customers, "including by integrating the system into their existing processes and using it accordingly without the need for modifications or additional components" (paragraph 11). On that reading, a store that embeds an unmodified vendor widget is most likely a deployer and the vendor carries Article 50(1). A company that builds a chatbot in-house and puts it into service under its own name or trademark is a provider, and so is one that modifies an existing system and puts the result into service under its own name (paragraph 11).

The Guidelines do not address white-label tools that a vendor builds and a business brands as its own. The language on systems that are "developed" for a provider points toward the brand owner being the provider, and we treat that as an open question. A deployer with no Article 50(1) duty of its own still makes choices that matter: a human name or photo for the bot can make the vendor's disclosure ineffective (paragraph 38), and the Guidelines say existing consumer protection law, such as the rules on misleading omissions, applies in parallel and does not depend on whether the interaction is obvious (paragraph 50).

What a sufficient notice looks like

Article 50(1) names no technique, but the Guidelines say several approaches are not enough when used alone (paragraph 38). They include disclosures contained only in terms and conditions, URLs or documentation; machine-readable markings people cannot perceive at the point of interaction; unclear signals such as a generic reference to "assistant"; and generalized wording:

"Generalised disclosures that are not sufficiently specific to the AI system's outputs and interactions (e.g. on a platform providing a variety of services or individual inputs, a general disclosure like "Services on this website use AI" is insufficient)"

A single prominent notification before the first interaction "is likely to suffice in most instances", with periodic reminders likely to be needed with vulnerable people and in riskier contexts, such as financial, insurance, legal or health advice and complaints handling (paragraph 40). The "obvious" exception is read restrictively, and the Guidelines list chatbots embedded in online platforms and helpdesk tools, where people may take the output for human-written, among systems that are not obviously AI (paragraph 45). AI agents must disclose both their artificial nature and the person on whose behalf they act (paragraph 31).

The United States works differently. In California, Maine and Utah the notice duty sits on the business that uses the bot; see US chatbot disclosure rules and our AI chatbot disclosure guide.

Source: Commission Guidelines (PDF), paragraphs 11, 31, 38, 40 and 45. Verified October 21, 2026.

Deep fakes: Article 50(4), first subparagraph

"Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated."

Article 3(60) defines the term:

"'deep fake' means AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful"

Source: Regulation (EU) 2024/1689, Articles 50(4) and 3(60). Verified October 21, 2026.

How the Guidelines read the definition

The Guidelines test four cumulative elements: resemblance, existence, a covered kind of subject and a false appearance of authenticity or truthfulness (paragraph 113). Several points matter for businesses.

• "Objects" include "consumer goods", and "persons" include "realistic AI-generated human avatars or personas" (paragraph 113).
• False appearance is judged as a whole, objectively, with no need for an intent to deceive, and against "the possible diverse composition of the reasonably foreseeable audience", not a hypothetical average person. It may be enough that part of the foreseeable audience, such as children, older people or people with lower AI literacy, would be misled (paragraphs 114 and 115).
• Photorealism makes a deep fake more likely, but "photorealism alone is not determinative" (paragraph 114).
• Authenticity covers "the involvement of real human beings", "the actual appearance or use of objects" and "the delivery of services" (paragraph 113).

This is the Article 3(60) test applied case by case. The Guidelines do not draw a line between fully synthetic and retouched images.

What the Guidelines say about commercial content

The Guidelines' list of deep fake examples and non-examples includes several for advertising, and one sentence on product images.

Source: Commission Guidelines (PDF), paragraphs 113 to 116 and 124. Verified October 21, 2026.

Two things the Guidelines do not settle. First, they mention "room staging" only when listing AI-assisted product visualization as not being an interactive system under Article 50(1); they do not say whether virtual staging output is a deep fake. The Commission's icons page does list "Authentic photographs of an empty apartment is furnished using AI" among the use cases for its Partially AI-Modified icon, which suggests the Commission sees AI furnishing as a candidate. Second, realistic AI-generated voices that do not clone a real person are not addressed directly: the list of non-examples covers AI voice replication for fictional characters when there is no deception about the narrators' identity.

Advertising is not automatically "creative"

Article 50(4) gives a lighter duty for content that is part of an evidently artistic, creative, satirical, fictional or analogous work: disclosure in an appropriate manner that does not hamper the display or enjoyment of the work. The Guidelines read those categories strictly:

"some kinds of content (e.g. advertisements or documentaries) containing deep fakes might be regarded as evidently creative or fictional works in certain, specific situations, but not in others, since the assessment is case-specific. When the deep fake combines multiple characters (e.g. informative and creative), the informative character should always prevail and require compliance with the standard labelling requirements."

The same paragraph excludes content whose nature is "exclusively informative or commercial and is recognisable as such" (paragraph 122). Even where the lighter duty applies, the rights of third parties, including data protection and intellectual property, still have to be respected (paragraph 124).

The label has to be something a person can perceive

The Guidelines say labeling methods should be understandable and perceivable by people, "without them needing to rely on any specific technical tools or performing dedicated actions", and draw the consequence for metadata:

"deployers cannot rely on the machine-readable marking embedded in the content by the provider under Article 50(2) AI Act, since those markings are not immediately clear and distinguishable for the natural persons exposed to the deep fake content."

The information is due at the latest at the first exposure: at the start of a video that features a deep fake, or when a person meets it while scrolling (paragraph 143). If people may join a video partway, a notice only at the beginning does not adequately inform them and should be complemented later where possible. A label does not make an unlawful deep fake lawful, and personality rights and data protection duties continue to apply (paragraphs 127 to 129). Content generated before August 2, 2026 does not need to be labeled retroactively, and holders of older unlabeled deep fakes are not expected to make disproportionate efforts, such as auditing content databases or changing printed packaging (paragraph 154).

Sources: Commission Guidelines (PDF), paragraphs 117, 122, 124, 143 and 154. Verified October 21, 2026.

AI-written text: Article 50(4), second subparagraph

"Deployers of an AI system that generates or manipulates text which is published with the purpose of informing the public on matters of public interest shall disclose that the text has been artificially generated or manipulated."

The obligation does not apply "where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content". The limb is narrower than it first sounds. The Guidelines read it through three elements (paragraph 131):

• Published: accessible to an indeterminate, fairly large number of unrelated readers. Private correspondence and internal communications are not.
• With the purpose of informing the public: intended to communicate knowledge, opinions or facts. Short texts that do not materially do so do not count.
• On matters of public interest: politics, public administration and services, justice, fundamental rights, public security, public health, environmental protection, consumer safety, and economic, financial, political, scientific or cultural developments relevant to public debate.

Among the examples that fall outside the limb is "AI-manipulated text that is part of a company's advertisement or product descriptions (not including any claims related to e.g. health, consumer safety or sustainability)". AI-generated alt text, captions and UI labels are also outside it (paragraphs 68 and 131).

The human review exception

The exception needs both limbs. Human review means "the deliberate examination of the substance of the content by one or more natural persons possessing relevant knowledge and professional judgement", and the Guidelines call fact-checking "a minimum requirement" (paragraph 134). What does not count:

"Superficial, solely formal or procedural checks (e.g. spell-checking or grammatical correction), the mere existence of an editorial policy, automated review processes or cursory editorial approval without substantive engagement by the human reviewer or the editorial entity, cannot fulfil the conditions for human review or editorial control for the purposes of this exception."

The person or body with editorial responsibility must hold the ultimate legal responsibility for the publication, and their identity and contact details "should be made publicly available on an easily findable location", for example in a website's terms or other user-facing legal information (paragraph 138). The Guidelines' own example of text that does not qualify includes an AI-generated, self-published book on climate change made available on an e-commerce platform without any review by a competent person (paragraph 138).

Source: Commission Guidelines (PDF), paragraphs 131 to 138. Verified October 21, 2026.

Marking AI output: Article 50(2)

Article 50(2) is a provider duty: to ensure that outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated". It does not apply to the extent a system performs an assistive function for standard editing or does not substantially alter the input data or its meaning. The Guidelines explain what that excludes and includes (paragraphs 90 to 92).

• Examples that do not need marking: grammar correction and AI translation of text; format conversion and compression; minor cropping and minor color corrections; removal of dust spots and red-eye; deleting and obscuring backgrounds that are visible in the original file; pixelation or blurring of faces; pixel filling for aspect ratio adaptation.
• Examples that do: AI-generated summaries; rewriting that changes meaning; removal, replacement or insertion of objects or persons that changes the meaning of an image or video; face replacement; realistic speech in a specific person's voice; composites that modify the representation of persons, objects, events or facts.
• Outside the duty altogether: "single words, image captions, alt-text, UI labels and icon-scale graphics" (paragraph 68). A tool that writes alt text does not trigger the marking duty for that output.

The Code of Practice, for signatories only, asks providers for at least two layers of machine-readable marking for image, audio and video: digitally signed, time-stamped metadata and an imperceptible watermark (Section 1, Measure 1.1). It also asks them to make best efforts to preserve metadata markings, to prohibit intentional removal in their terms, and not to market tools whose purpose is to circumvent markings (Measure 1.2). It names no file format: neither C2PA nor IPTC appears in the text. If you handle files that carry markings, do not strip them. For what the markings look like in a file and what platforms read, see AI image metadata and the free metadata checker.

Sources: Commission Guidelines (PDF), paragraphs 68 and 89 to 92; Code of Practice (PDF), Section 1. Verified October 21, 2026.

Accessibility: Article 50(5)

"The information referred to in paragraphs 1 to 4 shall be provided to the natural persons concerned in a clear and distinguishable manner at the latest at the time of the first interaction or exposure. The information shall conform to the applicable accessibility requirements."

Article 50(5) adds no accessibility standard of its own. The Guidelines say so directly:

"Providers and deployers of AI systems falling within scope of the various transparency obligations listed in Article 50(1)-(4) AI Act must be aware of the applicable accessibility requirements (e.g. under Directive 2016/2102 and Directive 2019/882) and assess whether their product, service or content needs to comply with those rules. In such a case, they must ensure accessibility of the information conveyed in line with Article 50 AI Act in accordance with the applicable accessibility requirements. Article 50 AI Act does not impose distinct or additional accessibility requirements."

Directive 2016/2102 is the Web Accessibility Directive for public sector bodies. Directive 2019/882 is the European Accessibility Act (EAA), which covers e-commerce services. Our EU accessibility law page explains both and the reference standard, EN 301 549 version 3.2.1, which is based on WCAG 2.1 Level AA. Version 4.1.1, based on WCAG 2.2, was published in September 2026 but is not yet the legal reference, according to the Commission's AccessibleEU Centre.

Where the exemption leaves small shops

The EAA exempts microenterprises that provide services from its service accessibility requirements. Article 3(23) defines a microenterprise as "an enterprise which employs fewer than 10 persons and which has an annual turnover not exceeding EUR 2 million or an annual balance sheet total not exceeding EUR 2 million". For a business that is exempt, an accessible AI label is good practice rather than something the EAA adds. The Guidelines also say information is "clear" only where it is "noticeable, easy to understand by and accessible for the natural person concerned (including persons with disabilities)" (paragraph 142), and they do not say how those two statements fit together for a small shop. Whether a given label must meet an accessibility rule depends on which rules bind that business.

What "clear and distinguishable" rules out

The Guidelines say information is not clear and distinguishable where it "can be easily overlooked or missed by natural persons under normal exposure or interaction conditions (e.g. only included as part of a manual or hidden under layers of menu options on an online interface, part of terms of use that are often not read by users)" (paragraph 142). For chatbots they add that the notice must be provided in an accessible format for people with disabilities, and child-friendly where children may interact (paragraph 34).

The Code and the icons page on accessibility

For signatories, Section 2 of the Code of Practice, Measure 1.1, turns the accessibility duty into four applications. It says signatories will ensure accessible disclosure "in particular Directive (EU) 2019/882 (the European Accessibility Act) and Directive (EU) 2016/2102 (the Web Accessibility Directive)", which "includes but is not limited to application of":

• "audio descriptions or alternative cues for visual disclosure elements";
• tactile and haptic cues for audio-only content;
• "high contrast icons or equivalent labels and screen-reader compatibility, including for end-users with colour vision deficiencies";
• "detectability of the icon or equivalent label by assistive technologies".

The Code encourages ETSI EN 301 549 and WCAG 2.1 and gives no contrast ratio, size or duration. Its placement example is "in the top right corner of an image or video deep fake", and it asks that the label appear without "user (inter)action or sustained attention" and remain visible "against any background" (Measure 1.2). The Commission's icons page adds one hedged sentence: "If possible, the icon should be readable by assistive technologies using alt text or ARIA labels."

Our reading, which is not Commission text: a label drawn into the pixels of an image cannot be read by a screen reader, and metadata cannot be perceived by a person at all. A visible label plus a text equivalent in the page is the arrangement the sources point to. WCAG 1.4.3 also exempts text that is part of a picture with significant other visual content, so a low-contrast label burned into a photo can pass WCAG and still be easy to overlook in the sense of paragraph 142. Our accessible AI labels guide works through this, and the label generator drafts markup.

Sources: Commission Guidelines (PDF), paragraphs 34, 142 and 144; Code of Practice (PDF), Section 2, Measures 1.1 and 1.2; Commission icons page; Directive 2019/882, Article 3; AccessibleEU Centre on EN 301 549. Verified October 21, 2026.

The Code of Practice and the EU icons

The Code of Practice on Transparency of AI-generated Content was published in final form on June 10, 2026. The Commission's opinion of July 8, 2026 found that it adequately covers Articles 50(2), (4) and (5). Section 1 is for providers and Section 2 for deployers, and it binds only organizations that sign. The Commission's news item of July 31, 2026 counts 95 signatories to Section 1 and 192 to Section 2. Signing is voluntary: the Guidelines say a code assessed as adequate is "a straightforward, predictable, and legally certain way of demonstrating compliance", that non-signatories are expected to demonstrate how they comply through other adequate means, and that they "should carry out a gap analysis" against the Code (paragraphs 147 and 148). Commitments under an adequate code may be taken into account as a mitigating factor when fines are set (paragraph 149).

Section 2 asks signatories to use the EU icon or an equivalent label whose main visual element is the capitalized acronym "AI" in English, with an optional second layer saying whether content was generated or modified. The Commission publishes three icons, in four color variants, for free use:

• The icons are "publicly available for everyone to use freely, without the need for attribution".
• "The use of these icons does not establish legal compliance by itself."
• "Usage of these icons by non-signatories of the code should not be construed as signaling of their adherence to the code."

Do not describe a business as a signatory unless it appears on the Commission's list, and do not imply the Commission approved a particular label or page. A seal that says a site meets the Act would claim more than the Commission itself says its own icons do. GotAlt does not sell one.

Sources: Commission page for the Code; Commission news item on signatories; Commission icons page; Guidelines (PDF), paragraphs 146 to 149. Verified October 21, 2026.

Fines

Article 99(4) sets the ceiling for breaches of the transparency obligations in Article 50:

"administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher"

For small businesses the cap flips. Article 99(6) says that for SMEs, including start-ups, each fine is "up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower". The Omnibus adds Article 99(6a) for small mid-caps: "In the case of SMCs, each fine referred to in paragraphs 4 and 5 shall be up to the percentages or amount referred therein, whichever is lower." The Guidelines add that fines must be "effective, proportionate and dissuasive" and that authorities weigh the nature, gravity and duration of the infringement, whether it was negligent or intentional, and cooperation (paragraph 152). Member states set their own penalty rules within these limits, and they were required to take the interests of SMEs and their economic viability into account.

Sources: Regulation (EU) 2024/1689, Article 99; Regulation (EU) 2026/1744, Article 1(38)(c); Guidelines (PDF), paragraph 152. Verified October 21, 2026.

Who enforces, and what has happened so far

Market surveillance authorities designated by the member states, the AI Office in narrow cases and the European Data Protection Supervisor for EU institutions supervise Article 50. They can act on their own initiative or after a complaint, which any affected person or other person with grounds to consider there is a violation has the right to lodge (Guidelines, paragraph 151, citing Article 85). The AI Office is competent for systems built on a general-purpose model by the same provider, and for the Article 50(3) and (4) duties only where that provider is also the deployer. The Commission keeps a list of the authorities member states have designated; when we read it, last updated September 7, 2026, designations were still pending for a number of member states.

We found no enforcement action under Article 50 and no fine anywhere in the EU as of October 21, 2026. There is no central public register of enforcement, so this is a finding about what we could read, not proof that none exists.

Sources: Guidelines (PDF), paragraph 151; Commission list of market surveillance authorities. Verified October 21, 2026.

National laws

The AI Act is a regulation, so Article 50 applies directly. National laws matter for penalties, for who enforces, and for related offenses. In the texts and reports we read, no member state adds a stand-alone AI labeling duty beyond Article 50.

Other member states are not covered here. Verified October 21, 2026.

What to do now

These are practical steps people commonly take when Article 50 may reach them. They are not a legal conclusion about you.

1. Place yourself

   Work out whether you are a provider, a deployer or neither for each AI system you use or offer, and whether your output reaches people in the EU. Our which AI disclosure rules apply to me tool asks the questions and links the sources.

2. Decide, image by image, whether it is a deep fake

   Apply the four elements to the foreseeable audience and write down why you decided as you did. The Guidelines expect businesses that do not sign the Code to be able to explain how they comply (paragraph 148).

3. Put the label where people and assistive technology can reach it

   A visible label that does not rely on metadata, with a text equivalent in the page, is the arrangement the Guidelines and the Code point to. See the accessible AI labels guide and the label generator.

4. Keep markings a provider added, and check what your pages show

   Do not strip embedded markings. The AI image metadata checker reads what an image file declares, and the AI label and chatbot disclosure checker looks at a live page.