Article 50 transparency: the obligation that was not delayed
While attention went to the high-risk deadline moving to December 2027, Article 50 came into application on 2 August 2026 exactly as enacted. It binds far more organisations than the high-risk regime does, because it attaches to what your system does, not to what tier it sits in.
The four duties
| Provision | Who it binds | What you must do | From |
|---|---|---|---|
| Art. 50(1) | Provider | Design and build systems that interact with people so that the person is informed they are dealing with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person in the circumstances. | 2 Aug 2026 |
| Art. 50(2) | Provider | Mark synthetic audio, image, video or text output in a machine-readable format so it is detectable as artificially generated or manipulated. Solutions must be effective, interoperable, robust and reliable as far as technically feasible. | 2 Aug 2026 existing systems: 2 Dec 2026 |
| Art. 50(3) | Deployer | Inform the people exposed to an emotion recognition system or a biometric categorisation system that it is operating, and process their personal data in line with the GDPR and the LED. | 2 Aug 2026 |
| Art. 50(4) | Deployer | Disclose that image, audio or video content constituting a deep fake has been artificially generated or manipulated. For text published to inform the public on matters of public interest, disclose AI generation unless the content underwent human review and someone holds editorial responsibility. | 2 Aug 2026 |
Article 50(5) governs how: the information must reach the person in a clear and distinguishable manner, at the latest at the time of the first interaction or exposure, and must meet applicable accessibility requirements.
Where this usually goes next
Three situations account for most people reading this page. Each has a different answer.
A deal is blocked on an AI questionnaire
Legal will not sign until you can evidence how AI is governed. HumanAudit’s AI Trust Package is a fixed $3,500 over five business days: a public trust page, a pre-filled SIG Lite / CAIQ / SSPA Section K questionnaire bank, and your AI inventory and classification.
You need ISO/IEC 42001 documentation
23 clause-mapped AIMS documents with all 38 Annex A controls pre-populated, editable and yours to keep, from $199. Or score your gaps first: 18 questions, free, no signup to begin.
You are not sure what reaches you
Twenty minutes with the founder. No prep, no deck, straight to the person accountable for the work. If none of this applies to you, you get told that on the call.
This reference is published by HumanAudit Inc. Not a law firm, not an accredited certification body, not a registered auditor. We build documentation, your counsel interprets it, and an accredited body of your choosing certifies you. How this is funded →
Who this actually catches
The high-risk regime catches a defined list of use cases. Article 50 catches a defined list of behaviours, and most software companies shipping AI features exhibit at least one of them:
- A customer support chatbot, in-product assistant, or voice agent → 50(1).
- Any feature that generates text, images, audio, video, or code output for a user → 50(2).
- Sentiment or emotion analysis on calls, video interviews, or classroom footage → 50(3).
- Marketing or editorial output using synthetic likenesses or voices → 50(4).
The exemption is narrower than people assume
Article 50(1) lifts the duty where AI interaction is obvious to a reasonably well-informed, observant and circumspect person in the circumstances of use. That is a contextual test, not a blanket exemption for anything labelled "AI assistant". A widget on a bank's help page named after a person, answering in the first person, is a poor candidate for "obvious".
Expert analysis, not verified fact. No enforcement decisions or Commission guidance interpreting this test existed at our last review date.
The 2 December 2026 carve-out
The Digital Omnibus made one change here. Systems already placed on the market or put into service before 2 August 2026 get until 2 December 2026 to meet the Article 50(2) machine-readable marking requirement. New systems had to comply on 2 August 2026.
Practically: if you shipped a generative feature before August, you have until December to implement provenance marking. If you ship one now, the obligation is immediate.
Penalties: the right tier
Article 50 breaches fall under Article 99(4): up to €15 million or 3% of total worldwide annual turnover, whichever is higher. The €35M / 7% figure quoted in most coverage is the Article 99(3) maximum and applies only to breaches of the Article 5 prohibitions. Quoting the wrong tier is the most common error in AI Act commentary.
For SMEs including start-ups, each cap is the lower of the fixed amount and the percentage.
What compliant looks like
Practical recommendation, not a legal requirement. The Regulation states outcomes, not implementations. These are the patterns we see holding up in vendor due diligence:
- Inventory the surfaces. Every place a user meets AI output. Not every model — every surface. This is usually the step people skip and it is the one an auditor asks for first.
- Disclose at first contact. In the interface, before or with the first response. Not in the ToS, not in a settings page, not in a footer.
- Machine-readable marking for synthetic output. C2PA content credentials or equivalent provenance metadata, plus a visible indicator where the medium allows.
- Document the "obvious" judgement. Where you rely on the 50(1) exemption, write down why, who decided, and when. An undocumented judgement is indistinguishable from no judgement.
- Record it as evidence. Screenshots, dates, and the decision record, held where you can produce them on request from a market surveillance authority.
Article 4 travels with this
If Article 50 binds you, Article 4 AI literacy almost certainly does too: it has applied since 2 February 2025 to every provider and deployer at every tier, and it is the single most commonly undocumented live obligation. Article 4 explained →
Turn this into evidence you can hand over
Disclosure without a record is not compliance you can demonstrate. The AI system inventory and governance policy templates give you the artefacts, and if a customer is already asking how you govern AI, that is a procurement question best answered with an ISO/IEC 42001 management system.
Not sure if you are caught?
The classifier tests Article 50 exposure alongside Article 5, Article 6 and Annex III. Twelve questions, no email.
Questions
Was Article 50 delayed by the Digital Omnibus?
No. Regulation (EU) 2026/1744 moved the Annex III high-risk obligations to 2 December 2027 and the Annex I embedded obligations to 2 August 2028. Article 50 kept its 2 August 2026 date. The only change was the 2 December 2026 transition for Article 50(2) marking on systems already on the market.
Does it apply if our AI is minimal-risk?
Yes. Article 50 attaches to behaviour, not to risk tier. A minimal-risk chatbot is still a system that interacts with people.
We are outside the EU. Does it apply?
If you place the system on the EU market, put it into service in the EU, or the output is used in the EU, yes. Article 2 does not depend on where you are established.
Is a footer disclaimer enough?
Article 50(5) requires clear and distinguishable information at the latest at first interaction or exposure. A footer or ToS clause is unlikely to satisfy that wording. Our reading; no case law yet.
Found an error, or has guidance been published?
Commission guidance on Article 50 may change how the "obvious" test and the marking requirement are read. Tell us and we will update this page and note what changed. Report it →
Obligations, article by article
- Art. 5 prohibitions
- Art. 4 AI literacy
- Art. 9 risk management
- Art. 10 data governance
- Art. 11 / Annex IV
- Arts. 12–13 logging
- Art. 14 human oversight
- Art. 15 accuracy & security
- Art. 17 QMS
- Arts. 43–48 conformity
- Art. 49 registration
- Art. 57 sandboxes
- Open source
- Art. 72 monitoring
- Art. 73 incidents
- Arts. 51–56 GPAI
- Art. 99 penalties
- Compliance checklist
- FRIA template (Art. 27)
- When Annex III does not apply →