EU AI Act Article 50: Transparency Rules Explained

Article 50 is the transparency chapter of Regulation (EU) 2024/1689. It doesn’t ban generative AI and it doesn’t rank systems by risk tier: when people interact with an AI system, or encounter content one made, they should know. EU AI Act Article 50 is applicable now, regardless of risk category.

What EU AI Act Article 50 Requires

The most persistent misunderstanding: the Digital Omnibus (in force) deferred the heavy high-risk obligations to later dates, but left Article 50 untouched. The transparency duties are live law and enforceable today. Article 50 does not care about risk tiers, and it does not demand one identical label for every AI system. The right response depends on what the system does, how its output reaches people, and whether the organisation is a provider or a deployer. Four situations are regulated:

Direct interaction comes first. A support chatbot, booking assistant, AI receptionist, or sales agent should identify itself as AI no later than the first interaction, unless that fact is unmistakable to a reasonably well-informed, observant, and circumspect person. The Commission’s final guidelines (after a draft and public consultation) warn against assuming users will recognise an AI system from its design or tone. AI agents fall inside the duty too: systems that plan steps, call tools, and act on a user’s behalf must disclose their AI nature wherever they meet a user. (A visually distinct robot avatar may satisfy the duty. A chatbot with a human name and warm conversational style almost certainly will not: the guidelines are blunt on this point.)

The EU AI Act Article 50 marking duty is a different kind of obligation. Providers of systems that generate or manipulate synthetic content must support machine-readable detection: effective, interoperable, robust, and reliable as far as technically feasible. A visible badge alone may not cut it; provenance metadata, embedded watermarks, fingerprints, or a layered combination may be needed. Carve-outs include short number sequences, source code, machine-to-machine outputs, closed-loop production, and standard assistive editing. AI-generated translations are expressly among the examples benefiting from the assistive-editing exception.

Transparency is not permission. Deployers must inform people exposed to emotion-recognition or biometric-categorisation systems, and the duty can reach live processing as well as analysis of recorded material. But some of these uses are restricted or prohibited under other articles of the Act. An Article 50 notice doesn’t legalise a prohibited practice, and it doesn’t replace GDPR, employment-law, or consumer-protection duties.

Deepfakes complete the picture: the disclosure must be clear to the viewer or listener, and machine-readable provenance supports it but doesn’t replace a visible or audible disclosure. Artistic or satirical works get presentation flexibility, but the creative context doesn’t remove the duty to consider whether the material could falsely appear authentic. AI-generated or manipulated public-interest text must also be disclosed, unless it passed substantive human review and someone accepts editorial responsibility. A quick sign-off may not be enough. One overlap businesses keep tripping over: YouTube, Meta, and TikTok already require creators to flag realistic synthetic content depicting real people, places, or events. That is a platform duty, not an Article 50 duty. One doesn’t automatically satisfy the other.

The December Marking Deadline

December is when three separate AI Act items converge, and only one belongs to EU AI Act Article 50.

The grace period deserves a closer look. It applies only to systems placed on the market before the applicability date; anything placed on the market on or after that date had to mark from day one. After December, the legacy-versus-new distinction disappears. Treat it as an engineering deadline, not paperwork: the marking has to work across the publishing pipeline. On retroactivity, the Commission has said content generated before the applicability date does not need labelling after the fact. Voluntary labelling is encouraged, but the law doesn’t reach backward.

Providers vs. Deployers: Who Owes What

The provider-versus-deployer split sits at the heart of EU AI Act Article 50, and it’s where businesses misallocate responsibility most often: a provider develops or brands an AI system, or places it on the market; a deployer uses one under its own authority as part of a professional activity. A company can be both.

Calling a model API doesn’t hand every duty to the vendor. A business using one may still need to identify its own chatbot as AI, preserve provenance data through its publishing pipeline, and disclose qualifying content to its own users. Record the reasoning per system: assuming the vendor carries everything is the classic error.

The territorial reach is wider than many US and UK companies assume. Article 2 covers providers placing systems on the EU market and third-country providers or deployers where the output is used in the Union. The question isn’t only where a company is headquartered, but where its system and outputs are offered or used.

The Code of Practice on AI-Generated Content

The Code of Practice on Transparency of AI-Generated Content is the closest thing Article 50 has to a safe harbour: voluntary and finalised. The Commission and the AI Board assessed it as an adequate way to demonstrate compliance with the marking and labelling duties under Articles 50(2), 50(4), and 50(5). Roughly 190 organisations had signed by then.

The Code has two sections. Section 1 covers providers and their marking obligations (signatories include Anthropic, Google, Meta, Microsoft, Mistral, and OpenAI); Section 2 covers deployers and the visible labelling of deepfakes and public-interest AI text (signatories include Getty Images, Lenovo, and Lufthansa). Rather than one mechanism, the Code prescribes a layered approach: signed, time-stamped metadata where the format supports it, plus imperceptible watermarking, plus logging, and a standardised EU “AI” label with an interactive second layer noting whether content was generated or modified by AI and what changed.

Signing is voluntary and confers no legal immunity. But the asymmetry is real. (A signatory implementing the Code holds a documented, Commission-recognised compliance route, and national authorities are expected to treat signatories as compliant absent specific evidence otherwise. A non-signatory must show compliance by “alternative adequate means” and should expect more information requests and closer scrutiny: the enforcement asymmetry is deliberate.)

Anthropic signed as a provider of both generative models and systems; all Claude models launched on or after the applicability date carry machine-readable marks from launch, applied globally.

Reading DLA Piper’s walkthrough of the final Code, what struck me was how deliberately narrow it is: the Code operationalizes only two duties, machine-readable marking by providers and visible labelling by deployers. Everything else in Article 50 leans on the Commission’s guidelines alone. Worth knowing before treating a signature as a blanket compliance answer.

C2PA, SynthID, and Why One Technology Isn’t Enough

No single current technology fully satisfies all four statutory requirements (effectiveness, interoperability, robustness, and reliability) on its own. That’s the technical reality behind the Code of Practice’s layered mandate.

C2PA Content Credentials are the open standard for provenance: cryptographically verifiable information about a file’s origin, creation, editing history, and signer. The problem is durability: metadata gets stripped by screenshots, format conversions, re-uploads, resizing, or any platform that doesn’t preserve it. That’s why TikTok and YouTube building C2PA detection into their pipelines matters for deployers, and why a screenshot of a marked image still carries nothing. Google DeepMind’s SynthID takes the opposite approach, embedding an imperceptible watermark in the content itself across supported image, audio, text, and video systems. Since the signal lives in the pixels or waveform rather than in attached metadata, it survives transformations that strip metadata, though Google is candid that watermarking isn’t a complete solution and must be combined with broader provenance measures.

OpenAI reports a combined approach: C2PA credentials as the provenance layer, SynthID watermarking as the more durable signal when metadata is removed, plus verification tools. That’s a company-reported approach, not an independent ruling that every OpenAI output meets Article 50. The absence of a detected signal doesn’t prove content is human-created, as OpenAI itself notes.

An arXiv preprint argues for architecture-level marking by design, a non-peer-reviewed perspective, not settled evidence.

Penalties and the Enforcement Picture

Violations of Article 50 can fall within the Article 99 penalty tier: up to €15 million or 3% of total worldwide annual turnover, whichever ceiling applies higher. For SMEs, the lower applicable maximum is used. Authorities weigh the infringement’s nature, seriousness, duration, and consequences, plus responsibility, cooperation, and measures taken. For comparison, prohibited-practice breaches carry up to €35 million or 7% of turnover. The transparency tier sits one step below. These are ceilings, not automatic fines.

Enforcement stopped being theoretical when the AI Office set out its opening enforcement wave, starting with hiring and recruitment tools: tested against Article 50 transparency duties alongside high-risk requirements on human oversight, documentation, and conformity assessment. Almost every large employer licenses automated candidate filtering, so that’s where inspections land hardest and earliest. The machinery around it is operational: the AI Office works alongside 24 national market surveillance authorities, can interview anyone who consents, and can enter providers’ premises. National authorities are expected to handle most Article 50 cases; the AI Office takes systems under its own supervision, and the European Data Protection Supervisor handles matters involving EU institutions. A centralised complaints mechanism and a whistleblower channel are now live.

No public Article 50 fines had been announced yet, but the wave is mapped, the channels are open, and the grace period is nearly gone.

ECIJA’s TMT/IT partner Cristina Villasante put the rationale more bluntly than the regulation does: transparency over synthetic content’s origin is “not optional,” she wrote, it is “a necessary condition for the integrity of the information ecosystem.” That framing stuck with me because it explains where the penalty tier sits: the EU is treating undisclosed synthetic content as an information-ecosystem risk, not a paperwork slip.

EU AI Act Article 50 Compliance Checklist

EU AI Act Article 50 isn’t a generic “made with AI” message everywhere. It’s the right transparency for the actual system, content, audience, and legal role involved: work through it system by system:

• Inventory customer-facing AI: including shadow AI. Chatbots, voice agents, avatars, content generators, publishing workflows touching EU audiences, plus tools employees adopted without IT approval.
• Classify your role for each system. Provider, deployer, or both, and record the reasoning.
• Add first-interaction notices. Chatbots and agents should identify themselves as AI at the start. A human name and conversational style don’t count as obvious.
• Review vendor markings. Ask providers about C2PA credentials, watermarks, fingerprints, or other machine-readable signals, and whether they signed the Code of Practice.
• Test the full publishing pipeline. A mark that dies at the first re-upload isn’t compliance.
• Write a deepfake policy. Define which content needs a visible or audible disclosure and who adds it.
• Document human review. For public-interest text, record who reviewed it, what was checked, and who accepted editorial responsibility.
• Check accessibility and keep records. Notices must be clear and compatible with assistive tech. Store vendor docs, decisions, test results, and exceptions relied upon.
• Hit the December engineering deadline. Finish the technical marking work well before it.

FAQ