EU AI Act Article 50 checklist: chatbots and AI content
Hephaestus Technology11 min read
EU AI Act Article 50 sets four transparency duties:
- Chatbots and other AI systems that talk directly to people must tell users they are dealing with AI.
- Generative systems must mark their output in a machine-readable way.
- Deployers must inform people exposed to emotion recognition.
- Deployers must label deepfakes and AI-written text published on matters of public interest.
These duties have applied since 2 August 2026. One short transition for marking ends on 2 December 2026. To check your product, split the duties by role and work through the checklist below.
Key takeaways
- Article 50 covers everyday products: customer-service chatbots, synthetic images and voice, AI-written public-interest content and emotion-recognition features. It is not limited to high-risk systems.
- Providers carry chatbot disclosure and machine-readable marking. Deployers carry deepfake labels, public-interest text labels and emotion-recognition notices.
- The only transition is for 50(2) marking on systems placed on the market before 2 August 2026, due by 2 December 2026.
- Non-EU providers, including UK firms, are in scope if their system's output is used in the EU.
- Fines can reach EUR 15 million or 3% of total worldwide turnover.
What does Article 50 of the EU AI Act require, in plain English?
Article 50 requires that people know when they are dealing with AI or AI-made content. The European Commission's Article 50 FAQ summarises the four duties:
| Paragraph | Who | Duty |
|---|---|---|
| 50(1) | Provider | Design AI systems that interact directly with people so users are told they are interacting with AI, unless this is obvious |
| 50(2) | Provider | Mark synthetic audio, image, video or text output in a machine-readable format so it is detectable as AI-generated or manipulated |
| 50(3) | Deployer | Inform people exposed to emotion-recognition or biometric-categorisation systems |
| 50(4) | Deployer | Disclose deepfakes, and AI-generated text published to inform the public on matters of public interest |
Paragraph 5 governs how the information is given, and the Commission FAQ applies it to providers and deployers alike. Information must be:
- clear and distinguishable
- given at the latest at the first interaction or exposure
- in line with applicable accessibility requirements
These duties are not reserved for high-risk systems. Enforcement is mainly by national market surveillance authorities. Fines can reach up to EUR 15 million or 3% of total worldwide turnover for the preceding financial year.
The Commission says proportionality can be taken into account for SMEs and small mid-caps. That point concerns fines. The FAQ does not describe a lighter set of duties for smaller firms, so plan to meet them in full whatever your size.
If you are not yet sure the Act reaches your business at all, start with our guide on whether the EU AI Act applies to your business.
Who does Article 50 apply to: providers, deployers, or both?
Both, with different duties.
- Providers must meet 50(1), 50(2) and 50(5) before placing systems on the market or putting them into service, according to the Commission FAQ.
- Deployers carry 50(3) and 50(4). They must also follow the paragraph 5 rules on clear, distinguishable and accessible disclosure.
The FAQ defines the roles:
- A provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark.
- A deployer uses an AI system under its authority, excluding personal, non-professional use. Someone posting deepfakes privately is outside the Act. Use in a business, trade or freelance activity counts.
- Employees acting on company instructions are not separate deployers. The company remains the deployer, even when contractors operate the system for it.
Many SMEs build a chatbot on someone else's model. The Commission FAQ confirms that general-purpose AI systems are covered by the 50(2) marking duty.
Our reading is that a company selling or white-labelling a chatbot under its own brand is likely the provider. That is an inference, not a quoted rule. Check the Commission's final guidelines against your set-up.
When do the Article 50 transparency obligations apply?
Article 50 has applied since 2 August 2026. The Commission FAQ describes one limited grace period:
- It covers only the 50(2) marking duty.
- It applies only to systems placed on the market before 2 August 2026.
- Those providers must comply from 2 December 2026, which, as of November 2026, is only weeks away.
Content generated before 2 August 2026 does not need to be labelled retroactively. The Commission does encourage deployers to label it where possible.
Three points are easy to get wrong:
- 50(1), 50(3) and 50(4) have no transition. The grace period in the Commission FAQ covers 50(2) marking only.
- A feature launched on or after 2 August 2026 gets no grace period.
- The Digital Omnibus on AI also concerns the AI Act's timetable, but the FAQ does not discuss it. We have not verified the Omnibus's final status, so check the adopted text on EUR-Lex before relying on any date.
For the wider schedule, see our EU AI Act timeline.
EU AI Act Article 50 checklist: which items should you copy into your launch plan?
Copy the items that match your role. The duties come from the Commission FAQ. The 'what good looks like' column gives our suggested examples, not official wording.
| # | Role | Item | What good looks like |
|---|---|---|---|
| 1 | Provider | Classify the product: does it interact directly with people, generate synthetic content, or both? | A one-line note in your product spec stating which of 50(1) and 50(2) apply |
| 2 | Provider | 50(1): disclose AI interaction from the start of the first interaction, clearly and accessibly | A persistent label reading 'You're chatting with an AI assistant', plus a spoken line at the start of voice calls |
| 3 | Provider | 50(2): mark output so it is effective, reliable, robust and interoperable | Signed metadata plus an imperceptible watermark on generated images, audio or video, with the method documented |
| 4 | Provider | Check marking carve-outs: short strings, source code, machine-to-machine output, assistive standard editing, closed-loop industrial or product-development outputs | A written rationale for any output you do not mark |
| 5 | Provider | Decide whether to sign the Code of Practice | A recorded decision, with your alternative measures listed if you do not sign |
| 6 | Provider | Record your transition date | If on the market before 2 August 2026, marking live by 2 December 2026 |
| 7 | Deployer | 50(3): inform people exposed to emotion recognition or biometric categorisation | A notice in the interface or at the entrance before capture starts |
| 8 | Deployer | 50(4): label deepfakes on first exposure | A visible on-image or on-video label, or an audible one for audio, not just embedded metadata |
| 9 | Deployer | 50(4): label unreviewed AI text published on matters of public interest | A named editor who reviews and takes editorial responsibility, or a clear AI label |
| 10 | Both | Keep evidence of what you did and when | Screenshots, marking method notes and review logs (recommended practice, not a stated legal requirement) |
The FAQ also describes a narrow exemption for certain business-to-business or industrial uses. Read it closely before relying on it.
To fold these items into a broader release process, use our AI feature launch checklist.
How should a chatbot tell users they are talking to AI?
Tell users at the start of the first interaction, in a way they cannot miss. The Commission FAQ says people must be notified 'from the start of the first interaction in a clear and distinguishable manner and in accordance with accessibility requirements'.
The duty applies when four tests are all met:
- The system is an AI system.
- It is designed for a genuine two-way exchange.
- The AI itself communicates directly.
- It interacts with natural persons.
Background and machine-to-machine systems are out of scope. In our reading, a customer-service chatbot on your website or an AI voice assistant on your support line are the typical in-scope cases.
There is no mandatory wording. For 50(1), providers decide their own measures in light of the guidelines. The 'unless obvious' exception is judged from the view of a reasonably well-informed, observant and circumspect person, and the Commission says it should be read restrictively.
Our advice is not to rely on that exception. Put the disclosure in the interface itself rather than burying it in terms and conditions.
How do you mark AI-generated images, audio, video and text so machines can detect it?
Use technical marking that software can detect, and document the method. The Commission's Code of Practice on AI-generated content has two sections: one for providers on marking and detection, and one for deployers on labelling. It says solutions must be effective, interoperable, robust and reliable as far as technically feasible, taking account of content type, cost and the state of the art.
Orrick's analysis says the final Code expects two things:
- A two-layer approach for audio, image and video 'under the current state of the art': signed metadata plus an imperceptible watermark.
- Watermarking for free-form text over 200 tokens.
If you generate any of these formats, plan for layered marking rather than a single technique.
The Code is voluntary, but Article 50 is not. Signatories can rely on the Code to demonstrate compliance, and the Commission and the AI Board have assessed it as adequate. The Commission reported about 190 signatories by the end of July 2026; check its signatory list for the current count.
If you do not sign, you must show your own measures are adequate. The Commission FAQ warns you may then face more requests for information.
If you are building generative features and need marking designed into the pipeline from the start, that work sits in the product development stage of how Hephaestus works.
When must deepfakes and AI-written public-interest text be labelled, and what are the exceptions?
Deepfakes must be disclosed on first exposure at the latest, and deployers cannot simply rely on a provider's embedded metadata. A deepfake meets three cumulative criteria, per the Commission FAQ:
- It resembles something.
- That person, object, place, entity or event exists or could plausibly exist.
- It falsely appears authentic or truthful.
For evidently artistic, creative, satirical or fictional works, disclosure must still happen, but in a way that does not hamper enjoyment of the work. The Commission also offers EU icons that deployers may use.
AI-generated text needs a label when it is published, informs the public, and covers matters of public interest. Listed topics include:
- politics, public administration and justice
- fundamental rights and public security
- public health and consumer safety
- the environment
- economic, scientific and cultural developments
Text that has had human review or editorial control does not need a label, provided someone holds editorial responsibility. Spell-checks and grammar fixes do not count as review.
There is a separate exception for use authorised by law to detect, prevent, investigate or prosecute criminal offences, noted on the Commission's EU icons page.
Our reading is that routine product marketing copy is usually outside the text duty. Unreviewed AI articles on health or consumer safety, by contrast, would be exposed.
Does Article 50 apply to UK businesses selling into the EU?
Yes for providers. The Commission FAQ says providers are covered wherever they are established, including when the output of their AI system is used in the EU. The FAQ does not name the UK, but on that rule a UK company running a chatbot for EU customers should plan to comply.
Two questions remain open, and we have not verified either:
- how the Act's scope applies to deployers outside the EU
- whether an EU authorised representative is needed for Article 50 alone
Check both against the Act's text. For how this sits beside UK rules, see our comparison of the EU AI Act and UK AI regulation.
How does Article 50 fit with GDPR transparency and your other AI Act duties?
Article 50 adds to your other obligations rather than replacing them. The Commission describes it as complementary to the transparency rules for general-purpose AI models in Articles 53 and 55.
In our view, an AI disclosure is not a substitute for a GDPR privacy notice, so keep both. Separately check whether your feature falls into a high-risk category or a prohibited practice. Meeting Article 50 does not settle either question.
Frequently asked questions
Is there a grace period for Article 50?
Only for the 50(2) machine-readable marking duty, and only for systems placed on the market before 2 August 2026. Those providers must comply by 2 December 2026. Chatbot disclosure, emotion-recognition notices and deepfake labelling have no transition.
Do I have to relabel content created before 2 August 2026?
No. The Commission says content generated before 2 August 2026 does not need retroactive labelling. It encourages deployers to label it where possible.
Can I rely on my AI provider's watermark for deepfakes?
No. Deployers must disclose deepfakes to people on first exposure, which in practice means a visible or audible label. Embedded metadata from the provider does not meet the deployer's duty on its own.
Is the Code of Practice on AI-generated content mandatory?
No. It is a voluntary route to demonstrate compliance, which the Commission and AI Board have assessed as adequate. If you do not sign, you must show your own measures are adequate and may face more information requests.
Does Article 50 apply to my freelance or small business?
Yes, if you use AI as part of a business, trade or freelance activity. The Commission's SME-specific point is that proportionality can be taken into account when fines are set. It does not describe lighter duties for small firms.
If you are building an AI feature and want to talk through how these duties shape the product, book a free 30-minute call with Hephaestus. For legal advice on your position, use a qualified lawyer.
Cover photo by Matheus Bertelli on Pexels.