SELINA.ai
Sign in
eu ai act article 50 requirements

What the EU AI Act's Article 50 Transparency Rules Actually Require Starting August 2026

If you ship a chatbot, generate synthetic media, or build anything that touches emotion recognition, you have a deadline. The eu ai act article 50 requirements went live on August 2, 2026, and they carry fines up to €15 million or 3% of global turnover. Most of the commentary out there is written for lawyers. This piece is for the engineer or product lead who needs to know what to actually build, what the disclosure UX has to look like, and where the real implementation traps are hiding.

Key Takeaways

What are the four obligations under Article 50?

Article 50 creates four distinct disclosure duties, each triggered by a different kind of AI system:

  1. Chatbot disclosure. If a person is interacting with an AI system, they must be told they are interacting with a machine, not a human. This covers text chat, voice interfaces, and any conversational system.
  2. Synthetic content labeling. AI-generated or AI-manipulated image, audio, video, or text must be marked as such, both in a way humans can perceive and (where technically feasible) in machine-readable form.
  3. Deepfake disclosure. If content depicts real people saying or doing things they did not say or do, the deployer must disclose that it was artificially generated or manipulated.
  4. Emotion recognition and biometric categorization. If your system infers emotions or categorizes people using biometric data, the individuals subject to it must be informed and given the chance to understand what's happening.

These are not all the same obligation with different names. They have different triggering conditions, different responsible parties (some fall on the provider, some on the deployer), and different technical implementation requirements. Conflating them is how teams end up building one disclosure banner and calling it done.

Didn't the Digital Omnibus package push back the timeline?

No. Not for Article 50. The Omnibus package deferred the Annex III high-risk compliance obligations to December 2, 2027. But Article 50's core transparency and disclosure duties were explicitly left out of that deferral. They applied on schedule, August 2, 2026, enforceable by national market surveillance authorities.

There is one narrow exception: machine-readable marking obligations under Article 50(2) for systems already on the market before August 2, 2026 were delayed until December 2, 2026. That means if you shipped a text-to-image tool in 2025, you get four extra months to implement watermarking. But you do not get extra time for chatbot disclosure or deepfake labeling. Those started on August 2.

Who does this apply to?

The scope is broader than most teams assume. Article 50 obligations can apply even to limited-risk systems, not just the high-risk categories that get most of the press coverage. According to compliance checker data from artificialintelligenceact.eu, transparency obligations are the second most common compliance trigger after AI literacy requirements, affecting roughly 33% of respondents.

Extraterritorial reach is real. UK businesses serving EU users are in scope. If your output or your users touch the EU, Article 50 applies to you. This is the same jurisdictional logic as GDPR, and you should plan for it the same way.

What does "disclosure" actually mean in practice for a chatbot?

It means telling the user they are talking to a machine. At or before the start of the conversation. In a way they will actually perceive.

The regulation is specific about what does not count. A disclosure buried in terms and conditions is not compliant. A vague label like "assistant" is not compliant. Metadata with no visible notice is not compliant. You need an affirmative, perceivable disclosure that a reasonable user would actually register.

Timing matters too. Notification must be provided at the latest at the time of first interaction. For a chatbot, that means before or at the very beginning of the conversation. For AI-generated audio or video, at the beginning of the clip. In some sensitive contexts, one-time disclosure may not be sufficient, and it may need to be repeated.

If you're building a conversational product, the practical minimum is a visible, non-dismissable label at conversation start that says something equivalent to "You are talking to an AI system." Not "Powered by AI." Not a robot emoji. A clear, direct statement.

How does the "obvious" exemption work?

Article 50 includes an exemption: you don't need to disclose that someone is talking to AI if it would already be obvious to a reasonably well-informed, observant, and circumspect member of the target audience that they're interacting with a machine.

This exemption is narrower than it sounds, for two reasons.

First, the standard is not "obvious to you, the builder." It's obvious to a reasonable member of your specific target audience. If your target audience includes non-technical users, elderly users, or users in a high-stress context (customer support, healthcare triage), the bar for "obvious" is much higher.

Second, the burden of proving that the exemption applies sits on you, the provider. You have to document the reasoning. You have to be able to show an enforcement authority why a reasonable person in your user population would have known they were talking to a machine. If you can't produce that evidence trail, the exemption doesn't help you.

The practical implication: the more realistic and human-like you've designed your system to appear, the less likely this exemption applies. A crude command-line bot with "Bot>" as the prompt might qualify. A polished voice assistant with natural intonation and conversational fillers almost certainly does not. And the trend in our industry is toward more human-like systems, not less, which means the exemption is shrinking over time for most products.

How should you document the "obvious" determination?

Almost no guidance out there describes what the evidence trail should look like. Most legal guides just say "document the reasoning" and move on. From an engineering perspective, you want:

Think of it as an audit trail, the same way you'd build one for GDPR consent. If an enforcement authority asks in 2027, you need to be able to reconstruct what a user saw and why you believed it was sufficient.

What do the watermarking and machine-readable labeling rules require?

For AI-generated images, audio, and video, Article 50 requires machine-readable marking. The European AI Office's Code of Practice on Transparency of AI-Generated Content, released June 10, 2026, recommends two mechanisms: digitally signed metadata and imperceptible watermarking. There's also an optional third mechanism (fingerprinting/logging).

The Code doesn't name C2PA by name. But the only technology that currently meets the signed-metadata criteria is C2PA. Major global AI providers are expected to sign the Code first, and once they converge on C2PA as the standard, it becomes the de facto market requirement. Deviating gets hard for smaller players.

This creates a practical problem. If you're generating images or audio, you will very likely need to embed C2PA manifests. If you're not doing that already, start now.

Is text watermarking required too?

This is where it gets murky. The regulation covers AI-generated text under the synthetic content labeling obligation. But the Draft Code explicitly recognizes that watermarking text is notoriously difficult without degrading output quality, risking text that sounds robotic or unnatural. The "technically feasible" qualifier in Article 50 gives some breathing room here.

The practical answer today: for text, the human-perceptible disclosure (a visible label saying "AI-generated") is the primary obligation. Machine-readable text watermarking is technically aspirational. But "technically feasible" is a moving target. If someone ships a reliable text watermarking system that doesn't degrade quality, the feasibility defense evaporates.

What about the tension between watermarking and provenance?

There's a real engineering concern here. Research has highlighted potential contradictions between C2PA provenance manifests and invisible watermarks. They can interfere with each other in downstream workflows. If you're processing content through multiple stages (generation, editing, format conversion, delivery), you need to test that both mechanisms survive the pipeline intact. This is not a theoretical concern; it's a QA problem you can reproduce in your staging environment today.

What about agentic AI systems?

This is the hardest part of Article 50 to implement correctly, and most teams haven't started thinking about it.

The disclosure duty explicitly covers agentic AI systems that carry out tasks autonomously. It doesn't matter whether the AI talks to the person who gave the instruction or to third parties it encounters along the way. If a provider can't reliably rule out human contact, the agent must disclose its artificial nature in every likely-contact situation.

Think about what this means for an AI agent that sends emails on behalf of a user, or one that calls a business to book an appointment, or one that participates in a group chat. Each of those contact points with a human is a separate disclosure trigger. The agent can't rely on the fact that the person who deployed it knows it's AI; it has to tell every new human it encounters.

From an architecture perspective, this means disclosure can't be a UI-layer concern. It has to be a property of the agent's communication protocol. Every outbound message to a potentially human recipient needs to carry disclosure, whether that's an email header, a preamble in a chat message, or a spoken introduction on a phone call. Each channel needs its own treatment. A single banner on your web dashboard doesn't cover the Slack messages your agent sends or the emails it drafts.

We think about this as the same class of problem as consent propagation in multi-service architectures. You can't bolt it on after the fact. It has to be a first-class system property, propagated across every communication channel the agent might touch.

What are the penalties?

Penalties reach €15 million or 3% of worldwide annual turnover, whichever is higher. Enforcement is handled by national competent market surveillance authorities in each EU member state.

One useful detail: content generated before August 2, 2026 does not need to be labeled retroactively. You don't need to go back and watermark everything you've ever generated. But anything produced from that date forward is in scope.

What has the Commission published as guidance?

The European Commission published draft guidelines on the transparency obligations on May 8, 2026, the first Commission instrument to interpret Article 50 across its full scope. A targeted consultation ran until June 3, 2026.

The Code of Practice on Transparency of AI-Generated Content, released June 10, 2026, is the technical companion piece. It's not legally binding on its own, but it will become the reference point for what enforcement authorities consider compliant. When a major provider signs it and implements C2PA, that becomes the standard everyone else is measured against.

What should an implementation plan look like?

Here's what we'd scope if we were starting from scratch. This is roughly ordered by effort required.

1. Audit every human-facing touchpoint

Map every channel where your AI system communicates with or produces output visible to a human. Web chat. Mobile app. API responses consumed by third-party UIs. Email. Voice. Slack or Teams integrations. Each one needs its own disclosure treatment because each has different UX constraints. A visible text label works in a chat window. It doesn't work for a voice call.

2. Build the chatbot disclosure UX

For each conversational interface, implement a clear, upfront disclosure that the user is interacting with an AI system. Place it before the first exchange. Make it non-dismissable (meaning the user can't close it before seeing it). Use plain language. "You are chatting with an AI" is fine. "Welcome to your AI-powered experience" is not.

3. Implement synthetic content labeling

If you generate images, audio, or video: embed C2PA manifests in the output. If you generate text: add a visible human-perceptible label. Machine-readable text marking can wait until the technology matures, but the visible label cannot.

4. Build the audit trail

Log what disclosure was shown (or what exemption was claimed) for each user interaction, timestamped, versioned, and tied to the specific interface version. This is your evidence if someone challenges your compliance. Treat it like consent records under GDPR.

5. Handle the agentic case

If your AI system contacts humans autonomously (outbound emails, phone calls, messages in shared channels), build disclosure into the communication protocol itself. This is the hardest part. Every outbound message to a human must carry disclosure. If you can't determine with certainty whether the recipient is human, assume they are and disclose.

6. Document the "obvious" analysis

If you're claiming the exemption for any interface, write the analysis now. Describe your target audience. Explain why a reasonable member of that audience would know they're talking to AI without additional disclosure. Get it reviewed. Store it where you store your GDPR documentation.

Why does transparency matter beyond compliance?

We run an AI assistant. We've learned something building it: publishing your own limitations builds more trust than hiding them. When we tell users plainly what our system is and what it isn't, engagement goes up, not down. People don't want to be tricked into thinking they're talking to a human. They want to know what they're working with so they can calibrate their expectations.

Article 50's disclosure requirements encode something that good product teams already know. Transparency is not a cost center. It's a trust primitive. The teams that treat it as a design constraint rather than a legal checkbox will build better products. The ones that try to find the minimum viable disclosure will spend more time and money on compliance lawyers than they would have spent just being clear with their users in the first place.

The regulation is here. The deadline has passed. Build the disclosure UX, build the audit trail, and ship it. The alternative is worse.

Start a free 7-day trial, no card required.

Frequently Asked Questions

What are the four obligations under Article 50?

Article 50 requires chatbot disclosure (telling users they're talking to a machine), synthetic content labeling (marking AI-generated or manipulated media), deepfake disclosure (flagging content depicting real people saying or doing things they didn't), and notice for emotion recognition or biometric categorization. Each has different triggers, responsible parties, and technical requirements, so they can't be satisfied with a single generic disclosure.

Did the Digital Omnibus package delay Article 50's deadline?

No, the Omnibus package only deferred the Annex III high-risk compliance obligations to December 2, 2027, and explicitly left Article 50's transparency duties out of that deferral. The only exception is machine-readable marking under Article 50(2) for systems already on the market before August 2, 2026, which got until December 2, 2026; chatbot disclosure and deepfake labeling still started on August 2, 2026.

Who is actually affected by Article 50?

The obligations apply even to limited-risk systems, not just high-risk categories, and transparency triggers affect roughly 33% of respondents in compliance checker data, second only to AI literacy requirements. Extraterritorial reach applies too, so UK or other non-EU businesses serving EU users are in scope, similar to GDPR's jurisdictional logic.

What counts as compliant disclosure for a chatbot?

Disclosure must be an affirmative, clearly perceivable statement at or before the start of the interaction, such as a visible label saying users are talking to an AI system. Burying it in terms of service, using vague labels like "assistant," or relying only on metadata is explicitly non-compliant, and in sensitive contexts one-time disclosure may need to be repeated.

How does the 'obvious' exemption work, and can teams rely on it?

The exemption applies only when it would already be obvious to a reasonably informed member of the specific target audience that they're interacting with a machine, and the burden of proving this sits on the provider, who must document their reasoning. Because the exemption is judged against the target audience's expected sophistication and context, and because AI systems are becoming more human-like, the exemption is narrow and shrinking, especially for polished, conversational products.

Sources & References

Michael C.

Michael C.

Founder & Principal Engineer, Selina Labs

Michael builds Selina, a privacy-first AI that remembers you across conversations. He ships security-sensitive AI in production — real attacks, real fixes, measured in minutes and dollars — and writes about privacy, security, and LLMs from that seat. Top Rated Plus and expert-verified on Upwork.

Learn more about Selina.ai