Blog/Regulation

Article 50 of the EU AI Act applies from 2 August 2026

28 July 20266 min readObstruo team
RegulationEU AI ActTransparency

Transparency stops being guidance and becomes an obligation. It is a request-path problem, not a product-copy problem.

On 2 August 2026, Article 50 of the EU AI Act (Regulation (EU) 2024/1689) starts to apply. It is the transparency article, and it is unusually concrete for a regulation that spends most of its length on risk classification.

It is also close enough now that the guidance has stopped moving. The Commission adopted the final version of its Guidelines on the transparency obligations under Article 50 on 20 July 2026, thirteen days before the obligations bite. The Code of Practice on Transparency of AI-Generated Content was published on 10 June and has since been assessed as adequate by both the Commission and the AI Board. The EU icons for labelling synthetic content came out alongside it. Whatever you build now, you are building against a settled reading.

Fines for getting this wrong reach 15 million euros or 3% of total worldwide annual turnover, whichever is higher. Enforcement sits mainly with national market surveillance authorities, with the AI Office holding a narrow slice and the European Data Protection Supervisor covering EU institutions.

Four obligations, two roles, one date

The common summary of Article 50 is that chatbots have to say they are chatbots and AI images have to be labelled. That is two of four duties, and it collapses a distinction that decides where the work goes in your stack.

ProvisionWho it bindsWhat it requires
50(1)ProviderSystems that interact directly with people must be designed so those people know they are dealing with AI, unless it is obvious
50(2)ProviderOutputs of generative systems must be marked in a machine-readable format and detectable as artificially generated or manipulated
50(3)DeployerPeople exposed to emotion recognition or biometric categorisation systems must be informed
50(4)DeployerDeepfakes must be disclosed, and AI-generated text published to inform the public on matters of public interest must be labelled
50(5)BothThe information must be clear, distinguishable, accessible, and given no later than the first interaction or exposure

Provider and deployer are defined roles, not descriptions of company size. You are a provider if you develop a system and place it on the EU market or put it into service under your own name. You are a deployer if you use one under your authority in a professional capacity. Most teams shipping AI features are both, on different systems, on the same afternoon.

Two scope points that surprise people. Providers outside the EU are covered when the output of their system is used in the EU. And systems released under free and open-source licences get no exemption here.

The distinction most teams get wrong

Article 50(2) asks providers for a mark a machine can read. Article 50(4) asks deployers for a label a person can see or hear.

These are not two descriptions of the same feature. The Commission has been explicit: a deployer cannot discharge its disclosure duty by pointing at the machine-readable mark the provider embedded. The disclosure has to be perceivable by an ordinary person, without special tools and without taking any deliberate action to reveal it.

So the same generated image can carry a signed provenance manifest, an imperceptible watermark, and still leave you non-compliant because nothing visible tells the viewer what they are looking at. One obligation lives in the artefact. The other lives in the presentation of the artefact. If your compliance plan has only one owner, it is missing half the requirement.

Why it does not stay in the product copy

The tempting reading is that this is a design task. Add a line to the chat header, add a caption under generated images, done.

That works until the second team ships, or the first team ships a variant, or the assistant is embedded in a partner surface where your header does not exist. Transparency is a property of the output, not of the page around it. Once you accept that, the enforcement point stops being the frontend and becomes the place every model call already passes through.

If an obligation can be satisfied by a component, it can be forgotten by the next team that does not use that component. If it is satisfied in the request path, forgetting it is not an option.

The regulation reinforces this from its own direction. Article 50(5) fixes the timing at first interaction or first exposure, which is a property of the response, not of the roadmap. Text published on matters of public interest is exempt only where a human with relevant expertise reviewed the substance and someone holds editorial responsibility; spell-checking does not count. That is an assertion about a workflow, and asserting it credibly six months later means it has to have been recorded when the response was produced.

What in-path enforcement looks like

For disclosure, a policy attaches the required statement to the responses that need it, per project and per jurisdiction, with the wording versioned so you can show what was in force on a given date. For synthetic media, marking is applied to the artefacts leaving the boundary rather than to the surface displaying them.

  • Disclosure requirements set per project, so a regulated assistant and an internal tool do not get the same treatment by accident.
  • The active version of the wording recorded on every request, not just in a document.
  • Media marking applied where the artefact is produced, so downstream reuse keeps the marking.
  • Upstream marks preserved rather than stripped, which the Code of Practice treats as a duty in its own right alongside a ban on circumvention tooling.
  • A record you can query when someone asks what a user in Germany was told on 14 March.

The Code of Practice is worth reading even if you do not sign it, because it is the closest thing to a technical specification anyone will get. Its marking approach is layered: digitally signed, time-stamped, tamper-evident metadata in formats that support it, with C2PA as the de facto answer, plus an imperceptible watermark inside the content that survives compression, cropping, scaling and format conversion. For free-form text over roughly 200 tokens, watermarking is expected rather than optional in the final text, which closed off the signed-manifest alternative earlier drafts allowed. Providers are also expected to make detection available to the public, as a specification, a tool, or a free API.

Signing is voluntary. Not signing means demonstrating compliance some other way, and the Commission has said plainly that non-signatories should expect more requests for information.

The latency question, answered

The objection to in-path enforcement is always performance. We measured ours.

Image watermarking, as an on/off delta against a near-zero-latency stub, adds roughly 16 to 29 ms for a chat-sized image between 256 and 1,024 px, and about 90 ms at 4,096 px. Generation itself takes seconds, so the compliance step is a low single-digit percentage of the work. The text disclosure spliced into a generated response measures 8 to 26 microseconds in-process, three orders of magnitude below anything a person can perceive.

Those image figures come from a loaded development machine, so read them as order-of-magnitude rather than as a spec sheet. The conclusion survives the error bars: the reason to keep transparency out of the request path is not latency, because there is not enough latency in it to argue about.

The exceptions, and how far they stretch

Article 50 is broad but not unlimited. The carve-outs that matter in practice:

The obvious exception (50(1)). No notice is required where a reasonably well-informed, observant person would already know they are talking to a machine. The Guidelines say to read this restrictively, since it removes a protection.

Standard editing (50(2)). Assistive functions that do not substantially alter input data fall outside the marking duty. The Guidelines carry a set of examples, which is where the line actually gets drawn.

Content that is not really content. Short sequences of characters, source code, machine-to-machine output never seen by a person, and outputs used inside closed industrial or product-development loops, unless they are the final output.

Business-to-business and industrial contexts. A narrow exemption, on conditions set out in the Guidelines.

Artistic, creative, satirical and fictional work. Deepfake disclosure is still required, but in a manner that does not spoil the experience of the work.

Human review and editorial control (50(4)). Published text is exempt where a person with relevant knowledge examined the substance, or an editorial entity with authority to alter or reject it exercised control, and someone holds ultimate legal responsibility.

Also worth knowing: content generated before 2 August 2026 does not need retroactive marking. For text published on matters of public interest the relevant date is publication, so a draft written in July and published in August is in scope.

One date is not the date

The 2 August cliff has a single documented step, and as of last week it is settled law rather than a negotiating position. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July, on an urgency timetable written into the regulation itself precisely because the date it amends falls on 2 August.

For AI systems already placed on the market before 2 August, the machine-readable marking duty under Article 50(2) applies from 2 December 2026 instead. That extension covers the marking obligation only, and only for systems already on the market. It ended up shorter than the six months the Commission originally proposed.

Everything else applies on 2 August, to every system in scope, regardless of when it shipped. If you are launching after the cutoff, the marking duty is immediate.

The same regulation moved the high-risk regime to 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for AI embedded in regulated products. Article 50 did not move with it. If your AI Act programme was sequenced around a single August date, that sequence is now two separate programmes.

The part teams underestimate

Article 50 is not the hard part of the AI Act. It is the part with the nearest date.

Teams that treat it as a frontend ticket will satisfy it for their current surfaces and quietly fail for the next three. Teams that put it in the path satisfy it once, and get the evidence as a side effect.

That is the pattern for most of this regulation: the obligation is easy to describe, and only enforceable if it lives somewhere every call has to go.

This is an engineering perspective on where transparency obligations are best enforced, not legal advice. Article 50 turns on facts specific to your systems and your role in relation to each one. The Commission Guidelines are non-binding, and only the Court of Justice can give an authoritative reading of the Act.

Sources

Companion checklistArticle 50 before 2 August: a working checklistOpen the checklist