Article 50 of the EU AI Act began applying on 2 August 2026. It introduces transparency obligations for providers and deployers of certain interactive and generative AI systems, including duties around direct AI interaction, machine-readable marking of synthetic content, deepfakes, emotion recognition, biometric categorisation, and some public-interest text.
The practical question is not simply, “Does our company use AI?” It is, “Where does AI touch a person, content, or decision; what role do we play in that system; and what notice, marking, process, or record is required?” This article offers an implementation framework, not legal advice. Businesses with EU exposure should confirm their position with qualified counsel.
What Article 50 changes
The European Commission’s guidance explains that providers must design relevant AI systems so people are explicitly informed when they are directly interacting with AI. Providers must also add machine-readable marks that enable detection of AI-generated or manipulated content. Deployers must inform people when they are exposed to emotion-recognition or biometric-categorisation systems, deepfakes, and text on matters of public interest that is generated or manipulated by AI without human review or editorial control.
These are not all the obligations in the AI Act, and not every AI use falls within Article 50. The guidelines include definitions, examples, exceptions, and ways to demonstrate compliance. The work therefore begins with classification, not with adding the same “made with AI” badge everywhere.
First determine your role: provider, deployer, or both
A provider develops an AI system or has it developed and places it on the market or puts it into service under its name or trademark. A deployer uses an AI system under its authority, except in a non-professional personal activity. A business can be a deployer for a third-party chatbot and become a provider when it materially builds, brands, or supplies its own AI-enabled product. Role analysis can change by feature.
Business situation
Likely role to assess
Transparency question
Using a third-party support chatbot on the company website
Deployer, and possibly additional responsibilities depending on implementation
Does the visitor clearly know the conversation is with AI before relying on it?
Selling a branded AI assistant built on another model
Potential provider and deployer roles
Who implements the notice, marking, documentation, and downstream instructions?
Publishing AI-assisted marketing copy after substantive human editing
Deployer/content publisher
Is the content within a specified disclosure category, and what human review occurred?
Publishing an AI-generated video portraying a real person or event
Deployer
Is it a deepfake requiring clear disclosure?
Using emotion recognition in a customer or employee experience
Deployer
Is the person informed, and do other AI Act or data-protection rules restrict the use?
Do not assign the role solely from a vendor’s marketing language. Review the contract, technical architecture, branding, fine-tuning, configuration, distribution, and who controls the feature presented to users.
Build an inventory of AI touchpoints
Create one register covering customer-facing, employee-facing, and content-production uses. Include chatbots, voice agents, search assistants, recommendation tools, image and video generation, translation, automated summaries, recruitment tools, fraud systems, biometric features, and any API that can produce synthetic output.
For each entry, record the owner, vendor, model or service, purpose, people affected, countries served, input data, output type, human review, publication channel, retention, contractual terms, and current disclosure. The inventory should capture experiments as well as production tools; “temporary” pilots frequently become customer-facing before controls catch up.
Design disclosures around the user’s decision point
A disclosure is useful when a person sees it before or at the moment it changes how they interpret the interaction. A tiny notice buried in terms and conditions is unlikely to help a customer calibrate trust during a live AI conversation.
For chatbots and voice agents
- Identify the system as AI at the beginning of the interaction in clear language.
- Keep the notice visible or readily available throughout longer sessions.
- Explain important limits, especially where responses may be incomplete or incorrect.
- Provide a practical route to a human when the matter is sensitive, disputed, or outside scope.
- Do not design an avatar, name, or typing behavior to mislead users into believing a human is present.
For generated or manipulated media
Use a visible disclosure that fits the medium and context, and preserve the provider’s machine-readable provenance or detection mechanism when applicable. Avoid stripping metadata or transforming files in a workflow that unintentionally removes required markings. Test whether common exports, compression, content-management systems, and social platforms retain the intended signals.
For public-interest text
Map the editorial process. The Commission guidance specifically addresses AI-generated or manipulated text published to inform the public on matters of public interest when there is no human review or editorial control. Record who reviewed the text, what they checked, what authority they had to change or reject it, and when the review occurred. A nominal approval button is not automatically meaningful editorial control.
Create a technical implementation plan
Translate the legal analysis into testable product requirements. Define the exact notice copy, where it appears, when it triggers, language variants, accessibility behavior, logging, content-marking method, export behavior, API responsibilities, failure states, and owner for future updates.
For an AI assistant, acceptance criteria might include: the notice appears before the first generated answer; screen readers announce it; the user can reach a human; transcripts indicate AI participation; the feature does not claim human identity; and analytics confirm the notice is rendered across mobile, desktop, and embedded contexts. For generated media, criteria might test whether provenance survives the publishing pipeline.
Review vendor contracts and APIs
Ask vendors which Article 50 obligations they believe they satisfy as provider, what technical markings they supply, how downstream deployers should preserve them, which versions are covered, and how they will notify customers of changes. Documenting a vendor answer is useful, but it does not transfer every responsibility away from the business operating the experience.
API integrations deserve special attention because the end user may never see the provider’s interface. Your product must surface the appropriate notice and preserve required signals. Confirm whether a model response, image, audio file, or video includes metadata and whether your processing steps remove it.
Keep evidence, not just screenshots
A strong evidence file includes the AI inventory, role assessment, relevant contracts, design decisions, approved disclosure copy, test cases, release records, accessibility checks, content-review policy, staff responsibilities, training, incident reports, and periodic reassessment. Screenshots are helpful, but they do not show whether the system behaved correctly across all routes and versions.
Common implementation mistakes
- Adding a generic AI statement to the privacy policy and assuming every transparency duty is covered.
- Ignoring internal tools that affect employees or candidates.
- Removing machine-readable provenance during resizing, editing, or content delivery.
- Calling a workflow “human reviewed” without defining the reviewer’s checks and authority.
- Letting marketing launch an AI feature before product, legal, security, and support teams agree on ownership.
- Using dark patterns that visually minimise or obscure the disclosure.
- Failing to retest after a model, vendor, interface, or publishing pipeline changes.
A 30-day business action plan
Week
Priority
Deliverable
Week 1
Discover
Inventory AI systems and public content workflows; identify EU-facing products and audiences.
Week 2
Classify
Map provider/deployer roles, Article 50 categories, exceptions, and legal questions.
Week 3
Implement
Add notices, handoff paths, content labels, technical markings, records, and accessibility behavior.
Week 4
Verify
Run product tests, review vendor evidence, train owners, log gaps, and schedule reassessment.
When to get professional help
Seek legal advice when role, territorial scope, exceptions, deepfake classification, biometric use, or interaction with privacy and consumer law is unclear. Seek product and engineering help when the disclosure must work across a website, app, API, content-management system, or generated-media pipeline.
Southside Devs builds web applications, mobile apps, APIs, system integrations, websites, and cloud systems. For an AI-enabled experience, the useful technical question is how to make approved transparency requirements visible, accessible, testable, and maintainable in the real product. Review the verified service scope at https://southsidedevs.com/services or start a technical discussion at https://southsidedevs.com/contact.
Conclusion
The EU AI Act transparency rules turn AI disclosure from an informal trust practice into a defined compliance task for specified systems and uses. Start with an inventory and role map, then connect legal requirements to interface copy, machine-readable signals, human review, vendor responsibilities, testing, and records. The goal is not to label everything indiscriminately; it is to ensure people understand when AI materially shapes an interaction or piece of content.
Frequently asked questions
When did the EU AI Act transparency rules start applying?
Article 50 applies from 2 August 2026, according to the European Commission’s guidance. Other parts of the AI Act have different timelines, so businesses should not assume one date covers every obligation.
Does every chatbot need an AI disclosure?
Article 50 addresses direct interaction with AI systems, subject to its scope and exceptions. A business should assess the specific system and user context, then ensure the person is explicitly informed where required. Do not rely on a hidden terms-of-service clause as the only notice.
What is a machine-readable mark?
It is a technical signal intended to help systems detect that content was generated or manipulated by AI. The method may involve provenance data, metadata, watermarks, or other techniques. Businesses should follow provider documentation and verify that their editing and publishing workflows preserve the signal.
Does human review remove every disclosure requirement?
No. Human review is relevant to the specified category of AI-generated or manipulated public-interest text, but other duties can still apply, including those for direct AI interaction or deepfakes. The quality and reality of editorial control also matter.
Do companies outside the EU need to care?
Potential applicability can depend on how a system or service reaches the EU market and people in the EU, among other factors. A non-EU business with EU customers, users, distribution, or operations should obtain legal advice rather than assume location alone excludes it.
Is this checklist a substitute for legal advice?
No. It is a product and operational framework based on public guidance. The AI Act is context-dependent and interacts with data protection, consumer protection, intellectual property, employment, sector rules, and contracts. Qualified counsel should confirm obligations for material uses.