On 2 August 2026, the Article 50 transparency requirements of the EU AI Act came into effect. Failure to comply can lead to fines of up to 3% of annual global turnover or €15 million, whichever is higher.
Article 50 applies regardless of risk tier and imposes duties on both providers (design‑stage obligations) and deployers (use‑stage obligations). It is now one of the most broadly applicable obligations in the EU AI Act, covering nearly all interactive or generative AI systems placed on or used within the EU market.
There is an exception to this timescale: the Digital Omnibus added a grace period that applies to the marking and detection obligation under Article 50(2) for businesses that placed an AI system on the EU market before 2 August 2026. In this scenario, you have until 2 December 2026 to comply.
A challenge faced by many businesses is understanding the extent to which their use of AI falls in scope of the transparency obligations. This guide gives a checklist to help you understand what actions you must take.
1. Take an inventory
Review all the AI tools in use in your business. This is likely to be a mixture of third-party efficiency tools under an enterprise licence, such as Copilot; third-party, task-driven tools like Cursor or Canva; and tools which have been built in-house either for internal company use or for external use by customers.
You are likely to also find a variety of applications such as ChatGPT and Claude, which staff are using in a ‘shadow’ capacity. A Microsoft study found that 51% of UK staff regularly use unapproved AI tools at work, so it is important to understand how AI is being used in your company.
2. Map regions you operate in and applicable law
AI regulations are diverse across jurisdictions, and it cannot be assumed that compliance with one regulation, such as the EU AI Act, will give blanket compliance across regions. Mapping out the countries in which an AI system is offered or used, alongside estimated user volumes in each country, is an important step in identifying applicable requirements. Other factors, including the organisation’s role and where the system’s outputs are used, may also be relevant.
It may also be necessary to consider how AI regulations interact with other applicable legislation, taking into account the jurisdiction in which an organisation operates and its sector of activity.
For example, for some services, there are additional transparency requirements under the EU Digital Services Act: VLOPs (very large online platforms) must explain the main parameters used by their recommender systems which determine what a user sees.
3. Identify your role
The EU AI Act distinguishes obligations by role. The two roles you need to identify are provider and deployer.
Provider
This is the company (or person) that has developed an AI model, a GPAI (general-purpose AI) model or an AI system which is placed on the EU market under their name. If your business offers an AI tool as part of your product, even if you did not build the model, you are expected to follow the obligations for providers. If you are based outside the EU but offer your services inside the EU, the Act still applies.
Deployer
This is where a company or person is using an AI system in the course of their day-to-day operations. In the majority of cases, this is where your business has engaged a third-party software provider for enterprise tooling which has an AI component. Common examples are HR recruitment platforms, online training platforms and CRM (customer relationship management) systems.
If you are acting as a deployer in a purely personal capacity, such as using a chatbot for your own private tasks, then this is exempt under the Act. In some circumstances, a business may be both a provider and a deployer, depending on its use case. For example, a business may have a product with AI which is sold commercially (provider role) while also using the same product internally (deployer role).
Additional roles are defined in the Act, such as importer and distributor, but the Article 50 transparency obligations do not apply to these roles. Another consideration to note is that the EU AI Act classifications (use case risk and actor role) are independent of the GDPR (General Data Protection Regulation) concepts of controller and processor, which in turn have their own obligations relating to transparency when personal data is being processed.
4. Identify your use cases
The EU AI Act applies obligations by system type, broken down into categories of use. When this is combined with the role definitions, it is then easier to understand what controls must be applied.
Use case 1: A provider offering an interactive system
For example, a chatbot front end to a customer service centre.
Steps to take: You must inform users that they are interacting with an AI system. This could be through a graphic or a text label for an online portal, or an audio message if it’s a call centre.
Â
Use case 2: A provider offering a system which generates or manipulates synthetic images, video, audio or text
For example, a tool which creates videos, or a training platform provider which offers tools for creating content using a combination of images, text and audio.
Steps to take: Make sure the outputs are marked as AI in a machine-readable format, such as a watermark. The focus of this requirement is establishing the provenance and detectability of material which has been AI generated.
Â
Use case 3: A deployer using an AI system which performs emotion recognition or biometric categorisation
For example, a computer game which captures the players’ emotions during the game.
Steps to take: You must inform users that the AI is being used (unless the specific statutory law-enforcement exception applies).
You must also review the requirements for high-risk AI systems, which may have additional safeguarding requirements.
Use case 4: A deployer creating or manipulating deepfake images, audio or video
A deepfake is any synthetic content which has been produced or manipulated by an AI and which could be mistaken for a real person, place or object. Deepfakes are often associated with misinformation, but can also be used for legitimate purposes, such as in advertising.
The audience consuming the content must be considered, to account for groups who may be more easily misled such as children or the elderly.
Content that is AI generated but clearly untrue, such as a flying unicorn in a fictitious forest, is exempt. Deepfake labelling must be explicit; deployers cannot rely on watermarking alone to indicate fake content.
Steps to take: You must inform those seeing the output that it has been AI generated or AI modified. For evidently artistic, creative, satirical or fictional works, disclosure is still required but may be provided in a manner that does not hamper enjoyment of the work, so these should be checked first. It may also be that, for example, an AI-generated image meets the conditions for being watermarked initially by the provider and is subsequently labelled by the deployer to cover both the technical and the user-focused parts of the Act.
Â
Use case 5: A deployer publishing texts which are used to inform the public on matters of public interest
For example, a newspaper or magazine article (offered for free or under paid subscription), which has been written by AI, without the involvement of a human responsible for substantial editorial control. Exemptions include AI-produced books which are not about matters of public interest and chatbot news summaries given in response to a user prompt. The label applied to the generated text should be clear to all users, without the need for additional tools or special actions.
Steps to take: Assess whether the text meets the requirements of public interest and check for meaningful human involvement. If there are no applicable exemptions and the conditions still apply, then ensure your article is clearly marked as AI generated.
5. Apply labels
The EU offers icons for use (below), but organisations may create their own equivalent labels if desired. The principle is that organisations must support efforts to combat deception and misinformation, which in turn promotes public trust and encourages the responsible use of AI.
Before applying a label, decide who needs to see it, when it should appear, what wording or iconography will be used, and whether the proposed label is accessible.
Another consideration is whether your users include children and, if so, to ensure that labelling is suitable for this audience. You must also address the timing of when the transparency label is given. Generally, this must be provided at the first interaction or exposure at the latest – in practice within the first few seconds of use – and should be repeated when content is refreshed, such as a new level of a game or a new video in a training session.
The EU icons for AI-generated content
 | For use when AI was involved in the creation of deepfake content (image, audio, video) or published text or when a custom text label or interactive second layer is implemented. |
 | For use when pre-existing, human-made content was partially modified with AI turning it into a deepfake or text on matters of public interest. |
 | For use when the entire deepfake content (image, audio, video) or text is fully generated by AI with no human-created elements or human editorial control (apart from prompting). |
You can download these icons here.
Practical considerations
While the European Commission has published some useful information, in day-to-day operations there are likely to be a number of grey areas. Challenges are already being seen in this regard.
For example, it is rare for a piece of content to be solely AI generated – more often, this is a sliding scale, from a document that was authored by a human but has some minor editing done by an AI, right through to an article which was written by generative AI and then edited by a human.
A simple ‘AI Generated’ or ‘AI Modified’ label does not cover such nuance.
Anthropic’s recent announcement that it is applying watermarking to generated text from supported Claude models by default has been met with mixed responses. A watermark cannot distinguish between an item that is wholly AI generated and an item which was human produced but just touched by AI in the final stages of production.
From an AI governance perspective, this nuance can affect business reputation and raise the debate about how a business implements transparency in relation to the extent of its AI use, to qualify any possible misperceptions.
If credibility is at stake, then stating AI was used to proofread a report is perhaps better than leaving the recipient to wonder whether there was any human involvement at all.
While Anthropic is simply following its obligations under the Act, some users are now attempting to use tools to remove watermarking where they are operating in a region which does not require this by law. The technicalities of the preservation of watermarks are too complex to review here, but it is likely that this is just the beginning of debate and implementation complexity to address going forward.
Action to take to comply with Article 50
Since Article 50 began to apply on 2 August 2026, there has been scrutiny around how to implement its requirements. We expect that scrutiny to intensify, especially in the run up to the 2 December deadline.
Businesses should act now to make sure that:
- They know what AI systems are being used and can identify the use cases where the Article 50 (and other transparency) obligations apply.
- They are clear on their role under the Act, and employees understand that if they deviate from the approved use of an AI, the business can be at risk for fines from uncontrolled or unintended use due to unknowingly falling into one of the applicable categories.
- They have clearly identified where transparency must be implemented and agreed what that implementation looks like.
- For new systems or those under development, that the requirements of the Act are included in the system design requirements and are checked at design reviews in project stage gates.
- For providers of systems subject to Article 50(2) that were placed on the market before 2 August 2026, a feasibility assessment and delivery plan to have the required controls in place before the cut-off in early December.
- They have discussed AI governance in the business and reviewed AI use against business objectives and business risk appetite, in light of the requirements of the Act.
- They have considered where the Act may apply indirectly, even if they do not operate in Europe as the extra-territorial effect means customers or supply chain are likely to face due diligence checks relating to the Act, which in turn may confer requirements on their business.