EU AI Act Article 50 has been in force since 2 August 2026. It imposes four transparency duties: tell people when they are interacting with an AI system, mark AI-generated output so machines can detect it, disclose emotion recognition and biometric categorisation, and label deepfakes and AI-generated public-interest text.
The Commission finalised the Code of Practice on Transparency of AI-Generated Content on 10 June 2026, with guidelines on the scope of Article 50 following. The Code is voluntary. The obligation is not.
One deadline remains open. Generative AI systems placed on the market before 2 August 2026 benefit from a targeted grandfathering rule for the Article 50(2) marking duty, introduced by the AI Omnibus. That transition closes on 2 December 2026, which is eight weeks away.
Content generated and made publicly available before 2 August 2026 never needs retroactive marking. Content produced after that date does.
Official text: Article 50, Regulation (EU) 2024/1689
Key Definitions in AI Act Article 50
| Term | Definition |
|---|---|
| Provider | A natural or legal person that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trade mark (Article 3(3)) |
| Deployer | A natural or legal person using an AI system under its authority, except where used in a personal non-professional activity (Article 3(4)) |
| Synthetic content | Audio, image, video or text output generated or manipulated by an AI system |
| Marking | Machine-readable embedding that makes output detectable as artificially generated or manipulated. The Article 50(2) provider duty |
| Labelling | Human-visible disclosure that content is artificially generated or manipulated. The Article 50(4) deployer duty |
| Deepfake | AI-generated or manipulated image, audio or video content resembling existing persons, objects, places, entities or events, which would falsely appear to a person to be authentic or truthful (Article 3(60)) |
| Emotion recognition system | An AI system for identifying or inferring emotions or intentions of natural persons on the basis of their biometric data (Article 3(39)) |
| Biometric categorisation system | An AI system assigning natural persons to specific categories on the basis of their biometric data (Article 3(40)) |
| Code of Practice | The Code of Practice on Transparency of AI-Generated Content, finalised 10 June 2026. Voluntary, covering Article 50(2) and 50(4) |
| Content provenance metadata | Embedded data recording the origin and editing history of a file, for instance under the C2PA standard |
What AI Act Article 50 Requires
Article 50 sets four duties. They attach to different parties and are often conflated, which is the most common source of error in compliance programmes.
| Paragraph | Duty | Who | Trigger |
|---|---|---|---|
| 50(1) | Inform people they are interacting with an AI system | Provider | AI systems intended to interact directly with natural persons, unless obvious from the circumstances |
| 50(2) | Mark output in a machine-readable format, detectable as artificially generated or manipulated | Provider | Generative AI systems producing synthetic audio, image, video or text |
| 50(3) | Inform people they are exposed to the system | Deployer | Emotion recognition or biometric categorisation systems |
| 50(4) | Disclose that content is artificially generated or manipulated | Deployer | Deepfakes, and AI-generated text published to inform the public on matters of public interest |
Article 50 governs transparency about AI. It does not restrict what AI may be used for. A deepfake that is properly labelled is lawful under Article 50. An unlabelled one is not.
The provider and deployer split
Article 50(2) is a design-time duty on the provider: mark at the point of generation, in machine-readable form, and keep the mark intact through the export formats the system supports.
Article 50(4) is a publication-time duty on the deployer: make the disclosure visible to a human looking at the content.
A provider that marks correctly has not discharged the deployer’s labelling duty. A deployer that labels visibly has not discharged the provider’s marking duty. Organisations that are both, which is most companies building on third-party models, carry both.
AI Act Article 50 Exceptions
Article 50 contains carve-outs that are narrower than they are usually assumed to be.
| Exception | Scope |
|---|---|
| Obviousness (50(1)) | No disclosure needed where it is obvious from the circumstances and the context of use to a reasonably well-informed, observant and circumspect person that they are interacting with an AI system |
| Law enforcement (50(1), 50(2), 50(4)) | Disapplied where AI is authorised by law to detect, prevent, investigate or prosecute criminal offences, subject to safeguards for third-party rights |
| Assistive editing (50(2)) | Marking not required where the AI performs an assistive function for standard editing, or does not substantially alter the input data or its semantics |
| Artistic and satirical works (50(4)) | Disclosure limited to revealing the existence of the generated content in an appropriate manner that does not hamper the display or enjoyment of the work |
| Human editorial review (50(4), text) | Text disclosure not required where the AI-generated text has undergone human review or editorial control and a natural or legal person holds editorial responsibility for the publication |
The assistive editing exception is the one most often over-read. Standard colour correction or noise reduction sits inside it. Generative fill that inserts objects into an image does not.
The editorial responsibility exception for text requires a person or entity to actually hold editorial responsibility, not merely to have glanced at the output. An automated publishing pipeline with no accountable editor does not qualify.
The Code of Practice on Transparency of AI-Generated Content
Article 50(7) tasked the AI Office with facilitating codes of practice to support implementation of the detection and labelling obligations. The Commission ran that process over six months.
| Date | Development |
|---|---|
| 17 December 2025 | First draft published, feedback to 23 January 2026 |
| 3 March 2026 | Second draft published, feedback to 30 March 2026 |
| 8 May 2026 | Draft Commission guidelines on the scope of Article 50 |
| 10 June 2026 | Final Code of Practice published |
| 2 August 2026 | Article 50(2), (4) and (5) become applicable |
The Code has two sections. Section 1 operationalises the Article 50(2) marking and detection duty for providers. Section 2 operationalises the Article 50(4) labelling duty for deployers. It does not cover Article 50(1) or 50(3).
One drafting change is worth knowing about. The first draft contained a taxonomy distinguishing fully AI-generated content from AI-assisted content, with different disclosure requirements for each. That taxonomy was removed entirely in the second draft. Anyone who built a compliance position on the December 2025 draft should check it against the final text.
Voluntary, with consequences
The Code is voluntary. Signing is not required and not signing is not a breach.
What signing does is establish a reference point. The underlying Article 50 duties are mandatory and enforceable from 2 August 2026. A signatory demonstrating adherence to the Code has a documented route to showing compliance. A non-signatory must demonstrate compliance by other adequate means, which in practice means more questions and more detailed answers.
Providers sign up to Section 1. Deployers sign up to Section 2. An organisation that is both can sign both.
Signing the Code of Practice, European Commission
Marking Under Article 50(2): What Providers Must Do
Article 50(2) requires providers of generative AI systems to ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. The solutions must be effective, interoperable, robust and reliable as far as technically feasible, taking into account the specificities and limitations of various types of content, implementation costs and the generally acknowledged state of the art.
The Commission kept its technical guidance deliberately high level. The Code is more specific.
| Measure | Status under the Code |
|---|---|
| Record and embed provenance information in metadata, where the content format supports it | Core commitment |
| Apply watermarking where the Code recommends it for the content type | Core commitment |
| Preserve the marking across the export formats the system supports | Core commitment |
| Provide or support detection mechanisms | Core commitment |
| Test marking robustness and document the results | Core commitment |
The Code accepts openly that no single technique satisfies the Article 50(2) requirement across all content types. A multi-layered approach combining provenance metadata and watermarking is the working standard.
The text threshold
Text is the hardest content type to mark durably, and the Code addresses this with a length threshold. Marking commitments for text apply above approximately 200 tokens. Below that, reliable marking is not currently achievable with available techniques.
This is a practical accommodation rather than a legal exemption. Article 50(2) itself contains no length threshold, and a provider relying on the Code’s threshold should document that reliance.
Keeping the mark intact
The provider’s duty does not end at generation. The Code expects marking to survive the export paths the system offers. A provider whose system strips provenance metadata on export to a common format has not met the requirement, even if the mark was applied correctly at generation.
Downstream stripping by a third party is a different question. The provider is not responsible for a mark removed by someone else’s tooling, but it is responsible for not removing it itself.
Labelling Under Article 50(4): What Deployers Must Do
Article 50(4) is the duty most organisations encounter, because far more companies deploy generative AI than build it.
Deepfakes
Deployers generating or manipulating image, audio or video content that constitutes a deepfake must disclose that the content has been artificially generated or manipulated.
The disclosure must be clear and distinguishable, provided at the latest at the time of the first interaction or exposure.
Public-interest text
Deployers using AI to generate or manipulate text published for the purpose of informing the public on matters of public interest must disclose that the text has been artificially generated or manipulated.
This does not apply where the text has undergone human review or editorial control and a person or entity holds editorial responsibility for the publication.
The scope of matters of public interest is not exhaustively defined. News, political content, public health, and matters affecting consumer or civic decisions fall within it. Routine marketing copy generally does not.
AI Act Article 50 and EU Icons
The Commission finalised three icons that deployers may use where visual disclosure is possible. They were empirically user-tested during the drafting process.
| Icon | Use |
|---|---|
| Fully AI-generated | Content generated entirely by an AI system |
| AI-modified | Existing content altered or manipulated by an AI system |
| Basic icon with interactive second layer | A minimal mark supplemented by an expandable layer carrying fuller disclosure |
The icons are localised across EU languages, so the visual mark reads AI in English, KI in German, IA in French and Spanish, and so on.
Use is optional. A deployer may use its own labelling provided the disclosure is clear and distinguishable. The practical argument for the EU icons is recognisability: a label a user has seen elsewhere is a label they understand without reading it.
The interactive second layer is the useful one for interfaces where space is constrained. A small persistent mark that expands to full disclosure on interaction satisfies the clarity requirement without dominating the content.
The 2 December 2026 Grandfathering Deadline
This is the live deadline for anyone reading this in autumn 2026.
The AI Omnibus, agreed by the co-legislators and enacted as Regulation (EU) 2026/1744, introduced a targeted grandfathering rule for the Article 50(2) marking and detection obligations. It applies to generative AI systems placed on the market or put into service before 2 August 2026.
| Situation | Position |
|---|---|
| Generative AI system placed on the market before 2 August 2026 | Article 50(2) marking duty applies from 2 December 2026 |
| Generative AI system placed on the market from 2 August 2026 | Article 50(2) applied from day one |
| Article 50(4) deployer labelling | Applied from 2 August 2026 with no transition |
| Output generated and made available before 2 August 2026 | No retroactive marking or labelling required |
| Output generated from 2 August 2026 | Marking and labelling duties apply |
Two points to remember:
The grandfathering covers the provider marking duty only. The deployer labelling duty under Article 50(4) applied from 2 August 2026 with no transition at all. A company relying on a transition period for its labelling has misread the provision.
The no-retroactive-marking rule is unqualified and useful. Archives of content generated before 2 August 2026 do not need to be reprocessed. The dividing line is the date of generation, not the date of publication or the date the system was deployed.
Interaction of AI Act Article 50 with Other Obligations
Article 50 operates alongside, rather than within, several other frameworks.
| Framework | Interaction |
|---|---|
| High-risk AI obligations (Chapter III) | Independent. A high-risk system may also carry Article 50 duties. The Annex III deadline of 2 December 2027 does not affect Article 50, which is already in force |
| GPAI obligations (Chapter V) | Independent. A GPAI model provider may separately be a provider of a generative AI system under Article 50(2) |
| Digital Services Act | Platform obligations on illegal content run separately. Article 50 labelling does not discharge DSA duties and vice versa |
| GDPR | Deepfakes of identifiable individuals engage data protection law independently of Article 50 |
| Cyber Resilience Act | Applies to the product. Article 50 applies to the output |
| Product Liability Directive (EU) 2024/2853 | Unlabelled synthetic content causing harm may be relevant to defectiveness for products placed on the market after 9 December 2026 |
The most frequent error in multi-framework programmes is treating Article 50 as part of the high-risk workstream. It is not. Article 50 applies by system type and output type, not by risk classification, and a minimal-risk system can carry a full Article 50 duty.
AI Act Article 50 Penalties
Non-compliance with Article 50 falls within Article 99(4) of the EU AI Act.
| Infringement | Maximum penalty |
|---|---|
| Breach of Article 50 transparency obligations | €15 million or 3% of total worldwide annual turnover, whichever is higher |
| Supplying incorrect, incomplete or misleading information to authorities | €7.5 million or 1% of total worldwide annual turnover |
For SMEs and start-ups, Article 99(6) caps the fine at the lower of the percentage or the fixed amount rather than the higher.
Enforcement sits with national market surveillance authorities, with the AI Office supervising GPAI model providers.
AI Act Article 50 Compliance Checklist
| Step | Action |
|---|---|
| 1 | Inventory every AI system you provide or deploy that generates or manipulates audio, image, video or text |
| 2 | Determine your role for each: provider, deployer, or both |
| 3 | Identify which of the four Article 50 duties attaches to each system |
| 4 | For systems placed on the market before 2 August 2026, confirm marking is in place by 2 December 2026 |
| 5 | Confirm Article 50(4) labelling is live now, since no transition applied |
| 6 | Implement provenance metadata and watermarking per the Code of Practice for each content type |
| 7 | Test that marking survives every export format your system supports, and document the testing |
| 8 | Decide whether to use the EU icons or your own labelling, and apply it consistently |
| 9 | Assess which of your published text falls within matters of public interest |
| 10 | Document editorial responsibility where you rely on the human review exception |
| 11 | Document any reliance on the assistive editing or obviousness exceptions |
| 12 | Decide whether to sign the Code of Practice, and record the reasoning either way |
| 13 | Check supplier contracts: if you deploy a third-party model, confirm what marking the provider applies |
Step 13 is the one most often missed. A deployer using a model that does not mark its output has a problem the deployer cannot solve alone, and the Code addresses this by setting out how a deployer can apply a compliant Article 50(4) label where the provider’s marking does not satisfy the deployer’s duty.