EU AI Act Article 50: what deployers must do from 2 August 2026

Where Article 50 sits in the Act

The EU Artificial Intelligence Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024 and applies in stages. The prohibitions in Article 5 and the AI literacy duty in Article 4 came first, on 2 February 2025. Obligations for providers of general-purpose AI models followed on 2 August 2025. Article 50, the transparency obligations, applies from 2 August 2026.

In 2026 the Act was amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on 27 July 2026. The Omnibus postponed the obligations for high-risk systems, to 2 December 2027 for the Annex III use cases and to 2 August 2028 for Annex I products. It did not postpone Article 50. If your planning assumed that everything in the AI Act had moved to 2027, this is the part that did not.

Article 50 is also the part with the widest reach. High-risk obligations concern specific uses such as hiring or credit scoring. Transparency obligations concern any system that talks to people or produces synthetic content, which describes a large share of the generative AI now in use.

What Article 50 requires

In summary, the article requires three things:

• People must be informed when they interact with an AI system. A customer chatting with an AI assistant should know it is not a person.
• AI-generated content must be marked in machine-readable form. Providers of systems that generate synthetic audio, image, video or text must make the output detectable as artificially generated.
• Deepfakes must be disclosed, as must AI-generated text that is published to inform the public on matters of public interest.

The duties are split between providers, who build the systems, and deployers, who use them. Marking output is a provider duty: it has to be built into the system. Disclosing a deepfake, or labelling AI-generated text published on a matter of public interest, falls on the deployer who publishes it.

The date still ahead: 2 December 2026

There is a transition for systems that already existed. Providers of generative systems that were placed on the market before 2 August 2026 must implement machine-readable marking of their output by 2 December 2026.

For a deployer this is a vendor-management task with a deadline. If your marketing team uses an image generator, your training team a video-avatar tool or your support team a voice-synthesis service, ask each vendor to confirm in writing that marking will be in place by that date, and how it works.

The same date brings new prohibitions on AI that generates non-consensual intimate imagery or child sexual abuse material.

Which of your systems are in scope

Work from your inventory, and sort systems by two questions.

Does it interact with people outside your organization? Customer-support assistants, sales chatbots, voice agents, AI that answers emails in your name. These need an interaction disclosure.

Does it generate content that leaves the building? Images for campaigns, synthetic voice-overs, AI-written articles or reports published to the public, video with synthetic people. These raise the marking and deepfake questions.

A system that does neither, such as an internal coding assistant or a meeting summariser used only by staff, is unlikely to trigger Article 50, though other parts of the Act and your own policy still apply to it.

The difficulty is usually completeness. The systems that were formally procured are known. The image tool a designer signed up for last month is not. This is the same problem as shadow AI discovery, and it is why a transparency programme starts with finding what is in use.

A checklist for deployers

1. 01List customer-facing and content-generating AI. For each system record what it does, who encounters its output, and who owns it internally.
2. 02Add an interaction disclosure wherever a person might otherwise think they are dealing with a human. State it at the start of the interaction, in plain words.
3. 03Confirm marking with your vendors. Ask how output is marked as AI-generated, and get confirmation of the 2 December 2026 date for older systems.
4. 04Set a rule for deepfakes and public-interest text. Decide who checks whether a published item needs a disclosure, and what the disclosure says.
5. 05Do not strip the marks. If your workflow re-encodes, crops or edits generated media, check that machine-readable marking survives, or disclose in another way.
6. 06Write it down. Record which systems are in scope, why, and what wording is used. When a regulator or a customer asks, the record is the answer.
7. 07Brief the teams involved. Marketing, communications and support are where Article 50 is met or missed. The Act's AI literacy duty, which asks you to take measures to support the AI literacy of staff, points the same way.

What a good disclosure looks like

Disclosures fail when they are hidden or vague. A line in the terms of service does not inform anyone at the moment they are talking to a bot. Aim for wording that is short, specific and placed where the interaction happens:

• In a chat window, before the first reply: You are chatting with an AI assistant. You can ask for a member of our team at any time.
• On a synthetic voice call, in the opening sentence: This call uses an AI voice assistant.
• On published synthetic media: a visible label such as AI-generated image, next to the content and not only in metadata.

Keep the approved wording in one place, so that every team uses the same text and you can show which version was live when.

What happens if you do nothing

The Act's penalties are tiered. The highest tier, up to EUR 35 million or 7% of worldwide annual turnover, is reserved for prohibited practices; lower tiers apply to other breaches, including transparency failures.

The more immediate exposure is commercial. Enterprise customers have begun to ask suppliers how AI use is disclosed, and a missing or inconsistent answer slows deals. Transparency is also the obligation that is visible from the outside: anyone can check whether your chatbot says what it is.

How GhostAudit helps

GhostAudit keeps the inventory that scoping depends on, and its regulation tracker flags systems that interact with customers or generate synthetic media as in scope for Article 50, showing the attribute that triggered the match.

The Article 50 transparency notice template then works through those systems and produces a document that states applicability system by system, with wording for AI-interaction, AI-generated content, deepfake and public-interest text disclosures. It goes through review and approval like any other document, so there is a record of who approved which wording. See the EU AI Act overview for the rest of the timeline.