EU AI Act Article 50: Exactly What Applies From 2 August 2026, and to Whom

On 2 August 2026 the first EU AI Act obligations that most ordinary businesses will actually feel become enforceable: the Article 50 transparency duties. The heavy high-risk conformity machinery comes later. What lands now is four specific duties about telling people when they are dealing with AI and its outputs.

Most of the coverage blurs who carries which duty. The distinction matters, because two of the four fall on providers (whoever develops the system or has it developed and puts it on the market under their name) and two fall on deployers (whoever uses the system in a professional context). A business running a chatbot built on a vendor's platform is typically the deployer of that system, and if it customises or white-labels it, it can find itself holding provider duties too. Start by working out which seat you occupy for each AI surface you run.

Here is each duty, precisely, with the exemptions that matter.

Duty 1: AI that talks to people must say so (Article 50(1), a provider duty)

AI systems intended to interact directly with natural persons must be designed so the person is informed they are interacting with AI, unless that is already obvious to a reasonably well-informed, observant and circumspect person in the circumstances.

In practice: your customer-service chatbot, voice assistant, or AI intake agent discloses at the start of the interaction. The "it is obvious" exemption exists, and relying on it is a judgment call you would need to defend to a regulator; a one-line disclosure costs nothing and settles it. There is a narrow law-enforcement carve-out that will not apply to commercial deployments.

Duty 2: Generative outputs must be marked machine-readably (Article 50(2), a provider duty)

Providers of AI systems that generate synthetic audio, image, video, or text must ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. The marking must be effective, interoperable, robust, and reliable so far as technically feasible. Assistive functions (grammar correction, minor editing help) are exempt.

The one genuine grace period lives here. Under the May 2026 Omnibus agreement, generative systems already placed on the market before 2 August 2026 get until 2 December 2026 to bring their output marking into compliance. Systems placed on the market from 2 August onward must mark from day one. Note how narrow this is: it covers the machine-readable marking mechanism only. None of the other Article 50 duties are deferred.

Duty 3: Emotion recognition must be disclosed to the people exposed (Article 50(3), a deployer duty)

Deployers of emotion-recognition or biometric-categorisation systems must inform the natural persons exposed to them, and handle the underlying personal data in line with GDPR. If you run sentiment analysis on live customer calls or categorise people biometrically, the people on the other end have to be told the system is operating.

This duty sits alongside data protection law rather than replacing it: the same processing usually needs a lawful basis and, in most configurations, a DPIA under GDPR before Article 50 even enters the picture.

Duty 4: Deepfakes and AI-written public-interest text must be labelled (Article 50(4), deployer duties)

Two limbs. First, deployers of systems that generate or manipulate image, audio, or video amounting to a deepfake must disclose that the content is artificial. Evidently artistic, creative, satirical, or fictional work carries a lighter disclosure that does not spoil the work.

Second, deployers who publish AI-generated or AI-manipulated text with the purpose of informing the public on matters of public interest must disclose it. The practical exception most write-ups miss: no disclosure is required where the text has undergone human review or editorial control and a natural or legal person holds editorial responsibility for publication. A human-reviewed, human-signed-off article is outside the duty. Auto-published AI news content with nobody holding editorial responsibility is inside it.

How and when the disclosures must be made (Article 50(5))

Clearly, distinguishably, and at the latest at the moment of first interaction or exposure. Disclosures must also meet accessibility requirements. A buried terms-page paragraph does not satisfy a duty that attaches to the first interaction.

What does NOT happen on 2 August

The conflation to avoid: the high-risk (Annex III) obligations do not land on 2 August 2026. After the May 2026 Omnibus, they are provisionally set to apply from 2 December 2027, pending the Omnibus's formal adoption in the Official Journal. If your AI screens CVs or scores credit, that heavier regime is coming on the later date; what you owe on 2 August is the transparency set above. The GPAI model rules (August 2025) and the prohibited-practices ban (February 2025) are already in force.

Penalties

Up to €15 million or 3% of total worldwide annual turnover, whichever is higher. Early enforcement attention tends to fall on organisations that can show nothing at all, so a written record of your Article 50 analysis is itself a control.

The July checklist

Four weeks is enough if you start now:

• Inventory every public-facing AI surface: chatbots, voice agents, AI-generated content pipelines, synthetic media, any emotion or sentiment analysis running on people.
• For each, decide your seat: provider, deployer, or both.
• Chatbots and assistants: add the disclosure at first interaction. Do not lean on "it is obvious" without writing down why.
• Generative outputs: confirm your provider's marking position; if you are the provider, check the machine-readable marking, and note whether the 2 December 2026 grace applies to your system.
• Emotion recognition / biometric categorisation: build the notice to exposed persons, and check the GDPR side (lawful basis, DPIA).
• Published AI text and media: label deepfakes; for public-interest text, either label it or ensure genuine human editorial responsibility is in place and documented.
• Write the analysis down. The documented reasoning is what you show a regulator, a client, or a procurement reviewer.

Want it checked against your actual surfaces? The £200 Article 50 Readiness Teardown is a fixed-fee review of your public-facing AI against these duties: a written gap note within 72 hours covering what complies, what is exposed, and what to change, with the Article 50 basis for each point. If you go deeper, the £200 is credited against the £500 scoping review.

The bottom line

Article 50 is narrower than the headlines and stricter than most teams' current setup. Providers owe disclosure-by-design and machine-readable marking; deployers owe notices on emotion recognition, deepfakes, and unedited public-interest text. One genuine grace period exists, for the marking duty on pre-existing systems, and nothing else moves. Work out which seat you sit in for each AI surface, make the disclosures land at first interaction, and put the reasoning in writing before 2 August.

---

Michael K. Onyekwere is a CIPP/E certified data protection practitioner and the founder of Janus Compliance. He assesses AI systems against the EU AI Act as part of vendor privacy due diligence in a multi-jurisdiction second-line privacy function.

Current as at 6 July 2026. This is educational, not legal advice. Verify the current status of the Omnibus and any implementing guidance before relying on the dates. See also: EU AI Act compliance for SMEs, the conformity assessment guide, automated decisions under UK Articles 22A to 22D, which LLM API is GDPR compliant.