The EU AI Act's Transparency Rules Are Live: What Article 50 Means

August 2, 2026 came and went, and with it the EU AI Act's transparency chapter stopped being a future deadline and became enforceable law. If your product generates text, images, audio or video — or your company publishes synthetic media into the EU — Article 50 now describes obligations you're expected to be meeting today.

EU AI Act Article 50 is now in effect, and it requires four things: chatbots must reveal they're AI, providers must mark synthetic content in a machine-readable way, emotion-recognition deployments must be disclosed to the people exposed, and deepfakes plus AI-written public-interest text must be visibly labeled. Violations carry fines up to €15 million or 3% of worldwide turnover.

What EU AI Act Article 50 requires, at a glance

The article splits duties between providers (who build or supply the AI system) and deployers (who use it). Four obligations, per the official text:

Obligation	Who carries it	In practice
Tell people they're talking to AI	Providers	Chatbots and voice agents must self-identify, unless it's obvious to a reasonably informed person
Mark synthetic content	Providers	Audio, image, video and text outputs marked machine-readably as AI-generated
Disclose emotion recognition and biometric categorization	Deployers	People exposed to these systems must be informed
Label deepfakes and AI public-interest text	Deployers	Visible disclosure that content was generated or manipulated

The transparency rules sit in a sweet spot of the Act that makes them unusually broad: they apply regardless of risk classification, so a perfectly mundane marketing chatbot is covered just as much as a high-risk system.

The machine-readable marking rule

Article 50(2) is the piece with the longest technical tail. Providers of generative systems — including general-purpose models — must ensure outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated," with solutions that are effective, interoperable, robust and reliable "as far as this is technically feasible."

Two carve-outs matter for everyday tools. Systems performing an assistive editing function (think grammar correction) are exempt, as are systems that don't substantially alter the input's meaning. So spellchecking a human paragraph doesn't trigger marking; generating the paragraph does.

Practical mechanisms are converging on invisible watermarks and provenance metadata such as C2PA Content Credentials, which OpenAI, Adobe, Microsoft and Google already embed in various image pipelines. Timing note from the practical guides tracking implementation: generative systems already on the market before August 2, 2026 have a transition until December 2, 2026 to get marking in place — so expect a messy, partially marked internet well into 2027.

Deepfakes and AI-written text: the deployer duties

Article 50(4) reaches past tech companies to anyone using generative AI publicly.

Deepfakes. If you deploy AI-generated or manipulated image, audio or video that resembles real people, places, objects or events, you must disclose that it's artificial. For evidently artistic, creative or satirical work, the duty softens to disclosure "in an appropriate manner that does not hamper the display or enjoyment of the work" — a label in the credits rather than a stamp across the frame.

Public-interest text. AI-generated text published to inform the public on matters of public interest must be disclosed — unless it underwent human review or editorial control and someone, human or corporate, holds editorial responsibility. That exception is the newsroom escape hatch, and it's the reason every publisher should have a documented review workflow; our AI content policy template for publishers walks through building one.

Who's affected (a longer list than most expect)

Analysts have called Article 50 the provision that touches more organizations than almost any other in the Act, and the reach is straightforwardly extraterritorial: the AI Act follows the EU market, so a company anywhere in the world that places a generative system on that market, or whose outputs are used in the EU, is in scope. Concretely, the compliance question now lands on:

• Model and tool providers — marking outputs, disclosing chatbot identity.
• Companies embedding generative AI in products — you may qualify as a provider even if the model underneath is licensed.
• Publishers and broadcasters — deepfake labels, text disclosure or documented editorial review.
• Brands and agencies — synthetic ad imagery that resembles real people or events needs disclosure.
• Any enterprise running customer-facing chatbots in the EU — self-identification, at first contact.

Fines, enforcement and the guidance still arriving

Non-compliance with Article 50 draws administrative fines up to €15 million or 3% of total worldwide annual turnover, whichever is higher — with the notable mercy that for SMEs the lower of the two applies. That's the middle tier of the Act's penalty ladder, below the €35 million/7% reserved for prohibited practices.

Enforcement detail is still filling in. Through spring 2026 the European Commission consulted on draft guidelines interpreting the transparency obligations, and a Code of Practice on marking and labeling AI-generated content went through successive drafts, with legal analyses of the Commission's June 2026 materials stressing one theme: disclosure has to happen at first exposure, clearly, not buried in terms of service. Expect the first enforcement actions to target obvious cases — undisclosed deepfakes and chatbots posing as humans — while the technical marking standards mature.

The verification gap Article 50 doesn't close

Here's the operational catch: a marking obligation creates a checking obligation for everyone downstream. And marks are fragile. C2PA metadata is routinely stripped when files pass through social platforms; Google's SynthID watermark can't be verified by third parties at all, only through Google's own tools. A clean file with no provenance data is the normal case, not the suspicious one.

That's why detection and provenance inspection travel together. AI Detector 360 reads C2PA credentials, EXIF traces and generation parameters where they survive, then falls back to statistical analysis of the pixels or text when they don't — across text, images and video, with frame-by-frame timelines for the latter on the AI image detector and its video counterpart. The scores are probabilistic and we label their confidence honestly (here's how detection actually works), but paired with Article 50's marks, they're how a compliance team tells "unmarked because human" from "unmarked because stripped." You can test the provenance readout on any file via the free scanner in about a minute.

A 30-day compliance sprint

For a company starting late, a month of focused work covers the exposed surface:

• Week 1 — inventory. List every system that generates or displays synthetic content, every chatbot with EU-reachable users, and every team publishing AI-assisted media. Tag each as provider-side or deployer-side; obligations differ.
• Week 2 — close the loud gaps. Add self-identification to chatbots and visible labels to any deepfake-adjacent creative already live. These are the violations a regulator, or a journalist, finds in an afternoon.
• Week 3 — marking and workflow. Confirm your generation vendors emit machine-readable marks (ask for it in writing), preserve metadata through your asset pipeline instead of stripping it on upload, and document the editorial-review chain for published text.
• Week 4 — verify and file. Spot-check outputs with AI Detector 360 or comparable tooling, keep the PDF reports, and stand up a quarterly re-check. Under a transparency regime, the evidence that you checked is nearly as valuable as the check itself.

Legal counsel still owns the formal analysis — this article is orientation, not advice — but teams that finish this sprint tend to walk into that conversation with answers instead of questions.

Article 50 won't end synthetic-media confusion. It does something more modest and more useful: it makes honesty the legal default and puts a price on pretending. Companies that built disclosure and verification into their workflows early are finding the "now in effect" era mostly uneventful — which is the point.