Since 2 August 2026, Article 50 of the EU AI Act applies. It's the transparency article, and unlike the high-risk rules, which were postponed again in July, it wasn't delayed. If you have a chatbot on your site, an assistant inside your product, or a pipeline that generates images, audio or text that ends up in front of people, it most likely applies to you. Fines go up to €15 million or 3% of worldwide turnover, and for SMEs and startups it's whichever of the two is lower.
Most of what's been written about Article 50 is written by law firms for large companies, or by vendors selling compliance tools. This article is for a team of five to fifty people that built something on top of the Claude or GPT API and wants to know what to change in the product. We're engineers, not lawyers. What follows is our reading of the regulation, the Commission's FAQ and its final guidelines, with the uncertain parts marked as uncertain. For a binding answer on your specific case, talk to a lawyer.
Where we are on the timeline
The AI Act entered into force in August 2024, but its obligations apply in stages. In July 2026 the Digital Omnibus on AI, Regulation (EU) 2026/1744, changed several dates. It entered into force on 27 July 2026, six days before the original high-risk deadline.
The detail that matters for most small teams is the narrowness of the one extension Article 50 got. Systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with Article 50(2), the machine-readable marking of generated content. That's it. The chatbot disclosure and the deepfake and text labelling duties had no grace period. If you launched something after 2 August, there's no extension at all.
What Article 50 actually asks for
The article has four substantive paragraphs. Two are on the provider of the AI system, two on the deployer:
- Chatbots and assistants (50(1), provider). A system that interacts directly with people must be designed so they're told they're dealing with an AI. The exception is when it's obvious to a reasonably well-informed, observant person, and the Commission's guidelines say that exception is to be read restrictively.
- Marking generated content (50(2), provider). Systems that generate synthetic audio, images, video or text must mark the output in a machine-readable format, detectable as artificially generated. The guidelines exclude assistive editing that doesn't substantially change the input, and also short strings of text, source code and machine-to-machine outputs.
- Emotion recognition and biometric categorisation (50(3), deployer). People exposed to these systems must be told. Few small product teams have these, so we won't dwell on it.
- Deepfakes and public-interest text (50(4), deployer). Generated or manipulated images, audio or video that look real must be disclosed as such. AI-generated text published to inform the public on matters of public interest must be labelled, unless it went through human review or editorial control and someone holds editorial responsibility for it.
Paragraph 5 sets the form: the information has to be clear and distinguishable, given at the latest at the first interaction or exposure, and meet accessibility requirements.
Provider or deployer: which one are you?
This is the question that decides what you have to do, and it's the one where the official texts help least. A provider is whoever develops an AI system, or has it developed, and puts it on the market or into service under their own name. A deployer is whoever uses an AI system under their authority in a professional capacity.
The Commission's FAQ doesn't directly address the most common case among our clients: a company that builds a chatbot on Anthropic's or OpenAI's API and puts it on its site under its own brand. Applying the definitions, we read that company as the provider of the AI system (the chatbot), while Anthropic or OpenAI is the provider of the general-purpose model underneath. The model provider's own obligations don't move the chatbot disclosure off your plate.
Two notes on the table. A company that embeds a vendor's chat widget is, in our reading, a deployer, with the disclosure built by the vendor. But you're the one whose customers see it, so check it's switched on and visible in your configuration. And fine-tuning is the case people miss: commentary on the Act points out that a company that fine-tunes a model and makes it available can end up with general-purpose AI model provider duties without realising it. If that's you, Article 50 is the small part of the problem.
The chatbot checklist
For the most common case, a chatbot or assistant you built and branded, this is what we change in the product:
- Say it at the start, in the interface. A line in the chat window before or with the first message: "You're chatting with an AI assistant." Not in the terms of service, not in a tooltip, not after the third message. The guidelines say the information has to be there from the start of the first interaction.
- Make it accessible. The notice has to reach people using screen readers: real text, not an image, announced when the chat opens, with sufficient contrast. The accessibility requirement is in the article itself, not an extra.
- Don't let the bot claim to be human. Put it in the system prompt: if asked whether it's a person, the assistant says it's an AI. A bot that answers "yes, I'm Maria from support" is the exact deception the article exists to prevent.
- Cover every channel. If the same assistant answers emails, WhatsApp messages or phone calls, each channel needs its own disclosure at first contact. A voice bot says it in the first sentence.
- Label the handoff. When a conversation moves from the AI to a human, or back, say so. Users calibrate how much to trust an answer on who gave it.
- Keep evidence. Log the version of the notice that was shown and when. If a market surveillance authority asks, "we're pretty sure it was there" isn't an answer.
None of this takes more than a few days of work. The risk isn't the effort, it's assuming the model provider handles it. It doesn't: the model provider doesn't know where or how you show the model's output.
Generated images, audio and text: marking
If your product generates images, audio or video for users, Article 50(2) asks for machine-readable marks on every output. The final Code of Practice, published on 10 June 2026 and confirmed by the Commission and the AI Board as an adequate route to compliance, has signatories mark outputs in at least two layers, such as signed metadata plus an imperceptible watermark. In practice, if you use an image or voice model through an API, check what marks the vendor already adds, and then check that your own pipeline doesn't strip them. Image optimisation steps that remove metadata (resizing, recompression, "strip EXIF" options in sharp or ImageMagick) can silently remove the provenance information the vendor added. That one is worth a test in CI.
For text the picture is less clear. The guidelines exclude short strings of text, source code and machine-to-machine output, and the Code allows a single marking layer for certain free-form text. Whether ordinary chatbot replies in a live conversation need machine-readable marking, on top of the disclosure, is not directly answered in the FAQ. Long documents generated for users to take away (reports, emails sent in their name, articles) are closer to what 50(2) describes. If your product's main output is generated text that leaves the conversation, that's the case to put in front of a lawyer.
And on the deployer side, 50(4): if you publish AI-generated text on matters of public interest without a person reviewing it and taking editorial responsibility, it has to be labelled. A company blog where a person edits and signs off each article is the exempt case. An automated news feed is not.
What we'd do this month
- Make a list of every place in your product where a person talks to, or receives content from, an AI. Include internal tools only if outside people see their output.
- For each one, write down whether you're the provider or the deployer, using the table above as a starting point.
- Ship the chatbot disclosure, with accessibility and logging, on every channel. It's the cheapest item and had no grace period.
- If you generate images, audio or video, find out what marks your vendor adds and test that they survive your pipeline. If your system was on the market before 2 August, you have until 2 December 2026.
- If you've fine-tuned and distribute a model, or generate long-form text that leaves the conversation, get a legal opinion now rather than in December.
If you want help with the technical side of that list, inventorying where AI touches your users and implementing the disclosure and marking, it's work we do for clients. For the broader view of what an AI integration should look like, see how we build AI integrations.