Resources · Article 50

Article 50 in depth: the four transparency duties

Article 50 is the obligation most AI systems in production today actually carry. It is short, it is specific, and it applies from 2 August 2026. This page walks all four paragraphs, who each one binds, the exemptions, and what an auditor will ask you to show.

New to the Act? Start with the whole-Act guide — it places Article 50 among the four risk classes before you go deep on one of them.

Does Article 50 apply to you?

Three things need to hold. If all three do, Article 50 applies to that system from 2 August 2026:

1. Reach

Your system is offered in the EU, or its output is used by people in the EU. This can reach organisations with no EU presence at all — the test is where the output lands, not where you are incorporated.

2. Role

You are a provider (you develop the system or place it on the market under your own name or trade mark) or a deployer (you use it under your own authority). The duties differ by role, and one organisation is frequently both.

3. Situation

Your system falls into one of the four situations below. Article 50 attaches to a behaviour — talking to people, generating content, reading biometrics — rather than to a sector, which is why it catches so many ordinary products.

The 2-minute applicability check walks these three questions and tells you which paragraphs land on you. It is free and needs no account.

The four duties, one at a time

50(1) — “You’re talking to an AI.”

Binds the provider. AI systems intended to interact directly with people must be designed so that those people are informed they are interacting with an AI system — unless that is obvious to a reasonably well-informed person in the circumstances. In practice: chatbots, voice assistants, in-product AI agents. Exemption: systems authorised by law to detect, prevent, investigate or prosecute criminal offences, subject to safeguards for third-party rights.

50(2) — “This was AI-generated.”

Binds the provider. Providers of AI systems generating synthetic audio, image, video or text must mark the outputs in a machine-readable format and make them detectable as artificially generated or manipulated. The marking must be effective, interoperable, robust and reliable as far as technically feasible. Exemption: systems performing an assistive function for standard editing, or that do not substantially alter the input data or its semantics.

50(3) — “This system reads emotions or biometrics.”

Binds the deployer. Deployers of an emotion-recognition system or a biometric-categorisation system must inform the people exposed to it of its operation, and process personal data in accordance with the GDPR and the other applicable data-protection rules. Exemption: biometric systems permitted by law to detect, prevent or investigate criminal offences, subject to safeguards.

50(4) — “This is a deepfake, or AI-written news.”

Binds the deployer. Two separate duties in one paragraph. Deployers who generate or manipulate image, audio or video content constituting a deep fake must disclose that the content has been artificially generated or manipulated. Deployers who generate or manipulate text published to inform the public on matters of public interest must disclose it too — unless the content underwent human review or editorial control and a person or organisation holds editorial responsibility for it. Exemption: where the content forms part of an evidently artistic, creative, satirical or fictional work, disclosure is limited to doing so in a way that does not hamper the display or enjoyment of the work.

How the information must be given

Article 50(5) sets a single test across all four duties, and it is the part most implementations get wrong. The information must be provided:

Clearly and distinguishably, at the latest at the time of the first interaction or exposure, and in a form that conforms with the applicable accessibility requirements.

A disclosure buried in a terms-of-service page is not given at first interaction. A disclosure rendered only as an image is not accessible. Both are common, and both are cheap to fix once you know the test.

Article 50(6) adds that this does not affect the requirements and obligations set out in Chapter III (high-risk systems) and is without prejudice to other transparency obligations in Union or national law — Article 50 is a floor, not a ceiling. Article 50(7) charges the AI Office with encouraging codes of practice on detecting and labelling artificially generated content.

What an auditor will actually ask for

The duty is to inform. The problem is proving you informed — six months ago, on the version of the system that was live then, for every user who saw it. Three questions come up every time:

“Show me the disclosure as it was on the day.”

A screenshot proves what a page looked like when the screenshot was taken. What is wanted is a dated, tamper-evident record tied to the system version that was live.

“Show me it was machine-readable.”

For 50(2), a visible label is not the obligation — the marking must be in a machine-readable format. Which mechanism you used, and for which output modality, is the fact to record.

“Show me nothing was edited afterwards.”

This is the only question an evidence file uniquely answers. A hash-chained, signed record can be checked by the reader; a folder of PDFs cannot.

The disclosure generator produces compliant notice text for each of the four duties, and the site scanner checks a live URL for the disclosures Article 50 expects to find there. Both are free.

Penalties

Breaching Article 50 falls under Article 99(4) — the operator-obligations tier, the middle of the Act’s three ceilings, below the prohibited-practices tier of Article 99(3) and above the incorrect-information tier of Article 99(5). Article 99(6) points the ceiling downwards for SMEs and start-ups, and Article 99(7) lists ten criteria a national authority must weigh in setting an actual figure — with no weights and no published methodology.

Rather than restate the amounts here, our penalty estimator renders the statutory ceilings straight from Article 99 and keeps them visibly separate from the illustrative model — the two are not the same kind of number, and presenting them as though they were is the most misleading thing a tool like that can do.

Evidence, not screenshots

Clause50 turns these four duties into versioned, hash-chained, auditor-ready evidence for every system you run — and the same record keeps working when your obligations grow past Article 50.

Take the 2-minute check — free →Scan your site against Article 50 →