EU AI Act Article 50: What It Actually Requires
Article 50 has been in force since 2 August 2026. Most of what is written about it is either too vague to act on or wrong about who it applies to. This is the whole thing, route by route, with the deadlines and the exception that most publishers will end up relying on.
Article 50 does not create one general duty to label everything made with AI. It creates four separate routes, each with its own addressee, trigger and exceptions. Work out which route you are on before you change anything.
If you publish AI-assisted text, the obligation only bites when that text informs the public on a matter of public interest. Marketing copy usually sits outside it entirely. Where it does bite, there is an exception for substantively reviewed text with named editorial responsibility, and the Commission has been explicit that a spellcheck does not count.
Penalties reach €15 million or 3% of worldwide annual turnover, whichever is higher.
The four routes
The single most common mistake is treating Article 50 as a blanket labelling rule. It is not. It is four obligations pointed at different people in different situations.
| Provision | Who it lands on | What triggers it |
|---|---|---|
| 50(1) | Providers | An AI system interacts directly with people. It must be designed so those people know they are dealing with an AI. |
| 50(2) | Providers | A system generates synthetic audio, image, video or text. Outputs must be marked in a machine-readable format and detectable as artificially generated. |
| 50(3) | Deployers | Use of emotion recognition or biometric categorisation. The people exposed to it must be informed. |
| 50(4) | Deployers | Publishing a deepfake, or publishing AI-generated text to inform the public on a matter of public interest. |
Article 50(5) sits across all of them and governs timing and clarity: the disclosure has to reach the person at the point of first interaction or first exposure, and it has to be clear and distinguishable.
Provider or deployer? Answer this first
Almost every obligation in Article 50 turns on which of the two you are, and most companies guess wrong because the words sound interchangeable.
A provider builds the AI system and puts it on the market under its own name. A deployer uses an AI system in the course of its own business. If you prompt ChatGPT, Claude or Midjourney and publish the result, you are a deployer. The provider obligations belong to the company that built the model.
This matters because 50(1) and 50(2) are provider duties and 50(3) and 50(4) are deployer duties. A marketing team worrying about machine-readable watermarking is usually worrying about someone else’s obligation. What lands on them is 50(4).
One caveat worth knowing: if you substantially modify a system or put your own name on it, you can become a provider of that system. Rebadging a chatbot as your own product is the usual way this happens.
We wrote a longer breakdown of the distinction in provider vs deployer: which one are you?
Article 50(4), the one most publishers hit
Article 50(4) contains two separate obligations that get muddled together constantly.
Deepfakes
Deployers who publish AI-generated or manipulated image, audio or video content that constitutes a deepfake must disclose that it is artificial. This applies regardless of intent. Content made for entertainment, satire or advertising is still caught if it meets the definition, though the Act allows a lighter touch where the work is artistic or satirical, so long as the disclosure is still recognisable.
Not every edited image is a deepfake. The Commission’s guidelines indicate that minor alterations such as cropping or lighting adjustments fall outside the definition. The threshold is whether the content would falsely appear authentic.
Text on matters of public interest
This is narrower than almost everyone assumes, and getting the scope right saves a lot of pointless work.
The obligation applies to AI-generated or AI-manipulated text published for the purpose of informing the public on matters of public interest. Both halves have to be true.
On published: the guidelines treat text as published when it reaches an indefinite and relatively large readership. Private messages and internal documents are not caught.
On matters of public interest: the Commission reads this broadly but not infinitely. It covers public administration, fundamental rights, health, the environment, consumer protection, and economic, political, scientific or cultural developments with societal significance.
Ordinary marketing copy is not usually in scope at all. If the obligation does not attach, you do not need the exception.
A product launch email, a landing page, an ad campaign: these generally sit outside 50(4) entirely. An explainer on a new health regulation, a piece of political analysis, a consumer safety guide: those are the ones to look at. If you publish a mix, the sensible move is to sort your output into in-scope and out-of-scope buckets once, rather than applying a blanket policy to everything.
The exception, and why it is harder than it sounds
Where 50(4) does apply to your text, there is a way out of the labelling requirement. It has two conditions, and both must be satisfied.
One: the text has undergone human review or editorial control.
Two: a natural or legal person holds editorial responsibility for the publication.
The Commission’s guidelines define each of these tightly.
Human review means deliberate examination of the substance of the content by a person with relevant competence and professional judgement in that subject area. Not any human. A competent one, engaging with what the text actually says.
Editorial control means control exercised in practice by a responsible editorial entity with the authority to approve, alter or reject the substance of the text on substantive grounds, including fact-checking and assessing whether sources are trustworthy.
Editorial responsibility means someone holds ultimate legal responsibility for the publication, including for the review itself.
What does not qualify
The guidelines rule out three things by name: superficial, purely formal or procedural checks such as spell-checking and grammar correction; the mere existence of an editorial policy; and cursory editorial approval without substantive engagement.
The practical consequence is that “we have a review process” is not a defence. What is being asked for is evidence that a specific competent person substantively reviewed a specific piece of content, and that a named person carries responsibility for publishing it.
There is a further point worth internalising. If substantive AI intervention happens after the human review, the exception can be lost. The review has to sit at the end of the process, not somewhere in the middle of it.
The deadlines
Article 50 applied from 2 August 2026, but not every part of it landed on that date. The Digital Omnibus introduced transitional periods for some provider obligations.
| Date | What applies |
|---|---|
| 2 August 2026 | Article 50 transparency obligations apply. Deployer duties under 50(3) and 50(4) apply from this date with no deferral. |
| 2 December 2026 | Deadline for 50(2) marking and detection for generative systems already placed on the market before 2 August 2026. |
| 2 February 2027 | Deadline for 50(2) watermark-detection interoperability. |
If you are a deployer, none of these deferrals help you. Your obligations started on 2 August 2026. The full timeline for the rest of the Act is on our EU AI Act timeline.
What the Code of Practice is, and what it is not
The AI Office published the Code of Practice on Transparency of AI-Generated Content on 10 June 2026. The Commission and the AI Board concluded in July 2026 that it is adequate to support practical implementation of Articles 50(2), (4) and (5). The Commission’s finalised Guidelines followed on 20 July 2026.
Two things follow from that, and they pull in opposite directions.
The Code is voluntary. Signing it is not required, and adherence is not conclusive evidence of compliance. Article 50 itself is not voluntary. A common failure mode is reading coverage of the Code, concluding the whole area is optional, and doing nothing.
The other consequence is more useful: because the Code and Guidelines describe what market surveillance authorities will treat as adequate, they are the closest thing available to a published answer key. Aligning with them is the cheapest way to make your position defensible.
The penalties
Breaches of Article 50 can attract fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher. Enforcement sits with national market surveillance authorities, not the Commission, so the body that comes asking will be the one in your member state.
Article 50 also reaches beyond the EU. What matters is where the output is used, not where the company sits. We covered the test in does the EU AI Act apply to non-EU companies?
A practical sequence
- Establish your role for each AI system you touch. Provider or deployer, system by system.
- Inventory what you publish. Separate synthetic audio, image and video from text, and separate public-interest text from everything else.
- Label what needs labelling. Deepfakes and synthetic media, disclosed at first exposure, clear and distinguishable. Our free image labeller applies the EU icons in your browser.
- Check your chatbots. If people can talk to it, they need to know it is an AI.
- Decide on the exception for in-scope text. Either disclose, or build a review process that meets both conditions.
- Name the responsible person. Editorial responsibility has to belong to someone specific, not to a department.
- Keep the evidence. Not a policy document. A record, per piece of content, of who reviewed it and when.
The obligations checker runs through the first two steps in about a minute.
The part people underestimate
Steps one through six are policy decisions. You can make them in an afternoon. Step seven is the one that fails in practice, because the thing being asked for is not a description of a process but proof that the process ran on a particular day for a particular article.
A spreadsheet can be edited afterwards. A Google Doc’s history can be cleared. An email thread proves a conversation happened, not that a substantive review occurred before publication. None of these is worthless, but none of them is difficult to challenge either.
If you intend to rely on the human review exception, the question worth asking now, rather than during an investigation, is: what exactly would you hand over?
Where Art50 fits
Art50 records that a named person substantively reviewed a specific piece of AI-assisted content, seals that record so it cannot be quietly changed afterwards, and makes it checkable by anyone you give it to, including someone who does not trust you.
It does not determine or guarantee legal compliance, and it is not legal advice. It produces the evidence that the exception depends on. See how it works.
Common questions
Does Article 50 mean I cannot use AI to write?
No. Article 50 governs transparency, not permission. It does not restrict what AI can be used for. It requires that people are told when AI is involved, in the specific situations it covers.
Does every AI-generated blog post need a label?
No. The text obligation under Article 50(4) only applies to text published to inform the public on matters of public interest. Most commercial and marketing writing falls outside it. Where it does apply, the human review exception may remove the need for a label.
Is proofreading enough to count as human review?
No. The Commission states directly that spell-checking, grammar correction, the existence of an editorial policy, and cursory approval without substantive engagement all fail to meet the standard.
Do I have to sign the Code of Practice?
No. The Code is voluntary. Article 50 is not. You can comply without signing, but you will need to be able to show your approach is adequate.
I am outside the EU. Does this reach me?
It can. The test is where the output is used, not where you are established. If your content reaches people in the EU, you are likely in scope.
What are the penalties?
Up to €15 million or 3% of worldwide annual turnover, whichever is higher, enforced by national market surveillance authorities.
Sources
- Regulation (EU) 2024/1689, Article 50 (EUR-Lex)
- Transparency obligations under Article 50 (European Commission)
- Code of Practice on Transparency of AI-Generated Content (European Commission)
Free for every account until 2 December 2026. Always free for journalists, non-profits and public bodies.
