In short: since 2 August 2026, Article 50 of the AI Act requires any product that lets a user interact with an AI to tell them so, at the latest at the first interaction, unless it is obvious. Tools that generate text, images, audio or video must also mark their outputs in a machine-readable format; only systems already on the market before 2 August 2026 have until 2 December 2026 to do so. Breaches can lead to fines of up to €15 million or 3% of worldwide annual turnover, with the lower of the two amounts applying to SMEs and start-ups.
The AI Act has made headlines mostly for its "high-risk" systems, whose deadline the Digital Omnibus pushed back to December 2027. As a result, many product teams think they have time. They don't. The Article 50 transparency obligations were not postponed, and they cover very common features: an assistant in your app, a support chatbot, a generator of visuals or product descriptions in your SaaS.
This article is not legal advice: for borderline cases, have your analysis checked by a lawyer.
What does Article 50 of the AI Act say, in plain terms?
Article 50 of Regulation (EU) 2024/1689 sets out four transparency obligations, split between providers (those who develop an AI system or have it developed, and place it on the market under their own name) and deployers (those who use it in the course of their business).
| Paragraph | Who it applies to | What you must do | Applies from |
|---|---|---|---|
| 50(1) | Provider of a system that interacts with people (chatbot, voice assistant, agent) | Inform users that they are interacting with an AI, unless it is obvious | 2 August 2026 |
| 50(2) | Provider of a system that generates text, images, audio or video | Mark outputs in a machine-readable format, detectable as AI-generated | 2 August 2026, or 2 December 2026 for systems placed on the market before 2 August 2026 |
| 50(3) | Deployer of an emotion recognition or biometric categorisation system | Inform the people exposed of how the system operates | 2 August 2026 |
| 50(4) | Deployer publishing deepfakes, or generated text published to inform the public on matters of public interest | Disclose that the content was AI-generated or manipulated | 2 August 2026 |
Paragraph 5 sets the format: the information must be provided in a clear and distinguishable manner, at the latest at the time of the first interaction or exposure, and must meet the applicable accessibility requirements. A line buried in your terms and conditions is not enough.
Why is everyone talking about 2 December 2026?
The Digital Omnibus on AI, published in the Official Journal of the EU on 24 July 2026, mainly postponed the obligations for high-risk systems: to 2 December 2027 for Annex III systems (recruitment, credit, education…) and to 2 August 2028 for those embedded in regulated products.
For Article 50, it only granted a narrow transitional period: providers of systems generating synthetic content that were already on the market before 2 August 2026 have until 2 December 2026 to implement the machine-readable marking required by paragraph 2. Two important points:
- this grace period only covers the technical marking of outputs, not informing chatbot users, which already applies;
- a generation feature launched after 2 August 2026 does not benefit from it: it must comply from the day it goes live.
You use the OpenAI or Claude API: are you a provider or a deployer?
This question determines who carries the obligations in paragraphs 1 and 2, and the answer often comes as a surprise. Under the AI Act, a provider is whoever develops an AI system or has it developed and places it on the market or puts it into service under its own name or trademark. OpenAI, Anthropic and Google are providers of their models; but the chatbot built into your app, offered under your brand, is your system.
In practice, the prevailing reading is as follows:
- you offer an assistant or content generator under your brand, built on a model API: you are very likely the provider of that system, and it is up to you to inform users and ensure marking;
- you use a third-party tool internally, such as ChatGPT Enterprise, or a white-label chatbot supplied by a vendor: you are more likely a deployer, and the vendor carries most of the provider obligations;
- an agency or contractor builds the chatbot for you: "having it developed" does not exempt you, what counts is the brand under which the system is offered.
The line is still debated for very thin integrations, where the product simply displays the output of a model already offered as a usable system. But assuming that your model vendor "takes care of it" is risky. You can rely on the marking it already applies, provided it is compliant and you can demonstrate it.
In practice, what do you need to change in your chatbot?
For a conversational assistant, the obligation is easy to meet if you treat it as a product issue:
- display a clear notice as soon as the conversation opens, for example "You are chatting with an AI assistant";
- make it visible on every channel: web widget, mobile app, WhatsApp, voice; for a voice assistant, the announcement must be spoken;
- make it accessible: text readable by a screen reader, sufficient contrast, no information conveyed by an icon alone;
- don't give the AI a first name and a photo that suggest a human without saying otherwise;
- offer a route to a human where relevant, even though Article 50 does not require it.
The "obvious" exception exists, but it is assessed from the point of view of a person who is reasonably well informed, observant and circumspect. A tool labelled "AI Assistant" with an explicit badge can rely on it; a support chat where the conversation opens as if with an agent cannot. When in doubt, display the notice: it takes a few hours of development.
How do you mark the content your product generates?
Paragraph 2 is more technical. Generated outputs must be marked in a machine-readable format and be detectable as artificial, using solutions that are effective, interoperable, robust and reliable as far as technically feasible, taking into account costs and the state of the art.
| Content type | Common techniques | Difficulty |
|---|---|---|
| Images | Provenance metadata (C2PA standard), invisible watermark | Low to medium: often already provided by the model |
| Audio and voice | Inaudible audio watermark, metadata | Medium |
| Video | C2PA metadata, frame-by-frame watermark | Medium to high |
| Text | Metadata in exported files, server-side signature, statistical watermark where the model offers it | High: marking is fragile once text is copied and pasted |
Three things for your engineering team to watch:
- don't break upstream marking: resizing, compressing or re-encoding a generated image can strip its C2PA metadata; check your processing pipeline and your CDN;
- document your choices: which technique, for which content type, and why anything left unmarked cannot reasonably be marked;
- identify the exceptions: a tool that performs an assistive function for standard editing, such as spell-checking or light rephrasing, or that does not substantially alter the data provided by the user, is not subject to marking.
The Commission has published guidelines on Article 50 and a code of practice on marking and labelling AI-generated content. They are not legally binding, but they are the benchmarks authorities will use to assess your compliance: ask your team or your contractor to align with them.
Content published on your website: do you need to label everything?
Paragraph 4 applies to deployers, so to your marketing team too. Two cases:
- deepfakes (images, audio or video resembling real people, places or events that could pass as authentic) must be disclosed as generated; for an evidently artistic, satirical or fictional work, a discreet notice that does not spoil the work is enough;
- generated text published to inform the public on matters of public interest must be disclosed, unless it has undergone human review or editorial control and a natural or legal person holds editorial responsibility for the publication.
A blog post written with AI assistance, reviewed and owned by your company, therefore does not in principle need a notice. A news feed published automatically without review does.
What are the risks and what does compliance cost?
Article 99 of the AI Act provides for fines of up to €15 million or 3% of worldwide annual turnover for breaches of Article 50, whichever is higher. For SMEs and start-ups it is the other way round: the cap is the lower of the two amounts. Beyond fines, the most tangible short-term risk is often commercial: a large customer or an acquirer asking about your AI Act compliance will expect a documented answer.
Compliance costs remain modest if the issue is handled early. As an order of magnitude, for a team that knows its codebase:
| Workstream | Indicative effort |
|---|---|
| Mapping AI features and qualifying provider or deployer status | 1 to 3 days |
| Transparency notice on a multichannel chatbot | A few hours to 2 days |
| Marking generated images, if the model already provides it | 1 to 3 days checking the pipeline |
| Marking audio, video or text exports | 1 to 3 weeks depending on formats |
| Compliance documentation and contract updates | 2 to 5 days, with a lawyer |
These ranges assume a recent, well-structured product; on an older codebase where model calls are scattered, the effort grows quickly.
Where should you start before 2 December?
Here is the order we recommend:
- List every feature that calls an AI model, whether or not it is visible to users.
- For each one, determine whether you are the provider or the deployer, and which paragraph applies.
- Fix chatbots and assistants first: the obligation already applies and the fix is quick.
- Check when your generation features were placed on the market, and prioritise those launched after 2 August 2026, which have no grace period.
- Test end to end that marking survives your pipeline (resizing, compression, export).
- Document your choices and add the check to your definition of done for every new AI feature.
If you are launching a new feature, build these requirements in from the design stage: it is far cheaper than retrofitting them. We handle them systematically when integrating AI into a product or building a chatbot or AI assistant. To choose the features worth investing in, also read our article on the AI use cases that really create value in a SaaS.
Frequently asked questions
Does my chatbot have to say that it is an AI?
Yes. Since 2 August 2026, a system designed to interact directly with people must inform them that they are dealing with an AI, clearly and at the latest at the first interaction. The only exception is where this is obvious to a person who is reasonably well informed, observant and circumspect, for example a tool explicitly presented as an AI assistant. The Digital Omnibus postponement does not apply to this obligation.
Does the 2 December 2026 deadline apply to every product?
No. It only covers the machine-readable marking of generated content under paragraph 2 of Article 50, and only for systems placed on the market before 2 August 2026. A generation feature launched after that date must mark its outputs from the day it goes live, and the obligation to inform chatbot users has applied since 2 August 2026 with no extra time.
If I use the OpenAI or Claude API, isn't compliance their job?
Not entirely. Model vendors have their own obligations, but if you offer a chatbot or content generator under your brand, you are very likely regarded as the provider of that system. It is then up to you to inform users and ensure marking, although you can rely on the marking already applied by the model provided it is compliant and you can demonstrate it.
Do I need to label blog posts written with AI assistance?
In principle no, as long as the text has been reviewed or subject to human editorial control and your company holds editorial responsibility for it. The disclosure obligation targets generated text published to inform the public on matters of public interest without that control. Realistic images or videos that could pass as authentic, however, must be disclosed as generated.
What fine does a start-up risk if it ignores Article 50?
Breaches of Article 50 can be fined up to €15 million or 3% of worldwide annual turnover. For SMEs and start-ups, the lower of the two amounts is the cap: a start-up with €2 million in turnover is therefore capped at €60,000. The actual amount depends on the seriousness and duration of the breach and on cooperation with the authority.
👉 Want to review the compliance of your AI features? Discover our AI product integration service and our technical audit, or contact us to talk it through.