Is it a bot? EU AI Act transparency rules take effect 2 August 2026

Article 50 of the AI Act imposes distinct obligations on providers and deployers.

·       A provider is an entity that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trade mark. 

·       A deployer is an entity that uses an AI system under its own authority in a professional capacity.  The Commission's Guidelines clarify that "authority" means assuming responsibility over the decision to deploy the system and over the manner of its actual use, including its outputs; technical control over the AI system is not required.  Conversely, where a creative agency alone decides whether and how to use AI, the labelling obligation sits with the agency, not the commissioning client.

Both roles carry obligations regardless of where the business is established. Providers outside the EU are caught where outputs are intended for use in the EU - "intended" means foreseeable use, not incidental or unauthorised downstream use. For deployers, Article 50 applies where the deployer foresees that outputs will be disseminated or used in the EU e.g. by posting deepfake content on the globally accessible internet.

Article 50 establishes four distinct obligations, split between providers and deployers.  A horizontal requirement runs across all four: information must be provided to the people concerned in a clear and distinguishable manner, at the latest at the time of first interaction or exposure and must conform to applicable accessibility requirements. Information will not meet this standard if it can easily be overlooked, for example, if it is buried in terms and conditions or hidden under layers of menu options.

Disclose to people that they are interacting with a machine (Article 50(1) - providers)

Providers of AI systems that interact directly with people must ensure those people know they are dealing with AI, not a human and, where an agent acts on another's behalf, the identity of that person or entity. This covers chatbots, AI voice assistants, AI companions, bots on social networks, and agentic AI systems that autonomously contact individuals (e.g., an AI agent making phone calls or sending emails on behalf of a business).

The only exception is where the AI aspect of the interaction is "obvious", but the European Commission Guidelines interpret this very narrowly. The test is whether it would be obvious to a "reasonably well-informed, observant and circumspect" person, taking into account the target audience.

Article 50(1) only applies where there is a direct, two way exchange between the AI system and a human. Backend decision-support systems (where a user simply receives an AI-generated output without interacting with the system itself) fall outside the scope of this obligation.

Providers must ensure disclosure occurs at the time of first interaction - meaning each new individual who encounters the system, not merely the first time the system is used generally.  Where the deployment involves children, elderly users, or individuals in sensitive domains - health, legal, financial advice, insurance, and complaints handling - periodic contextual reminders are likely to be required in addition to the initial notice.

Mark AI-generated content so it can be detected (Article 50(2) - providers)

Providers of AI systems that generate synthetic audio, images, video or text must: (i) mark their outputs in a machine-readable format; and (ii) provide a corresponding means of detection – so that people can identify these as artificially generated or manipulated.  Marking alone, without a detection solution, is not sufficient. The marking must be embedded using metadata, watermarks, or other interoperable techniques - not visible to end users, but effective and robust enough to survive routine modifications.

Providers of general-purpose AI models are encouraged to implement marking at model level to facilitate downstream compliance, but this does not transfer the provider's own responsibility to verify and demonstrate compliance.

The Code of Practice (section 3 below) reflects the current state of the art: for most content, providers should apply at least two marking layers - digitally signed metadata (where the content format supports it) and an imperceptible watermark embedded within the content itself.  For free-form text, where metadata cannot be carried and watermarking is inherently less reliable, a single layer of watermarking is treated as sufficient (and there are carve-outs for short text). 

Standard editing (grammar correction, spellchecking, translation, minor cropping, or noise reduction) is exempt. But AI-generated summaries, face alterations, adding or removing objects from images, or converting black-and-white to colour, all require marking.

Real-time content that is ephemeral and consumed immediately without being recorded, stored, or disseminated further - such as in video games or virtual reality - is also exempt where marking is not technically feasible and users are made aware of the AI origin through in-experience or session-level disclosure.

Code signatories must implement an interoperability solution for watermark detection by 2 February 2027, so that content can be verified without running it against every provider's detection solution separately.

There is no obligation to retrospectively mark content produced before 2 August 2026; for systems already on the market before that date, the AI Omnibus extends the deadline to 2 December 2026.

Disclose emotion recognition and biometric categorisation (Article 50(3) - deployers)

Deployers must inform people who are exposed to emotion recognition or biometric categorisation systems that such a system is in operation. This applies to both real-time and ex post systems.

For example, a video game that records a player's facial expressions to capture their emotions must display a prominent pop-up notice before play begins. A retail store using facial recognition to categorise visitors by age group must provide a visible notice at each entrance.

Label deepfakes and AI-generated public interest text (Article 50(4) - deployers)

This obligation has two limbs, both directed at deployers.

Deepfakes: Deployers must disclose that image, audio or video content constituting a "deepfake" has been artificially generated or manipulated - regardless of whether it is published.

For artistic, creative, satirical or fictional works, deployers must still label the content but may do so in a way that does not hamper its display or enjoyment - for example in credits or accompanying notes rather than overlaid on the content. The Guidelines construe this narrowly: where content combines informative and creative elements, the informative character prevails, and the scope for reduced labelling in advertising is minimal.

AI-generated text published on matters of public interest: such text must be labelled unless it has undergone human editorial review, and a natural or legal person holds "editorial responsibility".   If there is substantive AI intervention after editorial sign-off the exception is lost.

The Commission has published two key implementation instruments.

The Guidelines were finalised on 20 July 2026 and provide interpretive guidance on all four Article 50 obligations. They are not legally binding, however, national market surveillance authorities and the AI Office are expected to follow the Guidelines closely. 

The Code of Practice offers the only EU-recognised framework for demonstrating compliance with Article 50(2) (marking and detection) and Article 50(4) (labelling). It does not cover Article 50(1) (interactive AI systems) or Article 50(3) (emotion recognition and biometric categorisation). The Code is voluntary and, while adherence is not conclusive evidence of compliance, it reduces the burden of justifying choices to market surveillance authorities.  Non-signatories will need to demonstrate compliance by other means and should expect closer regulatory scrutiny.

Article 50 obligations apply alongside existing legal obligations.

GDPR: GDPR transparency obligations (Articles 13 - 14) and data protection impact assessments apply alongside  Article 50(3).

Digital Services Act: The DSA imposes separate (complementary but non-overlapping) AI content labelling obligations on very large online platforms.

Consumer protection: Failure to disclose AI interaction may also constitute a misleading practice under the Unfair Commercial Practices Directive.

Businesses should also check applicable national law alongside their AI Act compliance as some Member States have introduced additional transparency rules.