EU AI Act Article 50 Explained: A Plain-Language Guide for Business Leaders

It is not a ban on AI. It is a honesty rule. You can still use chatbots, voice agents, image tools and AI writing tools. You just have to be open about it in four specific situations.

Talking to AI: if a person is chatting or speaking with an AI system, they must be told, unless it is obvious.
AI-made content: tools that create audio, images, video or text must mark their output in a way machines can detect.
Emotion and biometric tools: people exposed to them must be told they are in use.
Deepfakes and public-interest text: the organisation that publishes them must label them in a way people can see or hear.

The rule applies whatever the risk level of the AI system. A simple website chatbot is covered just like a sophisticated video generator.

How Article 50 affects businesses that use AI

If your business uses AI to talk to customers, create marketing content or publish information, Article 50 almost certainly touches you. It reaches far beyond AI companies. Ordinary businesses are covered when they use AI tools in their daily work.

Here is what it looks like in everyday terms:

If your business…	What Article 50 means for you
Runs a chatbot or AI assistant on its website or app	Customers must be told they are talking to AI, at the start of the conversation, unless it is obvious.
Uses a voice agent for calls or support lines	The caller must be told they are speaking with an AI.
Builds or sells a tool that generates images, audio, video or text	The tool must mark what it produces so software can detect it as AI-generated.
Uses AI to make realistic images, videos or voices of real people, places or events	You must clearly label the content as AI-generated or AI-manipulated.
Publishes AI-written articles or posts meant to inform the public on matters of public interest	You must say the text is AI-generated, unless a person reviewed it and takes editorial responsibility.
Uses systems that read emotions or sort people by biometric traits	The people exposed to the system must be told it is operating.

Three points matter most for leaders:

It applies even if you only buy the AI. Buying a chatbot or content tool from a vendor does not move all the duty to the vendor. Your own labelling duties as the user can remain with you.
It can reach non-EU companies. If AI output is meant to be used in the EU, or you post deepfake content on the open internet where EU users can see it, you can be in scope.
Open-source does not escape. Providers and deployers of open-source AI systems are not exempt.

Article 50 sits alongside other rules, not instead of them. Data protection law (GDPR) and the AI literacy duty in Article 4 still apply, and the Commission’s guidance links staff AI literacy directly to Article 50 work.

Who has obligations under Article 50

Article 50 splits the duties between two roles, and the first job for any leader is to work out which role their company plays for each AI system.

Provider: the organisation that develops an AI system, or has it developed, and puts it on the market or into service under its own name. Think of the company that builds the chatbot, the voice tool or the image generator.
Deployer: the organisation that uses an AI system under its own authority in its work. Think of the company that puts the chatbot on its website, or the marketing team that uses a tool to make a video.

One company can be both. If you build your own chatbot and run it on your own site, you are the provider and the deployer.

Article 50 paragraph	Duty	Who carries it
50(1)	Design the AI so people know they are interacting with AI	Provider
50(2)	Mark generated audio, image, video and text so machines can detect it as AI-made	Provider
50(3)	Tell people when emotion recognition or biometric categorisation is used on them	Deployer
50(4)	Label deepfakes and AI-written public-interest text	Deployer
50(5)	Present all the above clearly, no later than the first interaction or exposure	Whoever owes the duty above

Who is responsible, the provider or the deployer?

Both, for different things. Neither can hand the whole job to the other.

The provider is responsible for building the transparency into the product: the AI-interaction notice design and the machine-readable marking.
The deployer is responsible for what the audience actually sees or hears: the visible label on a deepfake, the notice about emotion recognition, and the disclosure on public-interest text.
The provider’s invisible marking does not replace the deployer’s visible label. The Commission’s guidelines are clear that these are two separate duties.

A few edge cases worth knowing:

Marking sits with the system’s own provider. The Article 50(2) duty rests with the provider of the AI system that generates the content, not with whoever built the underlying model it runs on.
Platforms and broadcasters that only pass along content made by others, and have no control over the AI tool used, are not treated as deployers.
Creative agencies: when an agency produces AI content for a client, the labelling duty can fall on either the client or the agency. Settle this in the contract.

Practical advice: write the split into every vendor contract, so it is clear who builds the notice, who adds the marking and who applies the label.

The four obligations under Article 50

1. Tell people they are talking to AI (Article 50(1), providers)

Any AI system built to interact directly with people must be designed so those people know it is AI. The exception is when it is obvious to a reasonably well-informed, observant person in that context. A cartoon robot mascot in a game is obvious. A friendly support agent called “Maya” is not.

2. Mark AI-generated content so machines can detect it (Article 50(2), providers)

Systems that generate audio, images, video or text must mark their output in a machine-readable way, such as a watermark or hidden metadata, so that it can be detected as AI-generated or AI-manipulated. This covers general-purpose AI systems too. Exceptions apply where the AI only helps with standard editing, does not substantially change the input or its meaning, or is authorised by law for criminal investigation.

3. Tell people about emotion recognition and biometric categorisation (Article 50(3), deployers)

If you use a system that detects emotions or sorts people into categories using biometric data, you must tell the people exposed to it that it is running. Systems that the law allows for detecting or investigating crime are exempt, with safeguards. GDPR rules on personal data apply on top.

4. Label deepfakes and AI-written public-interest text (Article 50(4), deployers)

Two separate rules sit here:

Deepfakes: if you use AI to create or alter image, audio or video content that counts as a deepfake, you must disclose that it is artificially generated or manipulated.
Public-interest text: if you publish AI-generated or AI-altered text to inform the public about matters of public interest, you must disclose it. The exception is when a human has reviewed the text, or it is under editorial control, and someone holds editorial responsibility for it.

For obviously artistic, creative, satirical or fictional works, the duty is lighter. You only need to disclose that AI-made or AI-altered content exists, in a way that does not spoil the viewing or enjoyment of the work.

The rule that ties them together: how to disclose (Article 50(5))

The information must be clear and easy to tell apart from other content, accessible, and given at the latest at the first interaction or first exposure. A notice buried in the terms and conditions does not meet this standard.

The complete Article 50

Article 50 has seven paragraphs. This table is a plain-language map of the whole article, in the same order as the law, so readers can match this page to the legal text. It is a summary, not the legal wording. Always rely on the official text for legal decisions.

Paragraph	In plain words	Who	Main exceptions
50(1)	AI systems made to interact directly with people must be designed so people are told they are dealing with AI.	Provider	Obvious from context to a reasonably well-informed, observant person; systems authorised by law for criminal-offence work, with safeguards.
50(2)	Systems that generate synthetic audio, image, video or text, including general-purpose AI systems, must mark output in a machine-readable format so it is detectable as AI-generated or manipulated. The technical method must be effective, interoperable, robust and reliable as far as technically feasible.	Provider	AI that only assists with standard editing; AI that does not substantially change the input data or its meaning; use authorised by law for criminal-offence work.
50(3)	Anyone using an emotion recognition or biometric categorisation system must inform the people exposed to it, and must process personal data in line with data protection law.	Deployer	Systems permitted by law for detecting, preventing or investigating crime, with safeguards.
50(4), first part	Anyone using AI to create or alter image, audio or video content that is a deepfake must disclose that it is artificially generated or manipulated.	Deployer	Lighter duty for evidently artistic, creative, satirical or fictional works; crime-related use authorised by law.
50(4), second part	Anyone publishing AI-generated or AI-altered text to inform the public on matters of public interest must disclose that it is AI-generated or altered.	Deployer	Human review or editorial control with a person or organisation holding editorial responsibility; crime-related use authorised by law.
50(5)	All of the information above must be provided in a clear and distinguishable way, no later than the first interaction or exposure, and it must meet accessibility requirements.	Provider or deployer, as relevant	None specific.
50(6)	Article 50 does not change the high-risk AI requirements in Chapter III, and it is without prejudice to other transparency duties in EU or national law.	Everyone	Not applicable.
50(7)	The EU AI Office encourages codes of practice on detecting and labelling AI-generated content. If the Commission finds a code inadequate, it may adopt common rules by implementing act.	EU institutions	Not applicable.

What is a deepfake under the EU AI Act?

A deepfake is AI-made or AI-altered image, audio or video that looks or sounds like real people, objects, places, organisations or events, and that would wrongly seem authentic or truthful to a viewer or listener. The legal definition is in Article 3(60) of the Act.

Three tests must all be met:

It is AI-generated or AI-manipulated.
It is image, audio or video. Text is not a deepfake under this definition. Text is handled by the separate public-interest text rule.
It resembles something real and would falsely seem genuine. The test is about the effect on the audience, not about the maker’s intent.

The Commission’s guidelines add two helpful points: you do not need to intend to deceive anyone, and photorealism alone is not what decides it. What matters is whether the content would falsely appear authentic to its likely audience. If the audience includes children, older people or people with low media literacy, they must be taken into account.

Example	Deepfake?	Why
AI video of a person resembling a politician giving a speech	Yes	Looks like a real person doing something real.
AI-generated celebrity-style influencer in an advertisement	Yes	A realistic person who could be taken as real.
Cloned voice of a podcast host saying new lines	Yes	A real voice saying things the person never said.
CEO video dubbed into five languages with an AI copy of the CEO’s voice	Yes	Even with the CEO’s consent, listeners could still be misled about how it was produced.
Photorealistic AI image of a “happy customer” in an ad	Yes	Falsely appears to be a real photograph.
Obviously drawn AI illustration in a blog post	No	Clearly artificial, nobody would take it as real.
AI image of a sphinx flying over the Eiffel Tower	No	Fantastical, would not appear authentic.
Satirical video using an AI double of a politician	Depends	It may be a deepfake, but the lighter rule for evident satire can apply.

Two points often missed:

Consent does not remove the label. Having permission to use someone’s voice or face settles the rights question. It does not settle whether the audience knows the content is AI-made.
The provider’s watermark does not replace your label. A hidden machine-readable mark is for software. The deployer’s disclosure must be something a person can see or hear.

Content created before 2 August 2026 does not carry a retroactive labelling duty.

How Article 50 applies to AI-generated audio and voice AI

Yes, Article 50 applies to voice AI. AI voices fall inside the rules, and the duties can stack up depending on what your system does. A single voice product can trigger more than one paragraph at the same time.

What the voice AI does	Article 50 duty	Who carries it
A voice bot answers or makes calls to real people	Callers must be told they are speaking to AI (50(1)).	Provider designs it in; the company running the line must make sure it happens in practice.
A text-to-speech or voice generation tool produces synthetic audio	Output must be marked in a machine-readable way and be detectable (50(2)).	Provider of the tool
A cloned or realistic voice of a real person is used in published audio	The audience must be told it is AI-generated or manipulated (50(4)).	Deployer who publishes it
AI voice reads out public-interest news or information	Disclosure that it is AI-generated, unless human editorial review and responsibility applies (50(4)).	Deployer
Voice analysis is used to detect emotions in callers or staff	The people exposed must be told (50(3)).	Deployer

What good disclosure sounds like

A visual badge does not work for audio-only content, so the disclosure has to be heard.

Voice bots: say clearly at the start of the call that the caller is speaking with an AI, and repeat a reminder during long calls.
Podcasts, audio ads and audio dubbing: use a short spoken statement or audio notice, since the Code of Practice contemplates audio disclaimers where a visual label is not possible.
Video with AI voice: show a visible label and also, where the audio is the AI-made part, make the disclosure audible.
Machine-readable marking: providers can use techniques such as inaudible watermarks and provenance metadata so detection software can identify the audio. The Code of Practice gives the practical options.

Common situations

Customer service voice bot: disclose at the start of every call. Treat it as a compliance requirement, not a branding choice.
AI dubbing of a creator or executive: get the person’s consent for the rights question, and label the audio for the transparency question. You need both.
E-learning narration with a synthetic voice: if the voice is obviously synthetic and does not imitate a real person, deepfake labelling is unlikely to apply, but the provider’s marking duty (50(2)) still does.

Bottom line: if a voice is generated or changed by AI, assume Article 50 needs a closer look, and decide whether the duty sits with you as provider, deployer or both.

Article 50 compliance checklist for providers

Use this if your organisation builds AI systems and offers them under its own name, including chatbots, voice agents and generative tools.

List every AI system you provide and note which ones talk to people or generate audio, images, video or text.
For each interactive system, design in a clear AI notice that appears at or before the first interaction (50(1)).
Decide whether any “obvious AI” exception really applies, and write down why.
For each generative system, add machine-readable marking to its output, such as watermarks or embedded metadata (50(2)).
Provide a way to detect the marking, so others can check whether content is AI-generated.
Check the method is effective, robust, reliable and interoperable as far as technically feasible, and test it.
Cover all output types you produce: audio, image, video and text. Note where text marking is still limited and record how you handle that.
Check whether an exception applies (assistive standard editing, no substantial change to the input) and document the reasoning.
For systems already on the market before 2 August 2026, finish the marking work before 2 December 2026.
Make sure notices are clear, easy to tell apart, accessible, and shown no later than first exposure (50(5)).
Decide whether to sign the Code of Practice, or document the alternative way you will show compliance.
If you use a third-party marking tool, remember you are still responsible for its compliance.
Give deployers the information and tools they need to label content properly, such as labelling options and guidance.
Write the provider and deployer split into customer contracts.
Confirm staff working on transparency have enough AI literacy (Article 4).

Article 50 compliance checklist for deployers

Use this if your organisation uses AI systems built by others (or by you) in its own work, such as customer chat, content creation, publishing or workforce tools.

Inventory every AI tool in use and record, for each, whether you are the deployer, the provider, or both.
Confirm each vendor chatbot or voice agent tells people they are dealing with AI at the start, and test it yourself.
If you use emotion recognition or biometric categorisation, tell the people exposed to it and check your data protection basis (50(3)).
Identify every image, audio and video asset made or altered with AI, including ads, training videos, dubbed content and social posts.
For each one, decide whether it is a deepfake: does it resemble something real and would it falsely seem authentic?
Apply a clear, visible or audible label to every deepfake, no later than first exposure (50(4)).
Do not rely on the provider’s invisible marking as your label. They are separate duties.
Review AI-written text meant to inform the public on matters of public interest. Either label it as AI-generated or confirm human review with named editorial responsibility.
For artistic, satirical or fictional works, use the lighter disclosure that does not spoil the work.
Make disclosures accessible, including for people with disabilities, and write them in the language of the audience.
Settle responsibilities with agencies, freelancers and vendors who create AI content for you.
Check that notices and your GDPR privacy information do not contradict each other.
Train the teams who create or publish AI content on when to label.
Set a sign-off step before publication for any content that may be a deepfake or public-interest text.

Penalties for non-compliance

Breaking Article 50 can cost up to €15 million or 3% of total worldwide annual turnover, whichever is higher. The fines come from Article 99 of the AI Act, and they are meant to be effective, proportionate and dissuasive.

Type of breach	Maximum fine
Prohibited AI practices (Article 5)	€35 million or 7% of worldwide annual turnover
Most other obligations, including Article 50 transparency duties	€15 million or 3% of worldwide annual turnover
Giving incorrect, incomplete or misleading information to authorities	€7.5 million or 1% of worldwide annual turnover

Build governance around Article 50 compliance

Treat Article 50 as an ongoing process with owners and checkpoints. A one-time clean-up will not hold. The steps below work for most organisations.

Name an owner. Pick one accountable leader and a small group from legal, product, marketing, IT and customer service.
Build an AI inventory. List every system that talks to people or creates content, and record whether you are provider, deployer or both.
Classify each use. Mark each one as AI interaction, generated content, emotion or biometric tool, deepfake, public-interest text, or none.
Write a short policy. Set out when notices, marking and labels are required, the approved wording, and the approval steps.
Put checks into workflows. Add a disclosure check to product launch, procurement, marketing sign-off and publishing.
Update vendor contracts. State who builds the notice, who marks the output and who labels the content, and require vendors to share evidence.
Train people. Cover chatbot owners, content creators, editors and social media teams, linked to your AI literacy programme.
Test and monitor. Spot-check live chatbots, voice agents and published content on a schedule, and log the results.
Handle incidents. Define what to do if a disclosure is missing, a label fails or a regulator asks questions.
Review regularly. The Code of Practice, guidelines and national guidance are still developing, so review the policy at least twice a year.

What evidence should teams keep for Article 50 compliance?

Keep enough to show a regulator, a customer or an auditor what you did, when, and who approved it. Article 50 itself does not list required records, so this is a recommended set. A policy on paper is not evidence. Proof that the policy was followed is.

Area	Evidence to keep	Why it helps
Scope	AI system inventory showing provider or deployer role and Article 50 classification for each system	Shows you know which duties apply to which system.
Chatbots and voice agents	Screenshots, call scripts or recordings showing the AI notice at first interaction, plus version history of the wording	Proves people were told at the right time.
Marking (providers)	Technical description of the marking method, test results, detection tool details, and dates of release	Shows the marking works and when it went live.
Deepfake labels (deployers)	Register of AI-made or AI-altered image, audio and video, with the label used and where it appeared	Proves each deepfake was labelled.
Public-interest text	Record of which AI-assisted texts were labelled, and which were exempt because of human review, with the name of the editor responsible	Backs up any use of the editorial exception.
Exceptions	Written reasoning when you decide a duty does not apply, such as “obvious AI” or “assistive editing only”	Shows the decision was considered, not accidental.
Vendors	Contracts splitting provider and deployer duties, vendor compliance statements and certificates	Shows responsibilities were allocated.
People	Training records and AI literacy materials	Shows staff know the rules.
Governance	Policy, approvals, review dates, and incident or complaint logs	Shows ongoing control.
Code of Practice	Proof of signing, or notes on the alternative measures you use	Shows the route you chose to demonstrate compliance.

Tips for keeping evidence sensible:

Keep the compliance record separate from the content record. You rarely need to keep every customer message to prove that a notice was shown.
Keep versions. Disclosure wording and marking settings change, and you need to show what applied on a given date.
Respect data protection. Keep only what you need, for as long as you need it, and set retention limits.
Make it findable. Store it where legal, product and audit teams can retrieve it within days, not weeks.

Quick compliance checklist: all points to review

A one-page review that leaders can run in a single meeting. Every “no” is an action item.

Scope and roles

Do we have a complete list of AI systems that talk to people or generate content?
For each, do we know whether we are the provider, the deployer, or both?
Have we checked whether our output reaches EU users, even if we are based elsewhere?

Talking to AI (50(1))

Does every chatbot and voice agent tell people it is AI at the start?
If we rely on the “obvious” exception, is the reason written down?

Marking AI-generated content (50(2))

Is output marked in a machine-readable way, and is there a way to detect it?
Are legacy systems on track for 2 December 2026?

Emotion and biometric tools (50(3))

Are people told when emotion recognition or biometric categorisation is used on them?

Deepfakes and public-interest text (50(4))

Do we know which of our images, audio and video are deepfakes, and are they labelled?
Is AI-written public-interest text labelled, or covered by documented human editorial review?
Are artistic or satirical works handled with the lighter disclosure?

How we disclose (50(5))

Are notices clear, distinct from other content, accessible and shown by first exposure?

Governance and proof

Do we have an owner, a policy and a sign-off step?
Do vendor contracts split provider and deployer duties?
Have we trained staff, and do we hold evidence of notices, labels and decisions?
Have we decided whether to follow the Code of Practice?

Frequently asked questions

Does Article 50 apply to voice AI systems?

Yes. If a voice system interacts directly with people, they must be told it is AI (50(1)). If it generates synthetic audio, the provider must mark the output (50(2)). If it imitates a real person’s voice in a way that would seem genuine, the deployer must disclose it as a deepfake (50(4)). If it analyses voices to detect emotions, the people exposed must be told (50(3)).

What is a deepfake under the EU AI Act?

A deepfake is AI-generated or AI-manipulated image, audio or video that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful. Text is not included. Intent to deceive is not required, and a licensed or consented voice clone can still be a deepfake. The full explanation is in the deepfake section above.

Who is responsible for Article 50 compliance, the provider or deployer?

Both, for different parts. Providers are responsible for 50(1) and 50(2): designing the system so people are informed, and marking generated content. Deployers are responsible for 50(3) and 50(4): telling people about emotion recognition or biometric categorisation, and labelling deepfakes and public-interest text. Each party must make sure the information meets the presentation rules in 50(5). The provider’s marking does not cover the deployer’s label.

Does every piece of AI content need a visible label?

No. Article 50 creates specific duties, not a blanket rule. Many everyday uses, such as spell-checking, drafting internal emails or editing, do not trigger a public label. The visible label is required for deepfakes and for AI-generated public-interest text published without human editorial control.

Are small businesses and open-source projects exempt?

No. Neither is exempt from the duties. Small businesses and start-ups benefit only from a lower fine ceiling.

We bought our chatbot from a vendor. Is it only the vendor’s problem?

No. The vendor, as provider, must design the AI notice in. But you control how the chatbot is presented to your customers, so check that the notice really appears and put the split of duties in your contract.

Sources and further reading

This page was written on 10 October 2026 from the sources below, found by search; the search snippets were read, not each full page. Check the official legal text and the latest Commission guidance before making legal decisions. This guide is general information, not legal advice.

Official sources

Law firm and expert analysis

Timelines, Digital Omnibus and penalties

Voice and deepfakes

Before You Get Started

If your business uses AI to communicate with customers, generate content, deploy chatbots, or create synthetic images, audio, or video, the EU AI Act’s Article 50 may introduce transparency obligations you need to understand. The key question isn’t simply whether you’re using AI — it’s whether you know when disclosure is required, who is responsible, and how you can demonstrate compliance.

You may need to identify where Article 50 applies, establish clear disclosure procedures, assign ownership, assess relevant risks, and maintain evidence that your controls are working. These responsibilities can become difficult to manage when AI governance is added to an already demanding compliance workload.

That’s where Access0day can help.

We work with businesses to translate AI governance requirements into practical, operational controls — from assessing existing AI use cases and identifying compliance gaps to developing policies, defining accountability, and strengthening governance documentation. Where your broader AI governance programme requires it, we can also help you work towards an AI Management System aligned with ISO/IEC 42001.

Don’t let AI transparency become an afterthought. Talk to Access0day about building a governance approach that supports responsible AI adoption, strengthens stakeholder trust, and helps your business prepare for evolving regulatory expectations.