EU AI Act Article 50: what developers must do from 2 August 2026

The EU AI Act is the EU's horizontal regulation for artificial intelligence, and as of September 2026 its transparency duties are the part developers feel first. Article 50 has applied since 2 August 2026: if a person interacts with an AI system, the system has to make that clear, and the information must arrive at the latest at the time of the first interaction or exposure. A customer chatbot, a voice agent, a synthetic product photo, a news article drafted by a model — each lands in a specific paragraph of that one article.

This is a working map of Article 50 for people who ship the code: what the Digital Omnibus moved, the paragraphs that decide whether you owe a duty, why the provider or deployer label changes your engineering work, and a checklist for shipping a chatbot into the EU.

What the Digital Omnibus changed, and what it did not

The Omnibus moved the expensive obligations and left the cheap ones. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. Annex III high-risk duties — recruitment, credit scoring, education access, biometrics — now apply from 2 December 2027, and Annex I duties for AI embedded in regulated products from 2 August 2028. Article 50 was not deferred: it applies from 2 August 2026, with exactly one carve-out, the Article 50(2) marking duty for systems already on the market, which has a grace period to 2 December 2026.

The rest of the Act is already live. Prohibitions and the Article 4 AI literacy duty have applied since 2 February 2025, with Article 4 softened to ask that you support the development of AI literacy rather than guarantee a level of it. GPAI obligations have applied since 2 August 2025, and the Commission's enforcement powers over GPAI models since 2 August 2026. The Omnibus also widened the prohibited practices list: Gibson Dunn records a new ban on AI systems generating non-consensual intimate imagery and child sexual abuse material, transitional to 2 December 2026.

For an engineering team the consequence is blunt: the deadline you cannot move is the one about telling users. The one that moved is about proving a system is safe.

Article 50(1): telling people they are talking to an AI system

Article 50(1) puts this duty on the provider. AI systems intended to interact directly with natural persons must be designed and developed so that the people concerned are informed that they are interacting with an AI system. There is one escape hatch, and it is narrow: the duty does not apply "unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use."

That standard is the real design question, because the text does not enumerate interfaces for you. A chat window with a typing indicator is not obvious. A self-service booking flow where the only way in is by voice with a machine may well be. My rule of thumb: if you need a paragraph of context to argue your feature is obvious, it is not, so label it.

Agents get more attention than plain chatbots. The Commission's final Article 50 guidelines, published on 20 July 2026, confirm that AI agents acting on behalf of a principal fall inside Article 50(1) and must identify both their AI nature and the person or entity on whose behalf they are acting. A reference buried in your terms of service, a generic label such as "assistant", or metadata alone will not do. Where a provider cannot know in advance whether an agent will ever talk to a person, the agent must disclose itself in every situation where that is possible, and in a multi-agent setup each agent that can talk to people complies on its own.

Build that as a rule, not a string per feature: put the disclosure in the shared system prompt and the shared chat shell, so a new feature cannot ship without it. Worth knowing where the guidelines leave no room: "assistant" in a page title, a terms-of-service reference and metadata alone are all explicitly insufficient. The chat surface mechanics are in shipping LLM features in Nuxt.

// Illustrative pseudo-code: the Article 50(5) timing test in a chat handler
const mustDisclose = !isObviouslyAI(context)   // "reasonably well-informed,
                                              //  observant and circumspect"
if (mustDisclose) {
  logDisclosure({ user, session, at: 'first_interaction' })
  return renderChat({ banner: 'You are talking to an AI system.', agentPrincipal })
}
return renderChat({})

Article 50(5) sets the form as well as the timing: the information must be clear and distinguishable and conform to the applicable accessibility requirements. That last clause is easy to skip, so treat the disclosure as a real UI component with contrast, focus order and screen-reader semantics, not a low-contrast line of grey text.

Article 50(2): machine-readable marking of synthetic content

Article 50(2) is the technical paragraph. Providers of AI systems — the text says "including general-purpose AI systems" — that generate synthetic audio, image, video or text must ensure the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. There is a quality bar too: solutions must be effective, interoperable, robust and reliable as far as technically feasible, taking into account the content type, cost and the state of the art.

The Commission and the AI Board concluded that the current state of the art does not let any single technique satisfy all four requirements at once. The Transparency Code of Practice, published on 10 June 2026 and judged adequate on 8 and 9 July 2026, answers with layers: signed metadata plus imperceptible watermarking, with simplified requirements where outputs stay in physically controlled, closed environments or where the content type cannot carry embedded metadata — free-form text is the example given. Signatories must also offer detection tools, generally free of charge, and reach watermark-detection interoperability by 2 February 2027.

The exceptions are wider than the Act's own wording, because the guidelines widened them. AI-generated translations now sit inside the "standard editing" exemption, alongside grammar correction and minor stylistic polish; summaries and substantive rewrites still need marking. And there is a new business-to-business carve-out: providers may omit marking where outputs are used exclusively in closed industrial or B2B environments with appropriate safeguards against foreseeable misuse, such as cloud isolation and role-based access controls. Public and consumer-facing systems are excluded.

The unsolved part is free-form text: marking is mature for images and audio and much weaker for prose. The duty stays with the provider regardless, and cost on its own is not an exemption — it only weighs inside a proportionality assessment.

Article 50(4): deepfakes, public-interest text and editorial control

Article 50(4) is a deployer duty, and the one that reaches marketing and communications teams rather than platform engineers. There are two triggers. First, image, audio or video content that constitutes a deep fake — AI-generated or manipulated content resembling existing persons, objects, places or events that would falsely appear to a person to be authentic or truthful — must be disclosed as artificially generated or manipulated. Second, text published to inform the public on matters of public interest must be disclosed the same way.

The exceptions differ. For public-interest text, the duty does not apply where the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility for the publication. The final guidelines narrow that: routine or pro-forma review does not qualify. "A human read it before we published" only works if that human had the authority and the time to change the text, and if you can name the person accountable. For deepfakes, evidently artistic, creative, satirical or fictional work gets a reduced duty rather than an exemption: disclose that the generated content exists, in a manner that does not hamper enjoyment of the work.

The fourth element of the deep fake definition does a lot of work, and the guidelines use it both ways. Where the audience does not expect content to be authentic in a given context, it may fall outside the definition. But the Commission's examples confirm that AI-generated marketing content making products appear different from reality, digital replicas of real persons and de-aging effects applied to actors all are deepfakes requiring disclosure. Advertising counts as potentially "creative" only in narrow circumstances, and most examples do not qualify. A synthetic face next to a real product means a label.

One more date rule, because it trips people up. For image, audio and video, what counts is the date of generation, so synthetic media made before 2 August 2026 does not need marking retroactively. For public-interest text, what counts is the date of publication, so text generated earlier but published on or after that date does need a label unless it falls under the editorial-control exception.

What the label looks like is not left to taste. The Code specifies a clear visual label at the point of first exposure and accepts the Commission's standardised icon, while allowing alternative designs that meet its specifications. For audio-only formats, a spoken or written disclaimer does the job instead.

Provider or deployer: the label that decides what you build

Article 50 addresses paragraphs to specific roles, and that split decides whose problem a duty is. A provider develops the AI system or puts it on the market under its own name. A deployer uses an AI system under its authority. In an ordinary product both labels sit in your value chain, often in the same company: you buy a model, you wrap it, you publish the result.

Whatever the legal split, the engineering consequence is the same: put the Article 50 duties in the vendor contract. Buy a model API and you cannot mark its outputs or invent a detection tool, so get both promised in writing. Ship the model and you own all of Article 50(2).

Scope is broader than "we have an EU office". The guidelines read Article 2(1)(c) as making the obligations apply wherever the output is intended to be used in the EU, whatever the provider's or deployer's place of establishment. For deep fake labelling the Commission goes wider still: posting content on the globally accessible internet, with no requirement that it target the EU, may trigger the obligation. Open-source systems are not exempt, and the penalty ceiling is €15 million or 3% of worldwide annual turnover.

Article 4 AI literacy and the Austrian advisory desk

Article 4 has applied since 2 February 2025, and the Omnibus kept the duty while softening the wording: providers and deployers have to support the development of AI literacy among their staff rather than guarantee a level of literacy. Read literally that is light. In practice it is a documentation duty, satisfiable with a training offer, a written policy and evidence that both exist. The useful version is free: the people who ship a chatbot should know what it does and what it refuses. That is the same discipline as containing prompt injection by architecture.

In Austria, the national advisory body is the RTR KI-Servicestelle. The RTR's AI Act page follows the regulation in stages for a general audience and links the Official Journal text, the Commission's AI Office pages and the other EU acts that interact with it, the GDPR included. For an Austrian company that wants a regulator's framing rather than a vendor's slide deck, that is the first call.

A developer checklist for Article 50

Eight questions, in the order I would answer them. Each should end up as a line in a design document or a test.

1. Classify every AI feature against the five Article 50 triggers: direct interaction, synthetic content, assistive editing, published content, biometrics. Write the answer down.
2. Say who you are. Provider, deployer or both, per feature. If you deploy someone else's model, get the Article 50(2) marking and detection into the contract.
3. Ship the 50(1) disclosure in the shared layer — system prompt and chat shell — with the timing test explicit: clear, distinguishable, accessible, at first interaction.
4. Add a regression test for the disclosure that fails when you remove the banner. Evals work here; see building a regression suite for LLM features.
5. Track whether you are a pre- or post-2-August-2026 system. If you were on the market before that date, the marking grace period runs to 2 December 2026 and no longer.
6. Mark synthetic media in two layers — signed metadata and an imperceptible watermark — and plan watermark-detection interoperability for 2 February 2027 if you are a provider.
7. Decide who is editorially responsible for AI-assisted public-interest text, and make that a named role with real authority, not a review step.
8. Write down the Article 4 literacy evidence — policy, training, date — and use the RTR KI-Servicestelle as the Austrian first contact.

None of this is exotic, and that is the point: Article 50 is mostly a labelling problem with a deadline, not a research project. Designing that disclosure layer, the model gateway and the vendor contracts for a product sold into the EU is the kind of work I do as an AI engineer.

Sources

1. Article 50: Transparency Obligations for Providers and Deployers of Certain AI Systems – AI Act Explorer, full article text
2. Regulation (EU) 2026/1744 (Digital Omnibus on AI) – Official Journal of the European Union, 24 July 2026
3. Commission confirms Transparency Code of Practice as adequate and publishes final Article 50 Guidelines – Faegre Drinker, 30 July 2026
4. EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines and Other Key Changes – Gibson Dunn, 27 May 2026
5. KI-Servicestelle: AI Act – Rundfunk und Telekom Regulierungs-GmbH (RTR), Austria