When do EU AI Act Article 50 transparency obligations apply?

Article 50(1), (3) and (4) of Regulation (EU) 2024/1689 apply from 2 August 2026 for both providers and deployers of the AI systems they cover. The provider machine-readable marking duty under Article 50(2) has a legacy grace period until 2 December 2026 for systems already on the market.

Who is responsible for the Article 50(1) interaction notice — provider or deployer?

Article 50(1) places the design obligation on the provider: they must ensure the system is designed to give the notice. The deployer is responsible for ensuring the deployment does not suppress or circumvent the provider's disclosure mechanism, and for covering any gap where the provider's integration does not automatically surface the notice in the deployer's interface.

What does Article 50(3) require for emotion recognition and biometric categorisation systems?

Deployers of AI systems that perform emotion recognition or biometric categorisation of natural persons must inform those persons of the operation of the system. The information must be provided in advance or at the latest at the start of data collection. Processing of personal data must comply with the GDPR and the Law Enforcement Directive. The obligation applies from 2 August 2026.

Does Article 50 apply to AI used internally, or only to customer-facing AI?

Article 50(1) covers AI systems 'intended to interact directly with natural persons' — which includes internal HR chatbots, AI writing assistants used by employees, and AI-powered hiring tools that interact with candidates. Article 50(3) covers emotion recognition regardless of whether the subject is a customer or employee. The internal/external distinction does not create an exemption.

EU AI ACT — FAQ

The 12 questions your EU customers ask about Article 50

Q: Did the Digital Omnibus postpone Article 50?

No. Regulation (EU) 2026/1744 — the Digital Omnibus on AI — was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It defers Annex III (high-risk) and Article 26 deployer obligations to 2 December 2027. Article 50 transparency is a separate chapter and is not deferred — 2 August 2026 remains binding.

Q: Does Article 50(1) require a chatbot banner at every message?

Article 50(1) requires that the person is informed they are interacting with an AI system unless this is obvious from the circumstances and context of use. The information must be provided at the first interaction — a persistent banner visible on every message is one approach, but what matters legally is that the disclosure reaches the user before or at the first AI-generated response.

Q: What is the Article 50(2) machine-readable marking requirement?

Article 50(2) requires providers of generative AI systems to mark AI-generated outputs in a machine-readable format that enables detection as artificially generated or manipulated. Solutions must be effective, interoperable, robust and reliable as far as technically feasible. Approaches include C2PA Content Credentials, SynthID, cryptographic hashes, and embedded metadata.

Q: What does Article 50(4) require for deep fakes and AI-generated text?

Deployers of AI that generates or manipulates image, audio or video constituting a deep fake must disclose that the content has been artificially generated or manipulated. For text published to inform the public on matters of public interest, deployers must also disclose that the text was artificially generated — unless the text has undergone human editorial review with a natural person taking editorial responsibility. The obligation applies from 2 August 2026.

Q: How does Article 50 interact with GDPR?

Article 50(3) explicitly requires that deployers process personal data in accordance with the GDPR and the Law Enforcement Directive. Beyond Article 50, AI systems that process personal data for emotion recognition or biometric categorisation will typically trigger DPIA obligations under GDPR Article 35. The GDPR Articles 13 and 14 transparency notices should be updated to mention the use of such AI systems.

Q: What is the maximum fine for breaching Article 50?

Infringements of Article 50 fall under Article 99(4) of Regulation (EU) 2024/1689: up to EUR 15,000,000 or 3% of total worldwide annual turnover, whichever is higher. For SMEs and start-ups the fine is capped at the lower of the two amounts.

Article 50 of Regulation (EU) 2024/1689 sets transparency duties for chatbots, emotion-recognition systems, deep fakes and AI-generated text. It applies from 2 August 2026 — independent of the Annex III high-risk classification — and is not deferred by the Digital Omnibus. Here are the twelve questions HR-tech buyers, DPOs and procurement teams most commonly ask.

1. When do Article 50 obligations apply?

Article 50(1), (3) and (4) apply from 2 August 2026. The provider machine-readable marking duty under Article 50(2) has a legacy grace period until 2 December 2026 for systems already on the market before August 2026.

2. Did the Digital Omnibus postpone Article 50?

No. Regulation (EU) 2026/1744 (Digital Omnibus), published in the Official Journal on 24 July 2026 and in force from 27 July 2026, defers Annex III high-risk and Article 26 obligations to 2 December 2027. Article 50 is a separate transparency chapter — its 2 August 2026 application date is unchanged.

3. Does Article 50(1) require a chatbot banner at every message?

Not necessarily. Article 50(1) requires disclosure unless obvious from the circumstances and context of use. The information must be provided at or before the first interaction. A persistent banner is one approach; what matters legally is that the user is informed before or at the first AI-generated response.

4. Who is responsible for the Art 50(1) notice — provider or deployer?

Article 50(1) places the design duty on the provider. The deployer must not suppress or circumvent the provider’s disclosure mechanism, and must cover any gap where the provider integration does not automatically surface the notice in the deployer’s interface.

5. What is the Article 50(2) machine-readable marking requirement?

Providers of generative AI systems must mark outputs in a machine-readable format enabling detection as artificially generated or manipulated. Solutions must be effective, interoperable, robust and reliable as far as technically feasible. Current implementations include C2PA Content Credentials, SynthID, cryptographic hashes and embedded metadata.

6. What does Article 50(3) require for emotion-recognition systems?

Deployers must inform persons exposed to the system of its operation, in advance or at the latest at the start of data collection. Personal data processing must comply with GDPR and the Law Enforcement Directive. Narrow exemptions cover legally authorised criminal-offence detection only.

7. What does Article 50(4) require for deep fakes and AI text?

Deployers must disclose that image, audio or video content constituting a deep fake has been artificially generated or manipulated. For text published to inform the public on matters of public interest, deployers must also disclose AI authorship — unless a human exercised editorial review and takes editorial responsibility.

8. How does Article 50 interact with GDPR?

Article 50(3) explicitly requires GDPR compliance for the personal data processed. Emotion-recognition and biometric-categorisation systems will typically trigger a DPIA under GDPR Article 35. GDPR Articles 13 and 14 privacy notices should be updated to disclose the use of these AI systems and the Article 50 disclosure mechanism.

9. What is the fine for breaching Article 50?

Article 99(4) of Regulation (EU) 2024/1689: up to EUR 15,000,000 or 3 % of total worldwide annual turnover, whichever is higher. For SMEs and start-ups the fine is capped at the lower of the two amounts.

10. Does Article 50 cover internal AI use, or only customer-facing AI?

Article 50(1) covers AI systems intended to interact directly with natural persons — including internal HR chatbots, AI writing assistants and candidate-facing hiring tools. Article 50(3) covers emotion recognition regardless of whether the subject is a customer or an employee. There is no internal-use exemption.

11. What evidence should procurement ask vendors for?

For Art 50(1): screenshot or DOM export of the disclosure mechanism at first interaction, confirmed active in your configuration. For Art 50(2): vendor attestation that machine-readable marking is applied and survives copy/PDF export. For Art 50(3)/(4): your own disclosure text, a sample of the notice as shown to users, with a timestamp.

12. How does PowerQuant help?

PowerQuant Module 1 delivers a complete Article 50 evidence pack in 5 working days: AI inventory mapping which systems fall under each sub-paragraph, vendor-attestation templates, disclosure text, and a signed PDF evidence pack (Ed25519-signed, verifiable at powerquant.eu/trust). Fixed fee, no subscription.

Sources

Regulation (EU) 2024/1689, Articles 50, 99, 113 — EUR-Lex: eur-lex.europa.eu/eli/reg/2024/1689/oj
Regulation (EU) 2026/1744 (Digital Omnibus), OJ 24 July 2026, in force 27 July 2026.

Note: PowerQuant supplies software and documentation for use in your internal compliance process — not legal advice. Verify applicable dates and obligations with a qualified lawyer before relying on this guide.

PowerQuant Module 1

Article 50 evidence pack: AI inventory, vendor-attestation templates, disclosure text — EU-hosted, Ed25519-signed, delivered in 5 working days. Fixed fee, no subscription.

Price: EUR 1,499

Start Module 1