EU AI Act Article 50: the disclosure rules that already apply
Article 50 of the EU AI Act requires that people are told when they are interacting with an AI system, and that synthetic content is marked as machine-generated. Unlike the high-risk obligations, which phase in later, the transparency duties are the part of the Act most organisations are already exposed to, because almost every customer-facing chatbot and content generator falls in scope. Compliance is mostly about disclosure placement and record-keeping, not model changes.
What Article 50 covers
Article 50 imposes transparency duties on four situations, and they attach to different parties. Providers must design systems that interact with people so those people are informed they are dealing with an AI, unless it is obvious from context. Providers of generative systems must mark synthetic audio, image, video and text in a machine-readable way. Deployers of emotion-recognition or biometric-categorisation systems must inform the people exposed to them. Deployers who publish deepfakes must disclose that the content is artificially generated.
The obligation is on disclosure, not on outcome. Article 50 does not tell you what your AI may do. It tells you that people must not be misled about whether they are talking to software.
Why this is the obligation that bites first
Most coverage of the AI Act focuses on the high-risk regime under Annex III, which carries the heaviest requirements and the longest lead times. That focus is misleading for the average organisation, because most organisations do not deploy Annex III systems at all. They deploy support chatbots, drafting assistants and content generators.
Those are exactly what Article 50 covers. So the practical position for a lot of companies is that the obligations everyone is preparing for do not apply to them, and the obligation nobody is discussing already does.
What a compliant disclosure looks like
The standard is that the disclosure reaches the person at the point it matters, in a form they can act on. A line in a privacy policy does not satisfy that. Some working principles:
- Disclose at first contact, not after the conversation has developed.
- Use plain language. "You are chatting with an automated assistant" beats "AI-enabled experience".
- Keep it visible in the interface rather than behind an expandable section.
- Say how to reach a human, because the usual next question is how to escape the bot.
- For generated media, embed machine-readable provenance as well as the visible label.
The part organisations miss: proving it
Disclosure is easy to implement and easy to lose. Interfaces get redesigned, a component is refactored, and the notice quietly disappears from one flow while remaining in three others. Nobody notices until someone complains.
The durable version of Article 50 compliance is therefore not a one-off UI change but a record: which deployed systems interact with people, which of them carry a disclosure, and when that was last verified. That is an inventory problem before it is a legal one, which is why organisations that cannot list their AI systems cannot honestly claim Article 50 compliance either.
A workable checklist
If you are starting from nothing, this order gets you to a defensible position fastest:
- List every system that talks to a person or produces content for one.
- For each, decide whether a reasonable user would already know it is AI.
- Add a disclosure where the answer is no, at the first point of contact.
- Mark generated media with machine-readable provenance metadata.
- Record which system carries which disclosure, and keep that record current.
- Re-check after every interface change that touches those flows.
Frequently asked
Does Article 50 apply to internal AI tools?
The interaction duty is aimed at natural persons dealing with the system, and employees are natural persons. An internal assistant that a reasonable employee would recognise as software is unlikely to be a problem, but internal tools that impersonate a colleague are a different matter. The safer default is to disclose.
Is a disclosure in the terms of service enough?
Generally no. The requirement is that the person is informed in a way that reaches them, and buried terms do not. Put the notice in the interface at the point of interaction.
What counts as machine-readable marking for generated content?
Embedded provenance metadata rather than a visible caption alone. Content credentials and watermarking schemes are the common approaches. A visible label is still worth having, but on its own it does not meet the machine-readable element.
When did the transparency obligations start applying?
The transparency duties sit in the earlier part of the Act's phased timetable, well ahead of the high-risk obligations, which were pushed further out. That is why they are the practical first exposure for most deployers. Confirm the current dates against the official text, since the timetable has been amended.
Bulwark does this in production
Agent registry, scope enforcement, human approvals and a hash-chained evidence trail you can verify without trusting us. Free Developer tier, 100,000 governed decisions a month, no card required.
Related guides
- AI agent inventory: the register regulators will ask forWhat belongs in an AI system inventory, why "a spreadsheet of models" is the wrong shape, and how to keep it accurate as agents change.
- EU AI Act Article 14: what human oversight actually requiresArticle 14 requires human oversight of high-risk AI systems. What that means in practice, what counts as evidence, and what auditors look for.
- Shadow AI: how to find the agents already running in your companyMost organisations have more AI agents in production than anyone has written down. How to discover them from telemetry you already have.