Article 50 of the EU AI Act has moved AI transparency from a design preference to an operational obligation. Providers and deployers in the bloc must now address when people are told that they are interacting with AI, how synthetic material is marked and which disclosures accompany sensitive uses such as emotion recognition and biometric categorisation.
The rules respond to a practical problem: increasingly natural conversations and convincing synthetic media make it difficult for people to judge what they are seeing. Yet Article 50 is not one universal labelling rule. The obligation depends on what the system does and whether an organisation is acting as its provider, deployer or both.
Providers must make interaction and synthetic output visible
Providers must design directly interactive AI systems so people know they are dealing with a machine. An exception applies when that fact would be obvious to a reasonably well-informed, observant and circumspect person in the circumstances. Certain law-enforcement uses also sit outside the rule when safeguards protect third-party rights, although public-facing crime-reporting systems remain covered.
Systems that generate or manipulate audio, images, video or text create a second provider duty. Their outputs need machine-readable marking that can identify the material as artificial or altered. The Act calls for effective, interoperable methods as far as technically feasible, while taking account of implementation cost and the state of the art.
That qualification matters. Metadata can be removed, watermarks can be degraded and content can pass through platforms that do not preserve provenance. Article 50 demands a technical capability, but it does not make any single marking technology infallible.
Assistive editing that leaves a deployer’s input substantially unchanged is excluded. Routine enhancement therefore differs from generating a replacement scene. Providers will need documented criteria for that boundary rather than assuming every AI-assisted edit is treated alike.
Deployers face a different set of disclosure duties
Organisations using emotion-recognition or biometric-categorisation systems must inform the people exposed to them. Article 50 does not replace data-protection law: depending on the context, the GDPR, rules for EU institutions or the Law Enforcement Directive may still govern collection and use of personal data.
Deepfake images, audio and video require disclosure that they were artificially generated or manipulated. Artistic, satirical and fictional works receive a lighter treatment intended to preserve the experience of the work while still revealing the use of synthetic content.
Public-interest text has a more specific test. Deployers generally must disclose AI generation or manipulation, but the duty does not apply when a human has reviewed the text and a person or organisation assumes editorial responsibility. That distinction rewards accountable editing; merely sending raw output into publication does not meet it.
Disclosures must arrive by the first interaction or exposure. They also need to be clear, distinguishable and accessible. A notice hidden after a conversation or buried in terms and conditions would miss the timing and usability problem the rule is designed to solve.
Compliance depends on roles, timing and evidence
Enforcement is divided among national market-surveillance authorities, the AI Office for systems under its supervision and the European Data Protection Supervisor when an EU institution acts as provider or deployer.
For synthetic-content marking, organisations can use the Code of Practice on Transparency of AI-Generated Content as one path to showing compliance. Those that do not follow the Code must demonstrate adequate alternatives to the relevant authority. The source guidance does not define one exhaustive alternative checklist, so evidence of design choices, testing and limitations will be important.
The other Article 50 duties have no equivalent code-based shortcut. Each organisation must map the system’s function, identify its role in the value chain, select the relevant disclosure and prove that it appears at the right moment. One company may carry both provider and deployer obligations if it builds a system and operates it for users.
Practical preparation should include an inventory of interactive systems and synthetic-media features, ownership for every disclosure, accessibility testing and records of how machine-readable marks survive real distribution. Teams should also document exceptions rather than treating them as informal judgements.
Article 50 gives businesses a clearer reference point, but clarity in law does not remove uncertainty in implementation. Compliance will be demonstrated through the experience delivered to people and the evidence retained behind it—not through a generic “AI-generated” label added at the end of a project.
