What does EU AI Act Article 50 require?

Four transparency duties. Chatbots must tell people they are interacting with AI unless that is obvious. Providers of generative AI must mark outputs in a machine-readable format. Deployers of emotion recognition or biometric categorization must inform the people exposed. Deployers must disclose deepfakes and AI-generated text published on matters of public interest.

Who must comply with Article 50?

Both providers and deployers. Providers must design chatbots to tell people they're talking to AI and must mark generated outputs. Deployers must disclose deepfakes, AI-written public-interest text, and emotion recognition or biometric categorization. A company running a chatbot for EU customer support must make sure users are told it's AI unless that's obvious.

Are there exemptions to Article 50?

Yes. Uses authorized by law to detect, prevent, investigate or prosecute criminal offences are largely exempt. For evidently artistic, creative, satirical or fictional work, deepfake disclosure is limited to flagging that generated content exists, in a way that doesn't spoil the work. AI text reviewed by humans under editorial responsibility is also exempt.

What technical standards apply to Article 50 watermarking?

The AI Act names no standard. The Code of Practice on Transparency of AI-generated Content, published June 10, 2026, asks signatories for at least two marking layers, digitally signed metadata plus an imperceptible watermark, and a watermark alone for free-form text. It names no specific standard such as C2PA.

EU AI Act Article 50: Chatbot and Deepfake Disclosure

Image: Unsplash.

Correction (October 13, 2026) - EU Digital Omnibus: The Omnibus did not split the Article 50 deadlines. All Article 50 duties apply from August 2, 2026. The only transition: providers of generative systems placed on the market before August 2, 2026 have until December 2, 2026 to meet the Article 50(2) machine-readable marking duty. Chatbots must tell people they're interacting with AI unless that's obvious, not only when asked. An earlier version of this guide said otherwise. Full Omnibus details

Correction (October 19, 2026): The FAQ answer on what Article 50 requires said deployers must label all AI-generated images, audio, video and text, and that deployers mark deepfakes. Machine-readable marking is a provider duty under Article 50(2); deployers disclose deepfakes and public-interest text under Article 50(4).

Correction (October 19, 2026, second update): This guide said the "GPAI Code of Practice (finalized June 2026)" names C2PA as an acceptable watermarking standard. The code finalized on June 10, 2026 is the Code of Practice on Transparency of AI-generated Content, a separate document from the GPAI code of July 2025, and it names no specific standard; it asks for signed metadata plus an imperceptible watermark. The guide also listed hiring and HR emotion analysis as an Article 50(3) disclosure case: emotion recognition at work and in recruitment is banned under Article 5(1)(f). We also removed an "authorized testing" exemption that Article 50 does not contain, and corrected Obligation 1, which put marking on deployers.

Article 50 splits the work. Providers build chatbot disclosure and machine-readable marking into their systems; deployers, the companies that use those systems, disclose deepfakes, AI-written text on matters of public interest, and emotion recognition or biometric categorisation. If you use an AI image generator for marketing, the generator's provider marks the files; you have to disclose only when an image is a deepfake.

The four Article 50 obligations

Obligation 1: Machine-readable marking (providers)

Article 50(2) requires providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text to ensure the outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated". The technical solutions must be effective, interoperable, robust and reliable as far as technically feasible.

This is a provider duty. A deployer that only uses a generator doesn't mark files itself, but it should check that its provider does: the visible labelling duties in Obligation 2 sit with the deployer.

Providers of generative systems placed on the market before August 2, 2026 have until December 2, 2026 for this duty (Article 111(4)). How to mark is covered under "Technical standards" below.

A visitor walking past a row of national flags in the lobby of the European Parliament, representing EU AI Act Article 50 watermarking deepfake disclosure

Image: Pexels, used under the Pexels License.

Obligation 2: Disclose deepfakes (deployers)

Article 50(4) requires deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake to "disclose that the content has been artificially generated or manipulated". Article 3(60) defines a deep fake as content that "resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful", so it covers more than fake people.

Under Article 50(5) the information must be given "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure". The Commission has published a set of EU icons deployers may use as labels.

For evidently artistic, creative, satirical or fictional work, the duty is limited to disclosing that generated or manipulated content exists, in a way that doesn't spoil the work.

Non-consensual intimate deepfakes are a separate matter: from December 2, 2026, Article 5(1)(ba) bans AI systems that generate realistic sexual images of an identifiable person without explicit consent. No label makes that use lawful.

Obligation 3: Disclose emotion recognition and biometric categorization

Article 50(3) requires deployers of an emotion recognition system or a biometric categorisation system to inform the people exposed to it, and to process their personal data under the GDPR.

It does not cover the workplace or schools, because there emotion recognition is banned. Article 5(1)(f) prohibits inferring emotions of a person in the areas of workplace and education institutions, except for medical or safety reasons, and the Commission's guidelines on prohibited practices say "Using emotion recognition AI systems during the recruitment process is prohibited." A video interview tool that scores candidates' emotions is not a disclosure case: you stop using it.

Where Article 50(3) does apply:

Retail or customer-service tools that infer customers' emotions (the guidelines give a call centre tracking customers' anger as an example that is not prohibited)
Biometric categorisation systems that are not prohibited under Article 5(1)(g)

The information must reach people at the latest at the first exposure (Article 50(5)).

Obligation 4: Chatbot disclosure

AI systems designed to interact directly with people must be built so those people are told they're interacting with an AI system, unless that's obvious from the point of view of a reasonably well-informed person. This duty sits with the provider, and the information must be given at the latest at the first interaction.

Waiting until a user asks isn't enough. We'd also test every customer-facing bot with the question "Are you a human?": a bot that answers yes leaves the person uninformed, which is the opposite of what Article 50(1) asks for.

Does Article 50 apply to you?

Use this decision table:

If your company...	Article 50 applies?
Generates AI images for marketing shown to EU consumers	Only if an image is a deepfake (Obligation 2); marking is the generator provider's duty (Obligation 1)
Runs an AI chatbot for EU customer support	Yes (Obligation 4, a provider duty: check your vendor or your own build)
Uses AI video dubbing or voice cloning with real people's voices	Yes (Obligation 2, if the result would falsely appear authentic)
Uses AI to analyze emotional signals in job interviews	No: prohibited under Article 5(1)(f), not a disclosure case
Uses AI internally to analyze internal documents (not shown to users)	No
Uses AI code generation tools for internal development	No
Offers an AI product to EU businesses (not consumers)	Possibly yes, if EU business employees interact with the AI system
Develops a GPAI model and provides API access to others	GPAI duties (Articles 53-55); Article 50(2) if you also offer a generative AI system

If you are a GPAI model provider, Articles 53-55 and the Code of Practice add duties, but Article 50(2) also applies to you directly: providers of AI systems, including general-purpose AI systems, that generate synthetic content must mark outputs in a machine-readable format.

Technical standards for watermarking

European Commission page on the Code of Practice on Transparency of AI-generated Content: Article 50 duties apply from 2 August 2026, adherence to the code is voluntary, and the Commission and the AI Board have confirmed the code is an adequate voluntary tool to demonstrate compliance

Screenshot: "Code of Practice on Transparency of AI-generated Content", European Commission, Shaping Europe's digital future (taken October 19, 2026).

The AI Act names no watermarking standard. The Commission's Code of Practice on Transparency of AI-generated Content, published as final on June 10, 2026, is the practical benchmark. It is voluntary, and the Commission and the AI Board have confirmed it is an adequate tool to show compliance with Article 50. It is a different document from the General-Purpose AI Code of Practice of July 2025. What it asks of signatories that provide generative systems:

At least two marking layers. For audio, images, video and containerised text: digitally signed, time-stamped metadata recording that the content is AI-generated or manipulated, plus an imperceptible watermark embedded in the content.

Text. Free-form text can't carry metadata, so a watermark alone is enough; text longer than 200 tokens must still be watermarked.

Measure 1.1 of the Code of Practice on Transparency of AI-generated Content: signatories mark outputs with at least two layers of machine-readable marking, and a single layer is enough for free-form text, which cannot transport metadata

Screenshot: Code of Practice on Transparency of AI-generated Content, Measure 1.1, European Commission (June 2026).

Optional extras. Fingerprinting or logging, and perceptible marks.

Interoperability. The Code says interoperability standards are "yet to be developed, except for digitally signed metadata", so in the first stage signatories adopt established standards or best practices for metadata marking. It names no specific standard, C2PA included.

Practical reality: Marking is a provider duty under Article 50(2), so a deployer checks it rather than builds it. If you deploy a generator, ask your provider which marking layers it applies and whether it signed the Code; about 190 organisations had signed by the end of July 2026, per the Commission.

8-step compliance checklist

August 2, 2026 deadline: All steps. December 2, 2026 deadline: Only for machine-readable marking (Step 2) on generative systems placed on the market before August 2, 2026.

Step 1: Inventory your AI systems that interact with EU users List every AI system your company deploys that EU users interact with or that generates content shown to EU users. Note which obligation applies to each (Obligations 1-4).

Step 2: Ask your AI providers how they mark outputs For each AI image, video, audio or text generator you use, ask which machine-readable marking it applies (signed metadata, watermark) and whether the provider signed the transparency Code of Practice.

Step 3: Add visible labels where the deployer duty applies Label deepfakes, and AI-generated or manipulated text published to inform the public on matters of public interest unless it went through human review under editorial responsibility. The label must be clear and present at the first exposure.

Step 4: Review your chatbot configuration for denial-of-nature responses Check whether your customer-facing chatbots can tell users they are human. Disable any such response paths. Test with the direct question: "Are you an AI?"

Step 5: Review deepfake use cases If you use AI voice cloning, AI face synthesis, or AI video manipulation with real people's content, map each use to the artistic or satirical carve-out or add the disclosure. Sexual deepfakes of identifiable people without explicit consent are banned from December 2, 2026 (Article 5(1)(ba)).

Step 6: Audit biometric and emotion recognition tools Remove any emotion recognition used on staff, candidates or students (Article 5(1)(f)). For customer-facing tools that infer emotions or categorise people biometrically, add the Article 50(3) notice.

Step 7: Update your privacy policy and terms of service Add a section on AI-generated content and disclosure practices. Reference the Article 50 obligations where relevant.

Step 8: Document your compliance approach Prepare written documentation of what you implemented for each obligation. National market surveillance authorities enforce Article 50; with some exceptions, the AI Office does so for AI systems built on a general-purpose model by the same provider. Having it ready in advance is significantly better than reconstructing it afterward.

What the exemptions actually cover

Article 50 sets these exemptions:

Criminal law enforcement: uses authorised by law to detect, prevent, investigate or prosecute criminal offences, subject to safeguards, are exempt from the chatbot, marking and deepfake duties (and from the emotion recognition notice where permitted by law for those purposes). This does not cover commercial use.

Artistic, satire, and parody: For evidently artistic, creative, satirical or fictional work, the deepfake duty is limited to disclosing that generated or manipulated content exists, in a way that doesn't spoil the work. Some disclosure is still required.

Edited text: AI-generated text on matters of public interest needs no disclosure if it has undergone human review or editorial control and a person holds editorial responsibility for the publication.

Assistive and minor edits: the marking duty in Article 50(2) does not apply where the AI system performs an assistive function for standard editing or does not substantially alter the input data.

These exemptions are narrow. When in doubt, label.