AI Act Article 50: do you have to label AI content and chatbots?

The four duties in Article 50

Article 50 is short. It contains four transparency duties, and each one names who carries it. The Digital Omnibus (Regulation (EU) 2026/1744) moved the high-risk deadlines to December 2027 but left Article 50 on its original date, with one narrow exception for watermarking.

Article 50(5) adds how the information must be given: clearly, in a way people can tell apart from the rest of the content, at the latest at the first interaction or exposure, and in line with accessibility requirements. A disclosure buried in your terms of service does not meet that test.

Provider or deployer: which one are you?

The AI Act uses two roles. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its own authority in a professional context.

Your company is probably a deployer for most of the AI it uses. If your marketing team generates images in a commercial tool, the tool's maker is the provider and your company is the deployer. The picture changes when you build something yourself. A customer service bot that your developers built on a large language model API and launched under your brand is likely to be an AI system you put into service under your own name. If so, you are its provider for Article 50(1), even though someone else trained the model underneath. Base that conclusion on how the system was built, branded and launched, not on the fact that it calls a third-party API.

A bought-in chatbot widget sits in between. The vendor is the provider and should ship the disclosure. You still control the website it runs on, so check that the disclosure appears in your configuration and that a site update or a new chat flow has not switched it off or reworded it.

Chatbots and voice agents: what the disclosure must look like

People must be told they are dealing with an AI system unless that is obvious to a reasonably well-informed, observant and circumspect person, given the circumstances. The obviousness exception is narrower than it sounds. A chat window labelled "Support" with a human first name and a stock photo does not make the AI obvious; it does the opposite.

What works in practice:

• An opening line in the chat, such as "You're chatting with an AI assistant. Type 'agent' to reach a person."
• A persistent label on the chat widget itself, so people who scroll past the greeting still see it.
• For voice agents, a spoken statement at the start of the call, before the caller gives any personal details.
• For AI agents that write and send emails or messages to people on their own and handle the replies, a line in the message that says an AI system sent it. An email that a member of staff drafts with AI and sends themselves is unlikely to fall under Article 50(1).

The Commission's guidelines on Article 50, adopted on 20 July 2026, cover AI agents as well as chatbots. If you are piloting agents that contact customers or suppliers, build the disclosure in now. Adding it after launch means changing message templates that sales and support teams already depend on.

Watermarking and the 2 December 2026 deadline

Article 50(2) requires providers of generative AI systems to mark synthetic audio, images, video and text in a machine-readable format and to make it detectable as AI-generated. The solutions must be effective, interoperable, robust and reliable as far as is technically feasible. Common techniques are metadata such as C2PA content credentials, invisible watermarks, or both. No technique counts as compliant just by being used; what matters is whether the marking meets those tests in practice.

Generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to comply. Systems launched on or after 2 August 2026 had no grace period. The extension covers only the marking duty in Article 50(2), not chatbot disclosure or deepfake labelling.

If you only use generative tools, the marking duty sits with the tool's maker. Two things are still worth doing before December:

• Check whether your image pipeline, CMS or compression tools strip metadata from uploaded files. If they do, they remove the provider's content credentials from images you publish.
• If you fine-tuned or wrapped a generative model into a product your customers use, work out whether you are its provider. If you are, the marking duty is yours and the deadline applies to you.

There are exceptions. Marking is not required where the AI performs an assistive function for standard editing, such as grammar and spelling fixes, or does not substantially alter the input data or its meaning. The Commission reads AI translation as falling under the assistive editing exception.

Deepfakes and AI-written text: the deployer duties

A deepfake, in the Act's definition, is AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful. If you publish one, you must disclose that it was artificially generated or manipulated. The disclosure must be clear to the people who see or hear the content, so content credentials embedded by the tool's provider do not meet it on their own.

For marketing teams this catches more than face swaps. A product video with an AI-generated presenter who looks like a real person, a cloned voice of your managing director reading a company update, or a photorealistic AI image of your office presented as a photo can all fall within the definition. Where the content is part of an evidently artistic, creative, satirical or fictional work, the duty is lighter: you disclose the AI content in a way that does not spoil the work.

AI-generated text has its own rule. If you publish AI-written text to inform the public on matters of public interest, you must disclose it. The duty does not apply where the text has gone through human review or editorial control and a person or organisation holds editorial responsibility for it. The review has to be substantive. The reviewer checks the content, the facts and the sources, and has the authority to change or reject the text. For most company blogs and news pages, that means a named editor who does this for each AI-assisted article before publication. Keep a record of each review as evidence, but a sign-off without a proper read does not meet the test.

Fines, enforcement and the Code of Practice

Breaching Article 50 falls under Article 99(4): fines of up to €15 million or 3% of total worldwide annual turnover, whichever is higher. For SMEs and start-ups, Article 99(6) applies the lower of the two figures instead. These are maximums: under Article 99(7), the authority sets the actual amount based on factors such as the nature, gravity and duration of the breach and the size of the organisation. National market surveillance authorities enforce the rules in each member state.

Two documents help you show compliance. The Commission published the final Code of Practice on marking and labelling AI-generated content on 10 June 2026. It is voluntary and has two parts: marking and detection for providers, and labelling for deployers. The Commission also published EU icons that deployers can use to label AI content. The Commission guidelines on Article 50 followed on 20 July 2026. They are not binding, but they show how regulators will read the duties, including the proportionality carve-outs for some internal business-to-business uses.

What to do before 2 December 2026

1. List every place where AI talks to people on your behalf: website chat, WhatsApp and social messaging bots, phone and voice agents, and AI agents that send emails.
2. For each one, decide whether you are the provider or the deployer and whether Article 50 applies at all. Write the reasoning down, including any exception you rely on.
3. Test each bot as a customer would. Confirm the AI disclosure appears at the start of the conversation and on the widget, and that it is accessible to screen readers.
4. List where your marketing and communications teams publish AI images, video and audio. Agree a labelling standard, using the EU icons if they fit your channels.
5. Set up an editorial review step for AI-assisted articles and press material, with a named editor who checks content, facts and sources and can change or reject the text, and a record of each review.
6. Ask your generative AI vendors how they mark output under Article 50(2) and whether they rely on the 2 December 2026 transition date.
7. Check that your website and document workflows keep content credentials intact.
8. Add Article 50 to your AI governance policy so new AI tools get the same check before launch.

How Cyvra helps with Article 50

Cyvra works with organisations that use AI, not only those that build it. We map where AI meets your customers and staff, decide which Article 50 duties apply, and put the disclosures and review steps in place.

• AI touchpoint inventory: chatbots, voice agents, AI agents and content tools across your business units, including AI features switched on inside software you already use
• Role assessment: provider or deployer for each system, with the reasoning written down in a form a regulator can follow
• Disclosure and labelling standard: wording, placement and accessibility checks for bots, plus a labelling standard for marketing content
• Governance: Article 50 checks built into your AI policy and, where you want it, mapped to ISO 42001

Talk to our AI practice about where your organisation stands on Article 50.