Labelling AI output: the Art. 50 duties for product teams

Article 50 of the EU AI Act has applied since 2 August 2026, and it asks product teams to tell users when they are talking to an AI, to mark generated content in a machine-readable way and to label deepfakes and some published text. Only one of those duties has a later date: providers of generative systems already on the market before 2 August 2026 have until 2 December 2026 to comply with the marking duty.

What does Article 50 require, and from when?

The AI Act applies from 2 August 2026 under Article 113, and the Commission's guidelines on Article 50 say that all in-scope systems must comply from that date, whenever they were placed on the market. The four duties in Article 50 split between providers (who build and offer the system) and deployers (who use it).

Two of the duties fall on providers. Under paragraph 1, providers must design systems that interact directly with people so that those people are informed they are dealing with an AI, unless that is obvious to a reasonably well-informed, observant and circumspect person. Under paragraph 2, providers of systems that generate synthetic audio, image, video or text must ensure the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated.

The other two fall on deployers. Under paragraph 3, deployers of emotion recognition or biometric categorisation systems must inform the people exposed to them. Under paragraph 4, deployers must disclose that a deepfake has been artificially generated or manipulated, and they must do the same for AI-generated or manipulated text published to inform the public on matters of public interest. Paragraph 5 adds that the information must be clear, distinguishable, given at the latest at the first interaction or exposure, and accessible.

Which of these duties falls on a product team?

It depends on the role. The guidelines give an example: a company that offers a chatbot or image generator under its own name to users is a provider, whether the product is free or paid. A company that builds such a system for its own use and puts it into service under its own name is a provider too. A company that uses a system under its own authority is a deployer. One organisation can be both.

Those examples do not say whether a product built on a third-party model API makes its maker the provider. Treating it as a provider is our reading, and a lawyer should confirm it.

The guidelines list what counts as direct interaction: chatbots, voice assistants, AI companions, and AI agents that interact with people. They say an agent should disclose both that it is an AI and who it acts for. They place recommender systems, spam filters, translation tools and auto-completion outside paragraph 1.

For paragraph 2, the guidelines place source code, outputs that are single words, captions or alt text, and machine-to-machine output outside the marking duty. A provider may rely on a marking solution from an upstream model provider or a specialist vendor if that solution is compliant, but the guidelines add that this does not remove the provider's own responsibility to show compliance.

What changed for systems already on the market?

Regulation (EU) 2026/1744, the Digital Omnibus on AI, was signed on 8 July 2026 and published in the Official Journal on 24 July 2026. It enters into force on the third day after publication. It adds paragraph 4 to Article 111 of the AI Act: providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text and were placed on the market before 2 August 2026 "shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026".

Three limits apply. The date covers the marking duty in Article 50(2) only, since the Omnibus amends Article 50 in one place, paragraph 7 on codes of practice, and leaves the other paragraphs as they were. A system that is partly interactive and partly generative gets the later date for marking only, because the guidelines say its disclosure duty under paragraph 1 applied from 2 August 2026.

The third limit concerns old content. Content generated before 2 August 2026 does not need to be marked or labelled retroactively. The guidelines add that text generated earlier but published on or after that date does need a label.

A system placed on the market from 2 August 2026 is not covered by the Omnibus wording, which refers to systems placed on the market before that date. We found nothing on whether a major new version of an existing system counts as a new placement.

Do we have to label AI-written text?

Only in a narrow case. Paragraph 4 applies to text that an AI system generated or manipulated and that is published with the purpose of informing the public on matters of public interest. The guidelines read "published" as accessible to an indeterminate, fairly large number of unrelated readers, so private correspondence and internal communications are not published in that sense.

Their examples that need a label include an AI-generated summary of a newspaper article about a council decision and a listed company's AI-manipulated investor report. Examples outside the duty include AI-generated fantasy novels, product descriptions and advertisements without health, safety or sustainability claims, a chatbot's news summary shown only to the person who asked and a consultant's advice to a client.

The duty does not apply if the text has undergone human review or editorial control and a person or organisation holds editorial responsibility for it. The guidelines say a spell-check or a cursory approval does not count, and that an AI change after sign-off voids the exception.

Deepfakes are defined in Article 3(60) as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful. They need a disclosure, with a lighter form where the content is part of an evidently artistic, creative, satirical or fictional work.

What does the Code of Practice add?

The Commission published the final Code of Practice on Transparency of AI-generated Content on 10 June 2026. Section 1 is for providers (marking and detection) and section 2 is for deployers (labelling deepfakes and published text). The Commission's FAQ says adherence is voluntary and the Code adds no obligations beyond the AI Act.

In an opinion dated 8 July 2026, the Commission concluded that the Code adequately covers Article 50(2), (4) and (5), and that providers and deployers may rely on it. The same sentence says that adherence is not conclusive evidence of compliance. The guidelines add that non-signatories are expected to show by other means how they comply, and that commitments under an adequate Code may count as a mitigating factor when a fine is set. The Code does not cover paragraphs 1 or 3.

For marking, the Code asks signatories to use at least two layers of machine-readable marking while no single technique meets the four legal requirements: digitally signed metadata and an imperceptible watermark. For free-form text it treats one layer, the watermark, as sufficient, and it says text longer than 200 tokens needs one. For labels, it asks deployers to use the EU icon, with "AI" as its main element, or an equivalent label, and puts the label for published text at the top of the text or near the headline.

Where to start: a checklist for each AI feature

This section is our addition. It turns the legal text and the guidelines into questions for a feature review. It is an engineering aid, not legal advice.

Begin with interaction. Does a person interact directly with the feature, in a chat, a voice call or an agent that writes to people? If yes, where does it say it is an AI, and is that visible at the first message? If an agent contacts third parties, does it say who it acts for?

Then look at generation and marking. Does the feature generate audio, image, video or text that a person will see or hear? A summary counts, while source code and single words do not. Which part of the marking is yours, and which comes from the model provider? Ask the provider in writing what it marks and how it is detected. Was the system on the market before 2 August 2026? If yes, the marking date is 2 December 2026, and a system shipped after that date needs marking from the start.

Finally, consider publication and presentation. Does any output look like a real person, place or event? Then paragraph 4 on deepfakes may apply to whoever publishes it. Is generated text published to inform the public on a matter of public interest? If so, who reviews it and who holds editorial responsibility? Last, is the label in the interface where people first meet the content, and is it accessible?

We map features to the Act in our AI-native development work and leave the final call to your legal team. Building a new AI tool follows the same steps in AI app development, and how we handle your data is on our security page.

What could happen if we get it wrong?

Under Article 99, breaching the transparency duties of Article 50 can bring fines of up to EUR 15,000,000 or, for a company, up to 3% of total worldwide annual turnover for the preceding financial year, whichever is higher. For SMEs, including start-ups, each fine is capped at the lower of the two, and the Omnibus adds the same cap for small mid-caps in a new Article 99(6a). The guidelines (paragraph 152) repeat these figures.

What we could not confirm

EUR-Lex blocked our automated reading, so we read the Official Journal text of Regulation (EU) 2026/1744 and of the AI Act through the EU Publications Office, which serves the same documents. The Commission's own communication says the guidelines were approved in content on 20 July 2026 and will be formally adopted later, when all language versions exist, and only then become applicable. We did not find a record of that formal adoption.

We found no official statement on whether a major new version of a system placed on the market before 2 August 2026 counts as a new system for the 2 December 2026 date. Whether a product built on a third-party model API makes its maker a provider is our reading, not a quoted rule.