Docs

Appearance

Commission guidance on Article 50 transparency obligations ​

The Commission "Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of Regulation (EU) 2024/1689" give the Commission interpretation of Article 50 of the EU AI Act. This page tells which provider or deployer obligation applies to an AI system, which exceptions apply, and how and when to give the information.

Communication to the Commission C(2026) 5054 final of 20 July 2026 approved the content of the Guidelines, which are its Annex. That Communication tells the Commission: "The Guidelines will be formally adopted by the Commission at a later date, when all language versions are available. It is only from that moment that these Guidelines will be applicable." For more information on each Commission text, see Commission guidance.

The Guidelines are non-binding Commission guidance (paragraph (5)). Article 50 applies from 2 August 2026, with a transitional period for Article 50(2) (see Enforcement and application dates).

Providers, deployers and scope ​

Article 50 of the EU AI Act gives obligations to two actors. Providers (Article 3(3)) have the obligations in Article 50(1) and (2). Deployers (Article 3(4)) have the obligations in Article 50(3) and (4). The obligations can apply together to one AI system and its output (paragraph (8) of the Guidelines). For example, the provider of a system that makes images in a direct interaction can have the obligations in Article 50(1) and (2). A deployer of that system can also have the obligation in Article 50(4).

Providers ​

The Guidelines tell providers to include transparency in their interactive or generative AI systems and in the operation of these systems. The provider must comply with the obligations in Article 50(1), (2) and (5) at the latest when the system is placed on the market or put into service. All natural persons who interact with the system, or who are exposed to its outputs in scope, must be informed during its lifecycle. This applies "irrespective of who the deployers or other users of the system are" (paragraph (11)).

An organization can change a generative AI system of a different provider, for example with new training data. When the changed system is then put into service in its name or trademark, the organization becomes the provider of the new system. This is "without prejudice to the responsibility of the provider of the initial AI system for the latter" (paragraph (11)).

Deployers ​

A deployer uses an AI system "under its authority", unless the use is for a personal non-professional activity (Article 3(4)). The Guidelines give this meaning of "authority": "assuming responsibility over the decision to deploy the system and over the manner of the actual use of the system (including its outputs)". Technical control of the system is not necessary (paragraph (12)). The Guidelines give these limits:

  • Personnel and third parties. Where a legal person is the deployer, its personnel who operate on its instructions and with its control are not deployers. Examples are "digital animators, web designers, content creators, journalists". The legal person is the deployer also when third parties (for example "contractors, freelancers") operate the system for it, "under its responsibility and control" (paragraph (14)).
  • Provider and deployer. One organization can be provider and deployer. An organization that develops a generative AI system and uses it to make deep fakes has two obligations. It must do the machine-readable marking in Article 50(2) and the labeling in Article 50(4) (paragraph (15)).
  • Hosting services and broadcasters. Providers of hosting services (for example online platforms) and broadcasters are not deployers when they only disseminate or transmit AI content that third parties made, "without having authority over the use of the AI system". The Guidelines tell them that they are "strongly encouraged to preserve the marking and labelling". Obligations in Regulation (EU) 2022/2065 (Digital Services Act) or in other Union or national law can also apply. An actor that labels content, or uses labeled content, does not become a deployer only because of that (paragraphs (16)–(17)).

Scope of Article 2(1) ​

Article 2(1) of the EU AI Act gives the scope of the Article 50 obligations for each actor:

  • Article 2(1)(a): providers of AI systems that are placed on the market or put into service in the Union, also when these providers are established or located in a third country.
  • Article 2(1)(b): deployers that are established or located in the Union.
  • Article 2(1)(c): providers and deployers that are established or located in a third country, when the output of the AI system is used in the Union.

The Guidelines give this guidance on Article 2(1)(c):

  • Some third-country providers have systems that are not placed on the market or put into service in the Union. For these providers, "incidental, unforeseeable or unauthorised downstream use should not alone trigger the application of the obligations". This is "without prejudice to the powers for competent market surveillance authorities to consider their outputs as non-compliant with the AI Act" (paragraph (10)).
  • A third-country deployer is in scope "where the deployer itself foresees dissemination and use of the AI outputs in the Union". An example is "by directing or authorising distribution within the Union, including by posting deep fakes on the globally accessible internet". But "third country deployers are not bound by the transparency obligations where the content of the AI system reaches audiences in the Union through channels that are unforeseeable and outside their control" (paragraph (13)).

Exclusions and other obligations ​

Article 2 of the EU AI Act gives exclusions from its scope. For Article 50, the Guidelines give this guidance:

  • Purely personal non-professional activity. In Article 2(10), the AI Act does not apply to the obligations of deployers who are natural persons and use AI systems in a purely personal non-professional activity. The system stays in scope for its provider, who must mark the outputs in Article 50(2) also for that use. It also stays in scope for deployers who use it for professional purposes (paragraph (20)). "Any use by natural persons acting on behalf or under the authority of a deployer acting in a professional capacity will fall within the scope of the professional deployer’s transparency obligations" (paragraph (19)).
  • Free and open-source licenses. Article 2(12) is about AI systems released with free and open-source licenses. The AI Act applies to them when they are placed on the market or put into service as an AI system in the scope of Article 50. Their providers and deployers must comply with Article 50 (paragraph (23)). Providers of free and open-source components "that do not constitute in themselves (in part or in whole) an AI system" do not have the Article 50 obligations (paragraph (24)).
  • Scientific research and development. Article 2(6) and (8) give different research exclusions, and the Article 2(8) exclusion does not include real-world testing (Scope of the AI Act).
  • Products in Annex I, Section B. Article 50 does not apply to the high-risk AI systems covered by Article 2(2) (Annex I Section B scope).

Article 50 applies to AI systems, which include general-purpose AI systems. The Guidelines tell providers that "Article 50 AI Act does not explicitly apply to GPAI models" (paragraph (27)). Compliance with Article 50 does not make the use of an AI system or its output lawful. The system can also be prohibited by Article 5 or be high-risk. Article 4 (AI literacy) also applies to its providers and deployers (paragraph (25), and Article 50 transparency).

Article 50(1) — transparency for interactive AI systems ​

Article 50(1) of the EU AI Act applies to providers of AI systems that are intended to interact directly with natural persons. The provider must "design and develop" these systems to make sure that the natural persons concerned are informed that they interact with an AI system. The obligation has two exceptions: interaction that is obvious, and systems authorized by law for law enforcement.

Scope of Article 50(1) ​

The Guidelines give four elements that must all apply (paragraph (30)):

  • An AI system. The system meets the AI system definition in Article 3(1) (The seven elements of Article 3(1)). Systems that are not AI, for example "traditional out-of-office emails, rule-based quick message answers", are not in scope.
  • Intended to interact. The system can do a "bidirectional exchange of information or actions" with a "genuine conversational or responsive character". One input and one output is sufficient, and a person does not have to start the interaction. Systems that "only passively collect data" (for example "automated facial-recognition access controls") or "just collect one-time feedback" (for example "spam filters") do not interact.
  • Directly. The interaction is usually real-time or near real-time. Interaction through a different person is not direct interaction. Examples are a person who uses AI help to write to a person, and a person who disseminates the AI output. The "mere possibility for humans to intervene or review" the outputs "should not be used to circumvent the application" of the obligation. AI outputs that are mixed with content from persons are in scope, and the provider must disclose them. This does not apply if "those AI outputs have been properly reviewed and sent by humans as the main interlocutors with the natural persons".
  • With natural persons. The persons can be deployers, other persons who use the system (also in a purely personal non-professional activity), or persons who use it for them. These are not in scope: systems in a closed physical environment (for example industrial machinery), "backend machine-to-machine calls between AI systems (including AI agents) whose outputs are not intended to reach natural person", and virtual environments "without any direct contact with natural persons".

AI agents. An AI agent is in scope of Article 50(1) when it can interact with natural persons while it does its tasks. These can be the persons who give it instructions or other natural persons. Examples of tasks are "making bookings, managing correspondence, negotiating or concluding contracts, executing purchases". The Guidelines tell providers that such an agent must be designed and developed to disclose its artificial nature and "the person on whose behalf they are acting" (paragraph (31)). The Guidelines also give these recommendations:

  • "Where the provider cannot reliably determine whether the AI agent will directly interact with a natural person before placing the AI agent on the market or putting it into service", the agent "should be designed at the architecture level, and instructed, to disclose itself as such in every situation where it is reasonably likely that the agent may interact with a natural person". This includes the condition "where a natural person may represent or act for a legal entity".
  • The agent "should also disclose themselves, to the persons instructing them at key steps", for example "at the point of authorisation, reporting, validation", "and at every new interaction".

How to give the information ​

The provider makes the method for disclosure part of the system. The information must get to each natural person at the latest at the first interaction. Persons must be informed during the lifecycle of the system (paragraphs (32)–(33)). Article 50(1) does not tell which technique to use. The provider can use text, sound, visual signs, or two or more of these, if these two conditions apply (paragraphs (34)–(37)):

  • The information complies with Article 50(5) (see Article 50(5)).
  • The provider must make sure that the characteristics of vulnerable groups, for example children, the elderly and persons with disabilities, "are taken into account". This applies when the system is intended or reasonably likely to interact with them, for example with the general public. Information for children must be "child-friendly, age-appropriate, easy-to-understand and easily accessible to all children".

The Guidelines give these techniques as not sufficient when the provider uses only one of them (paragraph (38)):

  • Disclosure only in terms and conditions, URLs or documentation. This disclosure can add to the disclosure in the interaction, but cannot replace it.
  • Machine-readable marks, for example metadata or watermarks, that persons cannot perceive at the point of interaction. This does not change their use for Article 50(2).
  • Disclosure that is not clear, for example the general name "assistant", or "human-like representations that may mislead users".
  • "Generalised disclosures that are not sufficiently specific to the AI system’s outputs and interactions", for example "Services on this website use AI" "on a platform providing a variety of services".
  • "Technical or capability-based descriptions", for example "this system uses LLMs", that do not tell the function, the effects on the person, and the artificial source.

"A single, prominent notification" before the first interaction with a person "is likely to suffice in most instances". But "in certain riskier contexts, periodic reminders and context-aware disclosures are likely to be necessary", for example with vulnerable persons or AI companions. Providers "must also design and develop the AI system to ensure disclosure" when it is "being asked questions relating to its nature". This also applies when "it can be reasonably assumed from the exchanges with the natural person" that the person is "likely to be misled or confused" (paragraph (40)).

Exception for obvious interaction ​

The provider must "assess and demonstrate" that the artificial nature of the interaction is obvious (paragraph (42)). The test is a natural person who is reasonably well-informed, observant and circumspect, "taking into account the circumstances and the context of use". The Guidelines use the "average consumer" standard of EU consumer protection law (paragraph (43)). The provider does the "assessment" in two steps (paragraph (44)):

  • First, the provider identifies the audience that the system is intended and reasonably likely to interact with. This includes "a broader potential audience that is reasonably foreseeable", and not only the target audience.
  • Then, the provider examines how reasonably well-informed, observant and circumspect an average member of that audience is. This level is lower when persons with disabilities, the elderly or minors are reasonably likely in the audience. This level can increase when only a professional audience can use the system.

The Guidelines tell providers that the exception "should be interpreted restrictively". "The general awareness of consumers and other natural persons that AI systems (including chatbots and agents) exist does not imply that they recognise them in interactions." When the general public, with vulnerable persons "for whom the interaction is less obvious", can use the system, the exception "cannot be relied upon". The exception applies only when there is "almost no doubt left about the nature of the interaction" for an average member of the audience (paragraph (45)).

The Guidelines give these examples of obvious interaction. Each example applies only with its conditions:

  • AI-powered "code assistance and code review chatbots" that are "available only to professional developers" who have "no reasonable expectation of interacting with a human" and "can easily recognise that suggestions are generated by an AI system".
  • "An internal employee-facing assistant for properly trained staff who is AI literate and aware that they are using AI systems for internal organisational purposes".
  • "Interactions with AI-enabled Non-Playable Characters (NPCs) in a single-player video game where the nature of the video game makes it clear that no other natural person can participate and interact with the user and the AI nature of the interaction is also obvious for all users (including vulnerable persons)".

The Guidelines give these examples of interaction that is not obvious, where the obligation applies:

  • "An AI-powered robotic companion pet, looking highly similar to its natural equivalent".
  • "AI systems embedded in immersive environments (e.g. virtual or augmented reality) using realistic avatars or voices resembling humans", where children, the elderly or persons with disabilities cannot easily see the difference between a person and an AI system.
  • "AI chatbots embedded in online platforms or assistance support tools (helpdesks)" with outputs that persons "may perceive as human-generated".

Exception for law enforcement ​

Article 50(1) does not apply to AI systems authorized by law for the detection, prevention, investigation or prosecution of criminal offenses, subject to "appropriate" safeguards for the rights and freedoms of third parties. This exception does not apply when the system is available for the public to report a criminal offense. The Guidelines give this guidance (paragraphs (46)–(49)):

  • Authorized by law includes Union law, and national law that complies with Union law. The law must give the purposes and conditions of use, and "appropriate" safeguards. It is not necessary for the law to identify the AI system, "where the use of the AI system is generally envisaged within the scope of the legally authorised activity and complies with the applicable legal framework".
  • The purpose of the system must be the detection, prevention, investigation or prosecution of criminal offenses. Other public authorities, not only law enforcement authorities, can use the exception. When the same system is also used for other purposes, the obligation applies to those uses.
  • Systems that the public can use to report criminal offenses stay subject to the obligation. Examples are "AI-enabled police chatbots" for reports, "AI-powered telephone hotlines operated by the police or other law enforcement authority for general public inquiries", "AI-assisted fraud reporting hotlines", and "Virtual assistants used for witness statement collection".

Other Union law ​

Article 50(1) does not replace other information obligations. Union consumer protection law, for example Directive 2005/29/EC and Directive 2011/83/EU, has information obligations. These apply also when an interaction is obvious in Article 50(1). Information obligations in Union data protection law also stay the same (paragraphs (50)–(52)).

Article 50(2) — marking and detection of AI-generated content ​

Article 50(2) of the EU AI Act applies to providers of AI systems, which include general-purpose AI systems, that generate synthetic audio, image, video or text content. These providers must make sure that the outputs are:

  • marked in a machine-readable format
  • detectable as artificially generated or manipulated.

The technical solutions must be "effective, interoperable, robust and reliable" as far as technically feasible. The providers must comply with this condition: "taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art, as may be reflected in relevant technical standards". Three exceptions apply (see Exceptions to Article 50(2)).

Scope of Article 50(2) ​

The Guidelines tell providers that Article 50(2) applies when all of these conditions apply (paragraph (56)):

  • The system is an AI system.
  • The system can generate or manipulate synthetic content. Generation makes new material, for example "a synthetic image or a song". Manipulation changes existing content more than standard editing. Content that mixes AI material with material from persons is also synthetic content (paragraphs (57)–(59)).
  • The content is audio, image, video or text, or multimodal content from two or more of them.
  • No exception applies.

The Guidelines include these outputs in scope (paragraphs (60)–(63)):

  • "3-D images, 3-D videos and 3-D audio, as well as virtual, augmented or mixed reality". The Guidelines include virtual and augmented reality in video content.
  • Digital twins that are AI-generated or manipulated, as audio, image, video or text, unless the industrial rule or the real-time ephemeral rule below applies.
  • Outputs of AI agents that are AI-generated or manipulated content that natural persons can perceive. These are not in scope: "intermediate processing steps such as reasoning and chain of thought", and an "AI-generated action that is not intended to be directly perceived by natural persons", for example "a web request or browser action".

The Guidelines put these outputs out of scope (paragraphs (64)–(68)):

  • "Content generated by an AI system based on simple data processing, which is not specifically AI-generated or manipulated, for example a rendered frame".
  • "music playlists or other recommender systems that only select or rank existing content", and "AI systems used in internal analytical processes that extract and structure data, but do not summarise it".
  • "mere observations and recordings of data from physical or virtual environments, that is not AI-generated or manipulated", and data that AI systems transmit with no change.
  • Short outputs, for example "single words, image captions, alt-text, UI labels and icon-scale graphics", and other data labels.
  • Source code: "content written in a programming, scripting, markup, query or configuration language that is intended to be interpreted, compiled or executed by a computing system".
  • Outputs "intended to be exclusively communicated from machine to machine and processed automatically without any exposure to humans".
  • "Outputs that are only used in closed loop environments in industrial and product development workflows" (for example "film, animation, games or advertising production"). This does not apply to the final output of the AI system as AI-generated or manipulated text, audio, image or video content: "only the final output from workflow stages has to be marked and detectable".

Marking and detection ​

Article 50(2) has two elements that are "distinct, but inherently interlinked". The provider must mark the outputs in a machine-readable format. The provider must also make sure that the outputs are detectable. Only one of the two elements is not sufficient (paragraphs (69)–(70)). The Guidelines give this guidance on each element:

  • Marking. The marks are machine-readable when software can "identify, recognise and extract them without human intervention". Perceptible marks and labels can also help deployers with Article 50(4) (paragraph (71)). The provider can use one technique or two or more, for example "watermarks, metadata identifications, cryptographic methods for proving provenance and authenticity of content, logging methods, fingerprints or other techniques". "providers are not required to record or keep a full provenance chain" (paragraphs (72)–(73)).
  • Marking at different points. The provider can mark at the level of the AI system, at the level of the AI model, or "integrated in the AI system’s inference process". The provider can use the marking solution of an upstream model provider or of a third party, if that solution complies with Article 50(2). "Such reliance is without prejudice to the responsibility of the provider of the AI system to demonstrate compliance with Article 50(2) AI Act" (paragraph (74)).
  • Detection. The provider must make the means of detection available to the persons who can be exposed to the content. The detection must give human-readable results that show if the content is AI-generated or manipulated (paragraph (75)).
  • Interoperable detection. For full interoperability, the provider "must rely on publicly-available industry standard detection solutions", "ideally locally executable on the digital device". Where such standards are not available, the provider can use "its own detection solution or on a third party or shared detection solution" that is interoperable with the solutions of other providers. The Guidelines recommend a time limit for this alternative: "until harmonised standards and a standardised provider-agnostic interoperable detection solution emerge that is secure, privacy-preserving and locally executable" (paragraph (76)).
  • Detection through a different actor. When the provider "depends on another actor for the provision or access to a detection solution", the provider must make sure that the solution complies with Article 50(2) and (5). The provider must also make sure that the actor shows the results as Article 50(5) tells (paragraph (78)).

General-purpose AI models are not in scope of Article 50. But the Guidelines encourage their providers, and providers of other generative AI models, to put transparency measures at the model level. This helps downstream providers of AI systems with Article 50(1) and (2) (paragraph (27), and GPAI models).

Quality of the technical solution ​

Paragraph (79) of the Guidelines gives more information on the four qualities in Article 50(2). For example, robustness includes "common alterations and adversarial attacks", and interoperability applies "regardless of the marking technique(s) deployed by providers of different AI systems".

The marking and detection solutions together must have the four qualities as far as technically feasible (paragraph (80)). "Technical feasibility is an objective notion that is not dependent on the specific resources and capabilities of individual providers." The provider does not have to use a solution that is "not yet developed or available on the market" (paragraph (81)). Providers must adapt their solutions "in a timely and proportionate manner as the technology and state of the art evolves" (paragraph (83)).

The costs of implementation can also be taken into account (paragraph (85)). The Guidelines give three "narrowly defined cases":

  • Physical products. Less robust metadata marking can be sufficient for outputs with "inherently lower risks" from a generative AI system in a physical product. The product operates in a "technically controlled and closed environment that is mainly instructive in nature", for example "an AI system embedded in navigation systems in vehicles". This applies only "to the extent effective technical measures are embedded in the product to prevent the output from leaving the product environment" (paragraph (86)).
  • Industrial applications. This rule is for "industrial AI applications" or "business to business applications", "excluding public and consumer-facing AI systems". No marking and detection is necessary only if all of these conditions apply (paragraph (87)):
    • "The AI system’s generated output is strictly technical in nature", for example "engineering designs, industrial production workflows, technical instructions".
    • The output is "only intended to be perceived and processed by a limited pre-defined number of natural persons acting in a professional capacity within the organisation of the provider and the deployer".
    • The output "must not be intended to be shared outside the company or to be usable by external persons, with appropriate safeguards in place to avoid reasonably foreseeable misuse".
  • Real-time ephemeral content. "Real-time content generation that is ephemeral and consumed immediately, without being recorded, stored or disseminated further" (for example in video games or virtual reality) "may also be exempted". This applies "when marking is not technically feasible and the persons exposed to the content are made aware that the content is AI-generated or manipulated" (paragraph (88)).

Exceptions to Article 50(2) ​

Article 50(2) of the EU AI Act does not apply when one of these exceptions applies (paragraphs (89)–(93) of the Guidelines):

  • Standard editing. The AI system does an assistive function for standard editing. Standard editing is "preparing existing content for publication or distribution" and "does not involve generating new content". Changes are not standard editing when the content is "changed in a material way" that changes its meaning, style or intent (paragraph (90)).
  • The AI system does not substantially change the input data. The AI system does not substantially change the input data that the deployer gives, or its semantics. This is a case-specific "assessment" of "the format, media content type, style and changes in the content that affect its meaning, style or intent". A system can do the two types of change. Then "the transparency obligation under Article 50(2) AI Act will not apply to the content altered in a minor non-substantial manner" (paragraphs (91)–(92)).
  • Law enforcement. The use is authorized by law for the detection, prevention, investigation or prosecution of criminal offenses. The clarifications in paragraphs (46)–(48) of the Guidelines are also "relevant" to this exception (paragraph (93)).

Examples of standard editing and of small changes in the Guidelines include "Grammar correction and spellchecking", "AI-generated translations of text", "Formatting, format conversions, technical compression, noise reduction", "Minor cropping, minor colour adjustments" and "Transcriptions of conversations". Examples of changes that make marking necessary include "AI-generated summaries of text", "face replacement or substantial facial modification", "Synthesis of realistic speech in a specific person's voice" and "generation of realistic video depicting events that did not occur".

Other Union law and the transitional period ​

Marking and detection solutions must comply with Union data protection law. For example, "the information related to the creator of the content should not be processed" for marking and detection (paragraph (94)).

Article 111(4) gives providers of generative AI systems placed on the market before 2 August 2026 until 2 December 2026 to comply with Article 50(2), for marking and detection. Article 50(1) has no transitional period, also for systems that are interactive and generative (Application dates). Outputs that were generated or manipulated before 2 August 2026 "do not need to be marked or labelled retroactively" (paragraph (154)).

Article 50(3) — emotion recognition and biometric categorization ​

Article 50(3) of the EU AI Act applies to deployers of an emotion recognition system or a biometric categorization system. These deployers must tell the natural persons exposed to the system that it operates. Deployers must also "process the personal data" in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable. The obligation applies "regardless of whether the persons are exposed to such systems in real-time or those systems are operated ex post" (paragraph (100) of the Guidelines).

Systems in scope of Article 50(3) ​

  • Emotion recognition system. Article 3(39) gives this definition: "an AI system for the purpose of identifying or inferring emotions or intentions of natural persons on the basis of their biometric data". Article 5(1)(f) prohibits emotion recognition in the workplace and in education institutions, unless it is "for medical or safety reasons" (Article 5(1)(f)). Annex III, point 1(c), includes emotion recognition systems "in so far as their use is permitted under relevant Union or national law". Such systems are high-risk unless Article 6(3) applies. The Guidelines tell deployers to apply Article 50(3) together with the high-risk requirements (paragraphs (101)–(102)).
  • Biometric categorization system. Article 3(40) gives this definition: "an AI system for the purpose of assigning natural persons to specific categories on the basis of their biometric data, unless it is ancillary to another commercial service and strictly necessary for objective technical reasons". Article 50(3) applies to all biometric categorization systems that are not "prohibited" by Article 5(1)(g) (Article 5(1)(g)). Examples are "age or gender classification based on biometric data". This applies to high-risk systems and to systems that are not high-risk (paragraphs (103)–(104)).

The Guidelines tell deployers that the text and examples in the Commission guidelines on the classification of high-risk AI systems "are equally relevant in the context of Article 50(3) AI Act" (paragraphs (101) and (103)). These classification guidelines are a draft (Commission guidance).

Information for Article 50(3) ​

The Guidelines give this guidance on the Article 50(3) information (paragraphs (105)–(108)):

  • Content. Deployers tell the persons that they are exposed to an emotion recognition system or a biometric categorization system that operates. "The AI Act does not require including information about the reasons for the system’s operation", or about other purposes of the processing. Union data protection law can make that information necessary.
  • Persons. Deployers tell all natural persons exposed to the system that it operates. These persons include children.
  • Method. The AI Act does not give a method, but the Article 50(5) conditions apply. The method can change with the location, the persons, the type and length of the exposure, and the relation with the persons. The information can be "in writing, by standardised icons (also when presented electronically), orally, or by using combinations of such ways".
  • Time. The information must be given at the latest at the first interaction or exposure. Information before that time is permitted.

Exception for law enforcement ​

Article 50(3) does not apply to AI systems for biometric categorization and emotion recognition that are permitted by law for the detection, prevention or investigation of criminal offenses. This exception is subject to "appropriate" safeguards for the rights and freedoms of third parties, and must be in accordance with Union law. The text of this exception does not include "prosecute", but the other Article 50 exceptions include it. The Guidelines tell deployers: "While the other exceptions in Article 50 AI Act require an explicit law authorising the non-transparent use of the AI systems", Article 50(3) "makes such use possible when permitted under the legal rules governing the powers of law enforcement authorities", subject to "appropriate" safeguards (paragraph (109)).

Other law for Article 50(3) ​

The Article 50(3) information does not make the use of the system lawful. It does not make lawful a use that Article 5 or other Union law prohibits. Deployers must give the Article 50(3) information and also the information that Union data protection law makes necessary. They can put the two together (paragraph (110)).

Article 50(4) — deepfakes and public-interest text ​

Article 50(4) of the EU AI Act gives deployers two different obligations:

  • Deployers of an AI system that generates or manipulates image, audio or video content that is a deep fake must disclose that the content is artificially generated or manipulated.
  • Deployers of an AI system that generates or manipulates text that is published to "inform the public" on matters of public interest must disclose that the text is artificially generated or manipulated.

The content can be published by a person or by a different system. The two obligations apply together with the marking and detection that Article 50(2) gives to providers (paragraph (111) of the Guidelines). The obligations apply to deployers who use the AI system for professional purposes (paragraph (112), and Exclusions and other obligations).

Deepfakes (Section 6.1) ​

Article 3(60) of the EU AI Act gives this definition of a deep fake: "AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful". The Guidelines examine four criteria that must all apply (paragraph (113)):

  • Resemblance. The resemblance must be "appreciable" (Recital 134). There must be "a high level of similarity between the deep fake content and the subject". The content does not have to be the same as the subject. The deployer makes a "case-by-case assessment", with "an objective comparison between the simulated subject and the deep fake content".
  • Existing. It is sufficient that the subject "exists, can plausibly exist or could have plausibly existed in reality". Subjects that "defy the laws of nature or physics" and "have no potential to mislead" are not realistic and are not in scope.
  • Persons, objects, places, entities or events. The Guidelines use realistic subjects for each of these five categories. Persons include "digital replicas of real persons" and "realistic AI-generated human avatars".
  • False appearance. The content can deceive or mislead a person about its authenticity or its truthfulness. Authenticity is about the source of the content and how it was made. Truthfulness is about "the veracity of the content".

The Guidelines give this guidance on the "assessment" (paragraphs (114)–(116)):

  • The "assessment" of false appearance examines all of the content. It examines the resemblance, "the potential substantive message of the content", the deployment context, the environment, and the intended and reasonably foreseeable audience. "This assessment is objective and does not require the intention of the deployer to deceive or mislead".
  • When "the intended and reasonably foreseeable audience does not expect content to be authentic or truthful", the content "may not falsely appear to be authentic or truthful". If the content does not "falsely appear to be authentic or truthful", the false appearance criterion is not fulfilled. For example, AI "background scenes, special effects" in "standard movie production processes" are "not likely" to make a deep fake. AI for "essential elements that impact audience perception", for example "fully AI-generated actors, digital replicas of real or deceased actors, de-aging", is "likely" to make a deep fake.
  • "a high degree of photorealism renders it more likely that such content should be considered a deep fake", but "photorealism alone is not determinative".
  • For this "assessment", the Guidelines do not use the "average" person of Article 50(1). They recommend that deployers "take into account the possible diverse composition of the reasonably foreseeable audience". When it is reasonably foreseeable that children, the elderly or persons with lower digital and AI literacy see the content, false appearance to that part of the audience can be sufficient. But "deployers are not expected to consider potential further dissemination of the deep fake content by third parties beyond the reasonably foreseeable audience".
  • "AI-supported manipulation of insignificant substantive or technical aspects of pre-existing content" can be "of minor relevance" and then does not make a deep fake. Examples are "lighting adjustments" and "colour correction". This "depends on the context and the impact on the persons’ perception of the content’s authenticity or truthfulness in the specific case". But "substantial AI-powered editing of background details of journalistic images beyond standard technical, editorial practices" can change how persons see the authenticity of the content.

Examples in the Guidelines of content that is not a deep fake are an "AI-generated image of a scene involving a sphinx flying over the Eiffel Tower", and an "AI-generated video of mice arguing in human language over the best type of cheese".

Disclosure. The disclosure must be clear and perceivable to natural persons, for example "with visible or audible labels", "without them needing to rely on any specific technical tools or performing dedicated actions". Deployers cannot use the machine-readable marks of the provider from Article 50(2) for this obligation (paragraph (117)).

Artistic, creative, satirical, fictional or analogous works. The content can be part of an "evidently artistic, creative, satirical, fictional or analogous work or programme". Then Article 50(4) limits the obligation "to disclosure of the existence of such generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work". The Guidelines give this guidance (paragraphs (119)–(124)):

  • The obligation stays. The deployer must disclose in an "appropriate" manner, and must comply with Article 50(5).
  • The deployer makes a "case-by-case assessment" of the content. The category "should be evident to the natural persons exposed to it", and "the categories should be interpreted strictly". "Content whose nature is potentially unclear or ambiguous to the audience is excluded from the scope of this lighter transparency regime."
  • Content that is "exclusively informative or commercial and is recognisable as such (e.g. news reporting)" is not in these categories. "some kinds of content (e.g. advertisements or documentaries) containing deep fakes might be regarded as evidently creative or fictional works in certain, specific situations, but not in others".
  • "When the deep fake combines multiple characters (e.g. informative and creative)", "the informative character should always prevail", and the standard labeling applies.
  • The attenuated transparency obligation "cannot be a justification for failing to respect the fundamental rights of individuals or rightsholders under Union law on intellectual property or Union data protection law".

Law enforcement. The deep fake obligation does not apply where the use is authorized by law for the detection, prevention, investigation or prosecution of criminal offenses. The clarifications in paragraphs (46)–(48) of the Guidelines are also "relevant" to this exception (paragraph (125)).

Other law. The deep fake obligation applies together with Article 35(1)(k) of the Digital Services Act. That provision is about measures of very large online platforms and "search engines". A deployer can use the labeling tools that these providers give for its obligation there. The obligation stays with the deployer (paragraph (126)).

Deployers must also comply with Union data protection law, intellectual property law and personality rights. Disclosure does not make an unlawful deep fake lawful (paragraphs (127)–(129)).

Content made before 2 August 2026. Deep fakes that were generated or manipulated before 2 August 2026 "do not need to be marked or labelled retroactively". The Guidelines encourage deployers and other actors who have or disseminate such content to add a disclosure, "without being expected to engage in disproportionate efforts to that end" (paragraph (154)).

Public-interest text (Section 6.2) ​

The text obligation in Article 50(4) of the EU AI Act applies to deployers when all three elements apply (paragraph (131) of the Guidelines):

  • Published. The text is "accessible by an indeterminate, fairly large number of unrelated, potential readers simultaneously and/or successively, whether or not against payment". Text is not published when access is "restricted to specific individuals belonging to a closed, private group". "private, interpersonal correspondence (for professional purposes), or organisation-internal texts or communications" are also not published.
  • To "inform the public". The text must "intend to communicate knowledge, opinions or facts". "short texts which do not materially communicate knowledge, opinions or facts, cannot be deemed to inform the public".
  • On matters of public interest. Matters of public interest are "relevant to society at large, whether at a local, national, Union or international level, and meriting public debate or scrutiny". Examples are "politics and democratic processes, public administration and services, the administration of justice and law enforcement, the protection of fundamental rights, public security, public health, environmental protection, consumer safety", and more in paragraph (131).

An example in scope is an "AI-generated summary of a human-authored article on a newspaper’s website discussing a recent decision by a town council". Examples that are not in scope are "AI-generated fantasy novels" and a "News summary generated by a chatbot that is only available to the user that prompted the chatbot".

Disclosure. The disclosure must be clear and perceivable to natural persons, without technical tools (paragraph (132)).

Exception for human review or editorial control. The obligation does not apply when these two conditions apply (paragraphs (133)–(138)):

  • Human review or editorial control. Human review is a "deliberate examination of the substance of the content by one or more natural persons possessing relevant knowledge and professional judgement pertaining to the subject matter under scrutiny". "Fact-checking the accuracy of the content is a minimum requirement that should be part of that review." Editorial control is "the control exercised in practice by a responsible editorial entity (e.g. an editor-in-chief) over the content having the authority to approve, alter or reject the substance of the text based on substantive grounds". These are not sufficient for this condition: "Superficial, solely formal or procedural checks (e.g. spell-checking or grammatical correction), the mere existence of an editorial policy, automated review processes or cursory editorial approval without substantive engagement".
  • Editorial responsibility. A natural or legal person holds editorial responsibility for the publication. This is the "ultimate legal responsibility over the publication of the content, including the human review or editorial control". The Guidelines recommend that "the identity and contact details of the legal person, the natural person or the function with editorial responsibility should be made publicly available on an easily findable location".

"Where AI systems are used to modify, supplement, or reformulate content following editorial sign-off, the resulting content must be treated as AI-generated or manipulated". "Any substantive AI intervention occurring after the human review or editorial control process has taken place will therefore cause the exception to become void" (paragraph (136)). The Guidelines tell deployers that editorial responsibility in Article 50(4) "should therefore be interpreted in line with the existing media acquis", which includes Article 2(8) of Regulation (EU) 2024/1083 (European Media Freedom Act). But "it remains a distinct concept that may also apply in broader contexts and to other deployers". "Media service providers may rely on their existing editorial processes and standards to benefit from the exception" (paragraph (140)).

Law enforcement. The text obligation also does not apply where the use is authorized by law for the detection, prevention, investigation or prosecution of criminal offenses. The clarifications in paragraphs (46)–(48) of the Guidelines are also "relevant" to this exception (paragraph (139)).

Text made before 2 August 2026. Text that was generated or manipulated, and published, before 2 August 2026 does not have to be labeled. Text that was generated or manipulated before 2 August 2026 but is published on or after that date must be labeled (paragraph (154)). The two exceptions above also apply to this text (Article 50(4), second subparagraph).

Article 50(5) — How and when to give the information ​

Article 50(5) of the EU AI Act applies to the information in Article 50(1) to (4). Providers and deployers must give it to the natural persons concerned in a clear and distinguishable manner, at the latest at the time of the first interaction or exposure. The information must conform to the applicable accessibility requirements. The Guidelines give this guidance (paragraphs (141)–(144)):

  • Clear. The information is "noticeable, easy to understand by and accessible for the natural person concerned (including persons with disabilities)".
  • Distinguishable. The information is "easy to identify as separate from other information and the environment in which the content is presented". Information that persons can easily overlook or miss "under normal exposure or interaction conditions" is not clear and distinguishable, for example information "only included as part of a manual or hidden under layers of menu options on an online interface, part of terms of use that are often not read by users".
  • Each person. The first interaction or exposure is that of each natural person, not only of the first person.
  • Interactive systems. The Guidelines recommend that the information "at least, be provided once at the start of an interactive session".
  • Content in Article 50(2) and (4). The information applies to each output and to each exposed person. Information before the first exposure is permitted. But "if it is reasonably foreseeable that persons may not perceive content from its beginning, then only disclosure at the beginning of content does not adequately inform those persons and should be complemented with disclosure at later moments, where possible".
  • Detection results. For Article 50(2), the information is the result of the detection. The first exposure is "the moment at which natural persons are willing to verify the origin of a specific piece of content and access the detection solution to obtain the detection results" (paragraph (77)).
  • Accessibility. Providers and deployers check if accessibility rules apply, for example Directive (EU) 2016/2102 or Directive (EU) 2019/882. If they apply, the information must comply with them. "Article 50 AI Act does not impose distinct or additional accessibility requirements."

Code of Practice ​

Article 50(7) of the EU AI Act tells the Commission to encourage codes of practice. These codes are for the detection, marking and labeling of artificially generated or manipulated content. The Commission, "taking utmost account of the opinion of the Board", assesses if adherence to a code is "adequate" for Article 50(2) and (4). It uses the procedure in Article 56(6).

The Commission gives 10 June 2026 as the date of publication of the Code of Practice on Transparency of AI-Generated Content. In its Opinion C(2026) 4839 final of 8 July 2026, the Commission found that the Code "adequately covers the obligations provided for in Articles 50(2), (4) and (5) AI Act". The AI Board adopted its "adequacy assessment" on 9 July 2026. Adherence to the Code is voluntary. An "adequate" code is not a harmonized standard. It gives no Article 40 presumption of conformity (Regulation (EU) 2026/1744, recital 41).

The Commission Opinion tells providers and deployers that "adherence to the Code does not constitute conclusive evidence of compliance with these obligations".

The Guidelines give this guidance on the Code (paragraphs (146)–(150)):

  • Providers and deployers in scope of Article 50(2) and (4) can show compliance by adherence to a code assessed as "adequate". The Code does not replace the AI Act or the Guidelines.
  • Providers and deployers can also show compliance by other "adequate" means. For signatories, the Commission and market surveillance authorities examine if they have adhered to the Code. A signatory that opts out of a Code section loses the benefit of using that section to help demonstrate compliance.
  • Providers and deployers that are not signatories "are expected to demonstrate how they have complied with their obligations under Article 50(2), (4) and (5) AI Act through other adequate means". They are also "expected to explain how the measures they implement ensure compliance", and the Guidelines recommend a gap analysis against an "adequate" code. Authorities "will likely need more detailed information when monitoring for compliance", for example with "a larger number of requests for information and requests for access". This is Commission guidance, not an obligation in the AI Act.
  • Competent authorities can use "commitments implemented in line with a code of practice that is deemed adequate" "as a mitigating factor when fixing the amount of fines", "depending on the specific circumstances".
  • If the Commission deems a code inadequate, Article 50(7) permits an implementing act with "common rules" for the obligations in Article 50(2) and (4). Paragraph (150) of the Guidelines also names Article 50(5).

Enforcement and application dates ​

Competent national and Union authorities enforce Article 50 of the EU AI Act (Enforcement and penalties).

Providers and deployers must comply from the applicable dates, with an Article 111(4) transitional period for specified providers subject to Article 50(2) (Application dates).

Use Modulos ​

In Modulos, the EU AI Act Frameworks are OFF-1 at the Organization level and MFF-1 at the AI System level. The page Operationalizing the EU AI Act in Modulos gives the Requirement table and the steps to set up the Frameworks.

Sources ​

  • Regulation (EU) 2024/1689 (EU AI Act), consolidated version of 27 July 2026: Articles 2, 3(3), 3(4), 3(39), 3(40), 3(60), 50, 85, 99, 100(3) and 111(4). Also Annex III, point 1(c). EUR-Lex.
  • Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal of 24 July 2026: recital 41, and Article 1(39) on Article 111(4). EUR-Lex.
  • Communication to the Commission C(2026) 5054 final, 20 July 2026: approval of the content of the draft Guidelines. Commission.
  • Guidelines, Annex to C(2026) 5054 final: paragraphs (5), (8) and (10) to (154). Commission. Guidelines page.
  • Code of Practice on Transparency of AI-Generated Content, 10 June 2026. Commission.
  • The Commission Opinion C(2026) 4839 final of 8 July 2026, on the "assessment" of the Code. The AI Board "adequacy assessment" of 9 July 2026. PDF of the Commission Opinion. PDF of the AI Board document.

Disclaimer

This page gives general information. It is not legal advice.