AI Transparency Under Article 50: Chatbot Disclosure, Deepfake Labels and Machine-Readable Marking

The high-risk obligations of the EU AI Act moved to December 2027 and August 2028. Article 50 did not move. The European Commission’s FAQ is plain: “Article 50 of the AI Act applies as from 2 August 2026.” Its transparency obligations have been enforceable since then, and in our view they reach far more products than the high-risk regime. That includes any chatbot, any generative feature and any system that produces synthetic images, audio, video or text for people in the EU.

There is one grace period, and it ends on 2 December 2026. It covers only the machine-readable marking of AI-generated content, and only for systems already on the market before 2 August 2026.

This is an engineering-led guide to the EU AI Act Article 50 transparency obligations. It covers who owns each obligation, what the text actually requires, what the Commission’s Code of Practice says about labelling AI-generated content, and how to build disclosure and marking into a product rather than bolting them on. Legal text and Commission guidance are quoted from the sources listed at the end, all checked on 9 October 2026. The engineering recommendations are ours, and nothing here is legal advice.

Provider or Deployer? Who Owns What

Article 50 splits its obligations between two roles, so the first job is to work out which one you hold. The Act defines them in Article 3:

• Provider: a person or body “that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark”.
• Deployer: a person or body “using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity”.

Our reading, for the common case of a software company building on a third-party foundation model: if you build an AI feature into your product and sell that product under your name, you are likely to be the provider of that AI system, even though someone else provides the underlying model. Your customers, using your product in their business, are its deployers. Classification decisions should be confirmed with your legal advisers.

The Commission’s FAQ confirms the split: “Providers must ensure that their AI systems meet the relevant transparency obligations laid down in Articles 50(1), (2) and (5)”. Deployers must inform people about emotion recognition or biometric categorisation and “clearly label deepfakes and AI-generated or manipulated text published on matters of public interest without human review or editorial control”.

Article 50(1): Telling People They Are Talking to AI

The text: “Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use.”

Three engineering points follow.

It is a design obligation on the provider. The provider must design and develop the system so that people are informed. If you supply a conversational capability that your customers embed in their own interfaces, our view is that you should ship the disclosure as part of the component, and not rely on each deployer to remember it.

Timing and form are specified. Under Article 50(5), the information must be given “in a clear and distinguishable manner at the latest at the time of the first interaction or exposure”, and it “shall conform to the applicable accessibility requirements”. A disclosure buried in terms and conditions, or shown only after the third message, does not meet that.

Treat “obvious” narrowly. The exception applies only where AI involvement would be obvious to a reasonably well-informed, observant and circumspect person. Our recommendation is not to rely on it for anything that could be mistaken for a human: a support chat, a voice agent, an email assistant writing in a person’s name.

Practical patterns we recommend:

• A persistent, visible label in the chat interface from the first message, not a dismissible banner.
• A spoken disclosure at the start of a voice interaction, before any substantive exchange.
• An accessible equivalent for screen-reader users, built into the component.
• A configuration option that deployers cannot switch off for the disclosure itself, although they can restyle it.

Article 50(2): Machine-Readable Marking

The text: “Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated.”

The technical solutions must be “effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art”.

There are exceptions. The obligation does not apply “to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof”. A grammar checker or a formatting tool is in a different position from a system that writes a document from a prompt.

The Commission’s FAQ, drawing on its Guidelines on Transparency of AI-Generated Content, adds that certain outputs fall outside the obligation, including “a short sequence of numbers, symbols or letters” and “source code”. It also states that “a narrow exemption of the marking obligation is envisaged for AI systems that generate outputs used in ‘business to business’ or ‘industrial contexts’ (provided the conditions specified in the guidelines are met).” For business software, check those conditions in the guidelines before deciding which outputs to mark.

What the Code of Practice says about marking

The Commission published the final Code of Practice on Transparency of AI-generated Content on 10 June 2026. By the end of July 2026, the Commission reports, about 190 organisations had signed it. The Commission has concluded that the code “adequately covers the obligations provided for in Articles 50(2), (4) and (5)”, but it is explicit that “Adherence to the code does not constitute conclusive evidence of compliance with these obligations.”

The code’s central marking measure is a multi-layered approach. Signatories “will implement a multi-layered marking approach to ensure that the outputs of their generative AI systems are marked with at least two layers of machine-readable marking”. The two layers are:

• Digitally signed metadata. Signatories record in the metadata “whether the content is AI-generated or manipulated”, and “All recorded information will be digitally signed and time-stamped”.
• Imperceptible watermarking. AI-generated or manipulated content is “marked with an imperceptible watermark, with the exception of very short text.” The code covers both watermarking applied after generation and watermarking built into the model.

Text is treated differently: “given that free-form text cannot transport metadata, a single-layer of marking… is considered sufficient”. The code also says that for free-form text longer than 200 tokens, watermarking still needs to be applied.

Two further points from the code matter for planning:

• Fingerprinting or logging is optional and not enough on its own. “Relying on fingerprinting or logging alone is not considered sufficient”.
• Interoperability is unfinished. “At the time of publication of this Code, relevant interoperability standards and/or best practices are yet to be developed, except for digitally signed metadata.” The code expects a watermark-detection interoperability solution by 2 February 2027.

Where C2PA fits: our analysis

The code does not name a specific metadata standard. The Coalition for Content Provenance and Authenticity (C2PA) publishes “an open technical standard for publishers, creators and consumers to establish the origin and edits of digital content”, known as Content Credentials. Version 2.4 of its specification, from April 2026, added an AI disclosure assertion for machine-readable AI transparency information.

Our view is that C2PA Content Credentials is a strong candidate for the digitally signed metadata layer in the media formats it supports. That is our assessment, not the Commission’s. Neither the AI Act nor the code requires C2PA, and you still need a watermarking layer alongside it. Check format support for every output type you generate before you commit.

The 2 December 2026 grace period

The Commission’s FAQ: “A limited grace period is envisaged only for AI systems placed on the market before 2 August 2026 and only as regards the marking and detection obligation for AI-generated content (Article 50(2) of the AI Act). Providers of such systems must comply with those obligations only as from 2 December 2026.” The amended Act puts the same rule in Article 111(4).

Read the limits carefully:

• A generative system first placed on the market on or after 2 August 2026 has had to mark its outputs from launch.
• The grace period does not apply to 50(1) disclosure or to the deployer obligations in 50(3) and 50(4).
• “Content generated prior to 2 August 2026 does not need to be labelled retroactively.”

Article 50(3): Emotion Recognition and Biometric Categorisation

“Deployers of an emotion recognition system or a biometric categorisation system shall inform the natural persons exposed thereto of the operation of the system”, and must process personal data in line with the GDPR and related law. If your product includes either capability, our recommendation is to give your deployers the notice text and the user interface hooks to meet this, because the obligation is theirs but the means are in your product.

Article 50(4): Deepfakes and Published Text

Deepfakes

The Act defines a deep fake as “AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful”. Deployers of a system that generates or manipulates such content “shall disclose that the content has been artificially generated or manipulated.”

For “evidently artistic, creative, satirical, fictional or analogous” work, the obligation is limited to disclosing the existence of the generated content “in an appropriate manner that does not hamper the display or enjoyment of the work.”

The FAQ adds an important clarification: “deployers cannot simply rely on the machine-readable marking embedded in the content by the provider under Article 50(2) … to fulfil their disclosure obligation.” The provider’s invisible watermark does not replace the deployer’s visible label.

AI-generated text on matters of public interest

“Deployers of an AI system that generates or manipulates text which is published with the purpose of informing the public on matters of public interest shall disclose that the text has been artificially generated or manipulated.” The exception is where “the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content.”

The FAQ is clear about what does not count as review: “Superficial, solely formal, or procedural checks (e.g. spell-checking or grammatical correction) are not considered to be human review or editorial control.” And “Editorial responsibility means that a person must hold the ultimate legal responsibility over the publication of the content”.

Where Article 50 Meets Document Workflows

This section is our analysis. Many AI features in business software generate documents: contract drafts, reports, letters and summaries. Article 50 applies to them in specific ways.

• Marking applies to generated text. A feature that drafts a document from a prompt generates synthetic text. Unless an exception applies, the provider must mark it in a machine-readable way. A feature that only corrects grammar or reformats may fall within the “assistive function for standard editing” exception. Draw that line feature by feature, and document why.
• Public-interest publication is narrower than “any document”. The 50(4) text obligation is about text “published with the purpose of informing the public on matters of public interest”. An internal memo is not that. A public report, a press release or a policy statement may be. Where it applies, a documented human editorial review with a named responsible person engages the exception, and the review needs to be real, not a spell-check.
• Keep provenance inside the document. Where a document passes through several hands, record which passages were AI-generated, which model and system produced them, and who reviewed them. Tracked changes with a named author, and an audit trail, are the natural tools. We covered this in AI Document Review with an Audit Trail: Practical Guardrails for Compliance Teams and in Governing AI Agents That Edit Word Documents.

An Engineering Checklist

1. Inventory every AI output in your products: chat, voice, images, audio, video, text and documents. Record whether each system was placed on the market before or after 2 August 2026.
2. Assign the role you hold for each: provider or deployer.
3. Build 50(1) disclosure into the component, shown at first interaction, accessible, and not removable by configuration.
4. Implement marking for each output type: signed metadata and watermarking for media, and watermarking for longer text. For systems on the market before 2 August 2026, finish by 2 December 2026.
5. Give deployers what they need for 50(3) and 50(4): visible labels, notice text, and a way to record human editorial review.
6. Review generative guardrails against the new prohibition on generating non-consensual intimate material and child sexual abuse material, which applies from 2 December 2026.
7. Test and monitor. Verify that marks survive your own processing pipeline, such as resizing, transcoding and format conversion, and that disclosures render on every client.

The cost of getting it wrong is not trivial. The Commission’s FAQ notes that “Fines can reach up to 15 million euros or 3% of total worldwide turnover”.

How McKenna Consultants Can Help

McKenna Consultants is a UK software consultancy, building software since 2004, and an AI governance consultancy that works at the point where regulation becomes engineering. Through our AI First practice we help product teams classify their AI features under Article 50, design disclosure into their user interfaces, implement marking in generation pipelines, and build the review and audit trails that the human-review exception depends on.

If you have a generative feature on the market and the 2 December date is approaching, contact us.

This article is technical guidance, not legal advice. Confirm your obligations under the AI Act with qualified legal counsel.

Sources

All sources checked on 9 October 2026.

• AI Act Service Desk — Article 50: Transparency obligations for providers and deployers of certain AI systems (consolidated text as at 27 July 2026).
• AI Act Service Desk — Article 3: Definitions: provider, deployer, deep fake.
• AI Act Service Desk — Article 111: AI systems already placed on the market: paragraph 4, compliance with Article 50(2) by 2 December 2026.
• European Commission — Transparency obligations under Article 50: FAQ: application date; grace period; provider and deployer duties; outputs outside the marking obligation and the narrow business-to-business and industrial exemption; no retroactive labelling; deepfake labels; human review; fines.
• European Commission — Code of Practice on Transparency of AI-generated Content: final code published 10 June 2026; about 190 signatories by the end of July 2026.
• European Commission — Code of Practice on Transparency of AI-generated Content (PDF): multi-layered marking; signed metadata; watermarking; text; fingerprinting; interoperability.
• European Commission — Commission opinion on the assessment of the Code of Practice: adequacy assessment; adherence not conclusive evidence of compliance.
• European Commission — Enforcement of the AI Act: NCII/CSAM prohibitions from 2 December 2026.
• C2PA — Coalition for Content Provenance and Authenticity and C2PA Technical Specification 2.4: Content Credentials; AI disclosure assertion added April 2026.