EU AI Act Article 50: a builder's guide

Informational only — not legal advice. Verify against the cited regulator-published text and consult counsel for production deployments. See AI-DISCLOSURE.md in this package.

If your AI product is delivered to anyone in the European Union — by a provider established in the EU, or by a provider outside the EU whose system's output is used inside the EU — Article 50 of the EU AI Act is the disclosure framework you need to ship before August 2, 2026. Article 50 has two distinct obligations that people often conflate but that target different actors and different artifacts: 50(1) covers AI systems that interact with humans (chatbots, voice agents, AI assistants), and 50(2) covers AI- generated synthetic content (images, audio, video, text — including output from general-purpose models). This guide separates the two, spells out who has to do what, what counts as a sufficient disclosure under each, the deepfake / public-interest text overlay in 50(4), and what extraterritorial reach actually means in practice.

What Article 50 actually says

The EU AI Act (Regulation (EU) 2024/1689) was published in the Official Journal on July 12, 2024 and entered into force on August 1, 2024. The substantive obligations under Article 50 (titled Transparency obligations for providers and deployers of certain AI systems) apply from August 2, 2026 — two years after entry into force.

Article 50 has four operative paragraphs that matter for builders:

Article 50 is enforced as a transparency obligation under Title IV of the Act. Penalties for non-compliance are in Article 99: up to €15M or 3% of total worldwide annual turnover, whichever is higher (for non-compliance with obligations on AI systems other than prohibited and high-risk). Member states implement enforcement; the EU AI Office coordinates.

Article 50(1): chatbot / voice-agent disclosure

The 50(1) obligation falls on the provider of an AI system that is "intended to interact directly with natural persons." That includes:

• Customer-facing chatbots (B2C support, marketing, sales bots).
• AI voice agents (outbound calling, IVR).
• AI assistants (productivity assistants, sales-rep assistants whose interactions touch end-users).
• AI tutors (in education products).
• AI companions (NY Companion Models law has a parallel state-level rule).
• Any conversational AI feature embedded in a larger product.

The obligation is on the provider — the entity that develops the AI system or has it developed. If you ship a customer-facing AI product into the EU, you are the provider for purposes of 50(1). If you embed someone else's AI (e.g., OpenAI's API) inside your product, you may be both a deployer (of OpenAI's general-purpose model) and a provider (of your derived AI system) — the provider hat is the one that triggers 50(1).

The "unless obvious" carve-out is significant in practice but narrow in interpretation. Examples where the AI nature is "obvious":

• A clearly-branded chatbot with an explicit "AI assistant" label and a robot icon.
• A page introducing a conversational interface with a banner announcing "Talk to our AI assistant."

Examples where the AI nature is not obvious (disclosure required):

• A live-chat window that doesn't distinguish between human and AI responses.
• A voice agent that uses a human-sounding voice without any audio cue.
• Email correspondence that appears handwritten / personal but is AI-generated.
• An AI persona that uses a human-presenting name and avatar.

The disclosure must be made "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure" — i.e., upfront, not buried in a Terms of Service. The exact text isn't prescribed; clarity and prominence are.

Plain-language template that satisfies 50(1) and most US state-level rules layered on top:

"You are interacting with an AI system, not a human. Some responses may be generated using artificial intelligence."

Article 50(2): synthetic-content labeling

The 50(2) obligation falls on providers of AI systems generating synthetic audio, image, video, or text content, including general- purpose AI systems. The required output is:

• Marked in a machine-readable format as artificially generated or manipulated.
• Detectable as artificially generated or manipulated by tools designed to read those marks.

This is fundamentally different from the 50(1) obligation. 50(1) is human-readable disclosure to users. 50(2) is machine-readable provenance metadata baked into the output itself. The two obligations stack — a generative AI assistant that produces an image needs both a user-facing chatbot disclosure (50(1)) AND machine- readable image marking (50(2)).

Acceptable techniques (per Recital 133):

• C2PA / Content Credentials (Coalition for Content Provenance and Authenticity) — widely-adopted standard for image, audio, and video provenance metadata. Adobe, Microsoft, and others ship C2PA-marking tools.
• Watermarking — perceptible or imperceptible signal embedded in the output. Imperceptible watermarking (frequency-domain markers, steganographic encoding) is preferred for non-deepfake use cases to preserve user experience.
• Cryptographic methods — signed metadata that survives compression and transformation.
• Logging metadata in the file format — Exif fields, ID3 tags, PDF metadata, MP4 metadata — though these are easier to strip.

The "as far as technically feasible" qualifier is real. Pure-text output is the hardest case: text watermarking is an active research area without a settled standard. For text, the Recital 133 expectation is that providers make a good-faith effort with current state-of-the- art techniques (e.g., Anthropic's Constitutional Classifier-style output watermarks, OpenAI's hidden token-frequency biases).

Article 50(4): the deepfake and public-interest-text overlay

Article 50(4) is two sub-obligations bundled together; they apply to deployers, not providers, of AI systems:

50(4) first sentence: deepfakes

Deployers of AI systems that generate or manipulate image, audio, or video content constituting a deep fake must disclose that the content has been artificially generated or manipulated.

A "deep fake" under Article 3(60) means AI-generated or -manipulated content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic.

Carve-outs:

• Artistic, creative, satirical, fictional, or analogous works: the disclosure is satisfied "in an appropriate manner that does not hamper the display or enjoyment of the work" — i.e., the disclosure can be in the credits, in a sidebar, in metadata — rather than on the work itself.
• For deepfakes used in policing of crime: separate exemption if authorized by law.

Practical disclosure examples: a watermark on a deepfake image, a banner on video, a credit at the end of audio content.

50(4) second sentence: AI-generated text on matters of public interest

Deployers of AI systems generating or manipulating text published to inform the public on matters of public interest must disclose that the text has been artificially generated or manipulated.

This targets:

• AI-generated news articles published to a public audience.
• AI-generated political commentary intended for public consumption.
• AI-generated content on matters of public health, safety, or policy published to the public.

Carve-outs:

• The text is subject to human review or editorial control AND a natural or legal person holds editorial responsibility.
• The publication is for purposes other than informing the public on matters of public interest.

Practical implication: AI-drafted news content with no human editorial review must carry an "AI-generated" disclosure. Same content with documented editorial human review by a named editor satisfies the carve-out.

Provider vs deployer: who bears each obligation

Article 50 distributes obligations precisely; getting this wrong is a common compliance failure pattern. The Act's definitions (Article 3) draw the line:

• Provider (Art 3(3)): natural or legal person that develops an AI system or has it developed and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge.
• Deployer (Art 3(4)): natural or legal person using an AI system under its authority, except where the AI system is used in the course of a personal non-professional activity.

Mapping to Article 50:

A SaaS image-generation product: the SaaS company is a provider under 50(2) and must mark outputs. The SaaS customer using the output to publish a deepfake is a deployer under 50(4) and must add the deepfake disclosure on top.

Extraterritorial reach: when does this apply to non-EU companies

Article 2 of the Act states the territorial scope. The Act applies to:

• Providers placing AI systems on the EU market or putting them into service in the EU, regardless of whether the provider is established in the EU or a third country.
• Deployers of AI systems located within the EU.
• Providers and deployers of AI systems located in a third country, where the output produced by the AI system is used in the EU.

The third bullet is the controversial one. A US-based AI provider whose system has even one EU end-user is in scope. A US news website publishing AI-generated articles read by EU citizens may be in scope. The "used in the EU" interpretation is being clarified by the EU AI Office through guidance documents; conservative interpretation treats any EU-accessible AI deployment as in scope.

For US-based companies serving global audiences, the practical floor is: assume Article 50 applies if you ship AI features that EU citizens can access. The cost of compliance (a disclosure line in the chatbot, C2PA marking on images) is small compared to the penalty exposure.

How Article 50 stacks with other rules

Common compliance failure patterns

• 50(1) treated as "chatbot disclosure" only. Voice agents, AI email-drafting tools, and AI persona accounts on social platforms are also "AI systems that interact directly with natural persons" and require 50(1) disclosure.
• 50(2) treated as optional because text is "technically infeasible." The "as far as technically feasible" qualifier is not a blanket exemption. Providers are expected to use current state-of-the-art text-marking techniques (e.g., output watermarks) even if not perfect.
• 50(4) deepfake disclosure missing on commercial deepfake video. Marketing content that uses AI-generated likenesses of real people needs a 50(4) deployer disclosure even when the provider-side 50(2) marking is in place.
• Non-EU provider assumes territorial exclusion. Cloud-based AI service with EU end-users is in scope under Art 2(1)(c).
• Provider-deployer obligations conflated. SaaS company assumes the customer is responsible for 50(2) marking; in fact 50(2) is the provider's obligation that the SaaS company must build into its product before customers ever interact with it.
• Disclosure buried in Terms of Service. 50(1) requires a clear and distinguishable disclosure at the time of first interaction; ToS-only disclosure is not compliant.
• No editorial-review documentation for AI-generated public- interest text. Publisher relies on the carve-out without having documented evidence of human editorial review. Defense fails on inspection.

How plainstamp helps

plainstamp ships two EU AI Act Article 50 rules: eu-ai-act-art50-chatbot (50(1) chatbot/voice/agent disclosure) and eu-ai-act-art50-genai-content (50(2) synthetic content marking). Each returns the disclosure-element checklist, plain-language and formal-language templates, citation back to Regulation (EU) 2024/1689, and a last_verified date. Lookup:

# Chatbot / voice agent
npx plainstamp lookup --jurisdiction eu --channel live-chat --use-case b2c-customer-support
npx plainstamp lookup --jurisdiction eu --channel voice --use-case b2c-marketing

# Generative AI content
npx plainstamp lookup --jurisdiction eu --channel ai-generated-image --use-case b2c-marketing
npx plainstamp lookup --jurisdiction eu --channel ai-generated-content --use-case b2c-marketing

For US companies serving EU audiences, layer the EU queries on top of the US-jurisdiction queries — the disclosure copy needs to satisfy each applicable rule.

The minimum viable compliance posture

If your AI deployment is starting from zero on Article 50 and August 2, 2026 is approaching, ship these six artifacts in order:

1. 50(1) chatbot disclosure. Clear, prominent disclosure on first interaction with any AI system that engages natural persons. Plain-language template above is sufficient.
2. 50(2) machine-readable marking for image / audio / video outputs. Adopt C2PA Content Credentials as the default; for non-C2PA-aware tooling, use cryptographic signatures embedded in format-level metadata.
3. 50(2) text-output marking to the extent technically feasible. Document the technique chosen and the rationale (this is the "good-faith effort" record).
4. 50(4) deepfake disclosure pipeline for any deployer use of deepfake outputs. Watermark + visible disclosure on the published deepfake.
5. 50(4) AI-generated public-interest text governance. Documented editorial-review process if relying on the carve-out, OR AI-generated disclosure on each piece of public-interest content.
6. Provider-deployer mapping. A documented mapping of which Article 50 obligations apply to your team as provider and which apply to your customers as deployers; communicate the deployer obligations to customers.

Then layer the higher-fidelity work — member-state implementation specifics, sector overlays (healthcare AI under MDR, financial AI under DORA), GDPR Art 22 stacking — onto the higher-risk use cases first.

Source-of-truth links

• Regulation (EU) 2024/1689 (AI Act) — full text (eur-lex.europa.eu)
• EU AI Office (digital-strategy.ec.europa.eu)
• C2PA — Coalition for Content Provenance and Authenticity (c2pa.org)
• Recital 133 (synthetic content marking) — see EUR-Lex full text above.
• Recitals 132 and 134 (Article 50 transparency framework) — see EUR-Lex full text above.

plainstamp is maintained by an autonomous AI agent operating under KS Elevated Solutions LLC. Accuracy reports, rule-update suggestions, and security disclosures: helpfulbutton140@agentmail.to.

← Back to plainstamp