Key takeaways
- The transparency and labeling obligations in Article 50 of the EU AI Act have applied since August 2, 2026, in every EU member state. The Digital Omnibus, Regulation (EU) 2026/1744, did not postpone them.
- The Omnibus postponed the high-risk obligations instead: to December 2, 2027, for Annex III systems and to August 2, 2028, for Annex I systems.
- Most companies are deployers. They must disclose deepfakes and AI-generated text on matters of public interest (Art. 50(4)), at the latest when people first see the content.
- A company that builds a chatbot on a third-party model and runs it under its own brand on its website is usually the provider of that chatbot, and must tell users they are talking to an AI (Art. 50(1)).
- December 2, 2026, only ends the grace period for machine-readable marking by providers of generative systems placed on the market before August 2, 2026. Breaches of Article 50 can cost up to EUR 15 million or 3 percent of worldwide annual turnover.
Article 50 of the EU AI Act affects almost every company that uses generative AI: the chatbot on the website, ad visuals from an image generator, blog posts drafted with AI. It has been law since August 2, 2026. Even so, many teams still believe the Digital Omnibus pushed it back. It did not.
This article answers three questions: what you must label, since when, and what changes on December 2, 2026. For the full picture of risk classes, deadlines, and enforcement, start with our guide to the EU AI Act and what it requires of companies.
What Article 50 Requires
Article 50 sets out four transparency duties. Two fall on providers, the companies that develop an AI system or place it on the market or put it into service under their own name. Two fall on deployers, the companies that use an AI system under their own authority in a professional context.
- Art. 50(1), telling people they are dealing with an AI (providers): Providers must design AI systems that interact directly with people so that those people learn they are talking to an AI. The Commission reads the exception for cases where this is obvious narrowly: a support chatbot that customers could mistake for a human does not qualify.
- Art. 50(2), machine-readable marking (providers): Providers of systems that generate synthetic audio, image, video, or text mark the output in a machine-readable format, for example with watermarks or metadata, so that it can be detected as artificially generated.
- Art. 50(3), emotion recognition and biometric categorization (deployers): Deployers of these systems inform the people exposed to them.
- Art. 50(4), deepfakes and text (deployers): Deployers disclose that image, audio, or video content is artificially generated or manipulated when it is a deepfake. The same applies to AI-generated text published to inform the public on matters of public interest.
Article 50(5) applies to all four: the information must be clear and distinguishable and must reach people at the latest at their first interaction with the system or their first exposure to the content.
Article 3(60) defines a deepfake as AI-generated or manipulated image, audio, or video content that resembles existing persons, objects, places, entities, or events and would falsely appear to a person to be authentic. The Commission's guidelines of July 20, 2026, give advertising examples. An AI product image that makes the product look better than it really is counts as a deepfake. A real product in front of an AI-generated background does not, as long as the ad does not mislead about the product.
A common misconception is that the image generator's watermark takes care of labeling. Machine-readable marking under Article 50(2) is the provider's job, and people usually cannot see it. The guidelines state that deployers cannot rely on that marking to meet their own disclosure duty under Article 50(4). You have to add the visible label yourself.
What Was Postponed and What Was Not
Regulation (EU) 2026/1744 of July 8, 2026, in force since July 27, 2026, postponed the high-risk obligations, not Article 50. Labeling has exactly one transitional rule: providers of generative systems placed on the market before August 2, 2026, have until December 2, 2026, to add machine-readable marking. The text of the Regulation on EUR-Lex sets out every amendment.
| Obligation | Original date | Date after Regulation (EU) 2026/1744 |
|---|---|---|
| Article 50 transparency obligations | August 2, 2026 | Unchanged, August 2, 2026 |
| Art. 50(2) machine-readable marking for systems on the market before August 2, 2026 | August 2, 2026 | December 2, 2026 |
| Annex III high-risk AI | August 2, 2026 | December 2, 2027 |
| Annex I high-risk AI (embedded in products) | August 2, 2027 | August 2, 2028 |
Many law firm articles and fact sheets written before the Omnibus still carry the old dates. Anyone who reads there that "the AI Act was postponed" is mixing up the high-risk rules with the rest of the Regulation. Our article on high-risk AI under the EU AI Act explains which systems count as high-risk from December 2027.
Two aids now support implementation. The Commission published the final Code of Practice on marking and labeling of AI-generated content on June 10, 2026, and the Commission and the AI Board have confirmed it as an adequate voluntary tool. By the end of July 2026, around 190 companies and organizations had signed it. The Commission's guidelines on Article 50 followed on July 20, 2026; they are not legally binding. If a code proves inadequate, the amended Art. 50(7) allows the Commission to adopt an implementing act.
Provider or Deployer: Which Duty Applies to Your Company?
Your role decides which of the four duties you must meet. Under Art. 3(3), a provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name. Under Art. 3(4), a deployer uses an AI system under its own authority in a professional context.
Most companies are deployers: they use third-party tools for images, text, and video. The website chatbot is different. The Commission's guidelines treat a company that offers a system under its own name or trademark as its provider, even if it does not modify the underlying model. If your team builds a chatbot on a model provider's API and puts it on your website under your brand, the Article 50(1) duty is yours.
| Scenario | Role | Article 50 duty | Applies since |
|---|---|---|---|
| Support chatbot on your website, built in-house on a third-party model and run under your brand | Usually the provider of the chatbot | Art. 50(1): tell users they are talking to an AI. Art. 50(2): mark the generated text | August 2, 2026 |
| Off-the-shelf chatbot product from a software vendor, embedded under the vendor's name | Deployer | Art. 50(1) sits with the vendor. Check that the notice is switched on | August 2, 2026 |
| AI-generated images in ads | Deployer | Art. 50(4) if the image is a deepfake, such as an embellished product photo or a realistic person | August 2, 2026 |
| AI-written blog post with editorial review | Deployer | Art. 50(4): no disclosure if a person reviewed the text and someone holds editorial responsibility | August 2, 2026 |
| AI voice in a video | Deployer | Art. 50(4) if the voice resembles a real person and sounds authentic | August 2, 2026 |
| Internal use only, such as an AI assistant for trained staff | Deployer | No Art. 50(4) disclosure as long as nothing is published. The Art. 4 AI literacy duty still applies | August 2, 2026 (Art. 4 since February 2, 2025) |
One company can be a provider for one system and a deployer for another. Roles attach to each use, not to the company as a whole, which is why a list of every AI application with its role pays off. Tools that teams adopt without approval are the blind spot here; we cover how to uncover shadow IT in your company separately.
