Key points

• The EU AI Act's transparency obligations in Article 50 apply to chatbots, AI-generated or manipulated content and certain biometric and emotion recognition systems. They were set to apply from August 2026, and the Commission has proposed adjustments to timing for some elements, so the current status should be confirmed.
• Providers must design systems that interact directly with people so that users are informed they are dealing with AI, unless that is obvious to a reasonably well-informed person.
• Providers of systems that generate synthetic audio, image, video or text must mark outputs in a machine-readable format so they can be detected as artificially generated or manipulated.
• Deployers who publish deepfakes, or AI-generated text on matters of public interest, must disclose that the content is artificially generated, with exceptions for artistic work and for text that has been subject to human editorial review.
• Breaches can lead to fines of up to EUR 15 million or 3 percent of worldwide annual turnover, whichever is higher, and a Code of Practice on marking and labeling is being developed to support compliance.

Why transparency duties matter now

Much of the attention on the EU AI Act has gone to prohibited practices, high-risk systems and general-purpose models. The transparency rules in Article 50 are narrower, but they reach a very large number of ordinary business uses, including customer service chatbots, marketing content and image generation. A company does not need to build a high-risk system to be in scope. It only needs to deploy a chat interface, or publish content created with a generative tool.

The obligations also sit alongside other regimes. Consumer protection law already prohibits misleading commercial practices, and privacy law requires transparency about automated processing. The AI Act adds a specific, enforceable disclosure layer. Our colleagues have set out the wider framework for model providers in our note on general-purpose AI obligations.

The four transparency obligations

Interaction with AI systems. Providers of AI systems intended to interact directly with natural persons must design and develop them so that people are informed they are interacting with an AI system. The exception is where this is obvious from the point of view of a reasonably well-informed, observant and circumspect person, taking into account the context. A voice assistant that sounds human and a text chat window styled like a human agent are unlikely to qualify as obvious.

Marking synthetic content. Providers of AI systems, including general-purpose systems, that generate synthetic audio, image, video or text must ensure that outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. The technical solutions must be effective, interoperable, robust and reliable as far as technically feasible. Watermarks, metadata and fingerprinting are all being discussed, and the standards are still developing.

Emotion recognition and biometric categorization. Deployers of these systems must inform the people exposed to them and process the data in accordance with data protection law. Separate and stricter rules apply where such systems fall into the prohibited or high-risk categories.

Deepfakes and public-interest text. Deployers of systems that generate or manipulate image, audio or video content constituting a deepfake must disclose that the content has been artificially generated or manipulated. Deployers that publish AI-generated text for the purpose of informing the public on matters of public interest must also disclose it, unless the text has undergone human review or editorial control and a person holds editorial responsibility for the publication. For evidently artistic, creative, satirical or fictional works, the duty is limited to disclosure in a way that does not hamper the display or enjoyment of the work.

Who is the provider and who is the deployer

The Act places the marking duty on providers and the disclosure duties for deepfakes and public-interest text on deployers. A company that builds a customer-facing assistant on a third-party model is often the provider of the resulting AI system, even if it is not the provider of the model. That means the chat disclosure duty will usually fall on it. A marketing team using a vendor's image generator, by contrast, is typically a deployer and has the deepfake disclosure obligation for realistic content it publishes. Contracts with vendors should make clear which party implements marking and what technical support is provided.

Timing and what is still moving

Article 50 was scheduled to apply from 2 August 2026. The Commission has put forward proposals to adjust certain timelines under the Act, including a transition for the machine-readable marking obligation for systems already on the market. Legislative outcomes can change dates quickly, and we recommend confirming the status at the point of decision. The Commission is also facilitating a code of practice on the marking and labeling of AI-generated content, and guidelines on Article 50 are expected to clarify points such as what counts as obvious AI interaction. Signing or following the code is likely to be a practical way to show compliance.

Enforcement and penalties

Infringement of the transparency obligations is subject to administrative fines of up to EUR 15 million or, for an undertaking, up to 3 percent of total worldwide annual turnover for the preceding financial year, whichever is higher. National market surveillance authorities will enforce the rules for most operators. Member states are at different stages of designating those authorities, which affects how quickly enforcement will begin in practice.

A practical compliance approach

First, inventory customer-facing and content-generating uses across the business, including those embedded in marketing agencies' workflows. Second, determine for each whether the company is a provider or a deployer. Third, design the disclosures. For chat and voice interfaces, a clear statement at the start of the interaction is the simplest approach. For content, decide when a label is needed, how it will appear and who approves exceptions for editorial review. Fourth, check vendor capability for machine-readable marking and require it by contract. Fifth, align with privacy and consumer notices, so that users are not given inconsistent descriptions of the same system.

Companies operating in both the EU and the US should also watch state laws, such as those in California and Utah, that require disclosure of AI interaction in particular settings. A single global standard for disclosure is often easier to administer than a patchwork.

Corvane Ryle's Brussels-based Sophie Laurent-Brecht and our Artificial Intelligence practice advise on Article 50 readiness, vendor contracting and disclosure design, working with our Privacy & Cyber practice on the interaction with data protection law.