Short answer
Article 50 of the EU AI Act — the transparency rules for chatbots, synthetic content, deepfakes, emotion recognition and biometric categorisation — has applied since 2 August 2026 and was not postponed by the Digital Omnibus. Generative AI systems already on the EU market before 2 August 2026 must apply the output-marking rules by 2 December 2026. Fines reach €15 million or 3% of worldwide turnover.
When the Commission's Digital Omnibus pushed Annex III and Annex I obligations out to 2027 and 2028, a lot of AI startups parked EU AI Act work. That's a mistake. The Omnibus did not move Article 50, and Article 50 covers the parts of the Act that most SaaS startups will trigger: chatbot disclosure, generative-output marking, deepfake labelling and user notice for emotion/biometric features. This checklist is the practical, auditable version.
It's most useful if your product has at least one of: an AI chat UI, image/audio/video generation, face or voice categorisation, or an emotion-recognition surface. For the deeper framework fit see ISO 42001; for the controls that back these disclosures in a SOC 2 see SOC 2 controls for AI agents and MCP.
Who Article 50 applies to
| Duty | Who owns it | Trigger |
|---|---|---|
| Chatbot / interactive-AI disclosure | Provider | AI system is intended to interact directly with natural persons |
| Synthetic content machine-readable marking | Provider | Generative AI produces synthetic audio, image, video or text content |
| Deepfake labelling | Deployer | Content is AI-generated or manipulated to appear authentic and depicts real persons, objects or places |
| Emotion / biometric categorisation notice | Deployer | AI system is used to recognise emotions or categorise people biometrically |
| AI-generated text of public interest | Deployer | Text published to inform the public on matters of public interest, except when human-reviewed and the publisher takes editorial responsibility |
The seven-step checklist
- 1
Inventory the AI touchpoints that reach EU users
List every chatbot, generative feature, deepfake capability, biometric categorisation and emotion-recognition surface in your product. Note the role (provider vs deployer), the content type (text, image, audio, video) and whether EU users encounter it.
- 2
Add chatbot and interactive-AI disclosures
Any interactive AI reaching a natural person must disclose that they are interacting with an AI, unless it is obvious from the context or the user is a professional in a context where it is clearly implied.
- 3
Mark generative outputs as artificial
Images, audio, video and text generated by AI must be marked in a machine-readable format and be detectable as artificially generated. Embed watermarks (SynthID), C2PA Content Credentials or equivalent provenance metadata.
- 4
Label deepfakes clearly
If content was generated or manipulated to resemble a real person, object or place and appears authentic, deployers must disclose that it is AI-generated unless an exception applies (law enforcement, artistic/satirical uses with proportionate disclosure).
- 5
Notify users of emotion recognition or biometric categorisation
If an AI system recognises emotions or classifies people biometrically, affected individuals must be informed. Keep a notice at the point of capture, not buried in a privacy policy.
- 6
Patch legacy generative products by 2 Dec 2026
Generative AI systems placed on the EU market before 2 Aug 2026 have until 2 Dec 2026 to apply the output-marking rules. If you grandfathered a product, this is your deadline.
- 7
Keep the evidence an auditor would accept
A screenshot of each disclosure, a sample output with a decoded watermark, the C2PA manifest for a representative image, and the policy document that assigns ownership. Add to your SOC 2/ISO 42001 evidence set.
Chatbot disclosure: what good looks like
The disclosure must be “clear and distinguishable at the latest at the time of the first interaction.” In practice that means the opening message of your chat UI, a persistent “AI assistant” label on the widget, or a one-line banner above the input. Avoid dark patterns: a greyed-out mention three paragraphs into a tooltip doesn't qualify.
Patterns that pass:
- Opening system message: “Hi — you're chatting with an AI assistant. I can help with X, Y, Z.”
- Widget label: “AI support (powered by [model])” visible on the launcher and inside the chat window.
- Avatar + name combination that includes “AI” or “bot”.
Patterns that fail:
- Human-sounding name with no AI label (“Hi, I'm Sarah — how can I help?”).
- Disclosure only in the privacy policy, not in the UI.
- Disclosure that appears mid-conversation after the user has already shared information.
Synthetic-content marking: pick a standard, document it, verify
The Act requires outputs to be “marked in a machine-readable format and detectable as artificially generated.” The Act does not pick a technology, so the practical choice is between watermarking approaches and provenance metadata.
| Content | Common approaches |
|---|---|
| Images | C2PA Content Credentials, SynthID-style watermarking, EXIF/IPTC provenance metadata |
| Audio | Perceptual watermark (SynthID-audio-style), C2PA audio manifest |
| Video | C2PA manifest with per-frame signing, visible on-screen label plus machine-readable sidecar |
| Text | Statistical watermarking at generation, metadata annotation at delivery (API header, file-level metadata) |
Whichever approach you pick, record it in your ISO 42001 technical documentation, and verify on a sampling basis that a representative output can be decoded by a third-party detector. That verification is the evidence auditors will ask for.
Deepfakes: what the deployer owns
The deepfake rule attaches to the deployer, not the provider. If you're an AI SaaS that generates synthetic media on behalf of your customers, you're the provider; your customer who publishes the content is the deployer. The Act requires the deployer to disclose that the content is AI-generated or manipulated, in a form appropriate to the medium (visible overlay on video, caption on image, spoken disclaimer on audio).
Exceptions in the Act narrow this for artistic, satirical, fictional or law-enforcement contexts, with a proportionate disclosure requirement rather than a full label. As a provider, you can push the deployer in the right direction with product affordances — a “disclose as AI” toggle on by default, an export that bakes the label into the file, a dashboard that confirms disclosure is active.
Emotion recognition and biometric categorisation
Features that classify facial expressions as emotions, voice tone as mood, or group people by biometric traits must inform affected individuals that the system is operating and what it does. The notice has to be at the point of capture — a splash screen before a camera turns on, a verbal announcement before a call is analysed — not buried in a privacy policy. The ban on emotion recognition in workplaces and educational institutions is separate and sits in the prohibited practices part of the Act, which has been in force since February 2025.
Evidence to keep for your Article 50 file
- Screenshot of each chatbot disclosure in its current UI location, dated.
- Sample generated output + decoded watermark/manifest confirming detectability.
- Policy document assigning ownership of each duty to a named role.
- Deployment artefact (feature flag, config, release notes) showing when disclosures were enabled in production.
- Vendor DPA with the LLM provider referencing Article 50 cooperation.
- Internal review ticket signing off before any new generative feature or chat UI ships to EU users.
All of these slot into an existing SOC 2 or ISO 42001 evidence set. If you already answer AI vendor security questionnaires, this is a thin extension of the file you're maintaining.
Frequently asked questions
When did EU AI Act Article 50 start applying?
Article 50 — the transparency obligations for providers and deployers of certain AI systems — has applied since 2 August 2026. It was not postponed by the Digital Omnibus (Regulation (EU) 2026/1744); only Annex III and Annex I high-risk obligations were moved to 2 December 2027 and 2 August 2028.
Who must comply with Article 50?
Providers of AI systems intended to interact directly with people (chatbots), providers of generative AI that produces synthetic content, deployers of emotion-recognition or biometric-categorisation systems, and deployers of AI that generates deepfakes. Nearly every AI SaaS startup selling into the EU is in at least one of these categories.
Does the chatbot disclosure have to be visible all the time?
It must be given to the user in a clear and distinguishable manner at the latest at the time of the first interaction. In practice, that means the opening message or a visible label in the chat UI. "Obvious from the context" is a narrow exception — a feature called "AI assistant" probably qualifies; a nameless support widget on your site probably does not.
What counts as "machine-readable marking" for synthetic content?
The Article does not mandate a specific technique. Industry-accepted standards include watermarking approaches like SynthID for images and audio, metadata provenance such as C2PA Content Credentials, and cryptographic signing of generated content. Pick one, document the implementation, and verify a sample output can actually be detected as AI-generated.
What is the 2 December 2026 deadline about?
For generative AI systems that were already on the EU market before 2 August 2026, the output-marking requirements of Article 50 apply from 2 December 2026 instead of the original application date. If you launched after 2 August 2026, you were already on the hook.
Are deepfake labels required for every AI-generated image?
No. The deepfake rule in Article 50 targets content that generates or manipulates image, audio or video resembling existing persons, objects, places or events and appears authentic. A cartoon avatar generated by AI is not a deepfake; a photorealistic image of a real public figure saying something they did not say is. The labelling obligation is on the deployer who makes the content available.
What are the penalties for breaching Article 50?
Up to €15 million or 3% of worldwide annual turnover, whichever is higher, for non-compliance with transparency obligations. The maximum penalty tier (up to €35 million / 7%) is reserved for prohibited practices, not Article 50.
Make Article 50 part of your ongoing compliance
LowerPlane runs Article 50 evidence alongside your ISO 42001, SOC 2 and GDPR programmes so you don't have a separate “AI Act” folder. See the updated AI Act deadlines or the ISO 42001 overview.