The short answer: two obligations, two dates
The AI Act was amended this summer by the Digital Omnibus Regulation (EU) 2026/1744. It was adopted on 8 July 2026, published in the Official Journal on 24 July and entered into force on 27 July. The rest of Article 50 kept its original start date: Article 50 transparency duties applied from 2 August 2026.
Only one duty received a grace period: providers of AI systems that generate synthetic audio, image, video or text, and that placed those systems on the market before 2 August 2026, have until 2 December 2026 to comply with Article 50(2). Systems placed on the market after 2 August get no transition and must comply immediately.
| Obligation | Who carries it | Applies from |
|---|---|---|
| Tell people they are interacting with AI, Art. 50(1) | Provider | 2 August 2026 |
| Machine-readable marking of synthetic content, Art. 50(2) | Provider | 2 August 2026 for new systems; 2 December 2026 for systems already on the market |
| Inform people exposed to emotion recognition or biometric categorisation, Art. 50(3) | Deployer | 2 August 2026 |
| Disclose deepfakes and AI text on matters of public interest, Art. 50(4) | Deployer | 2 August 2026 |
The four transparency duties in Article 50
Article 50 covers four situations:
- AI systems that interact directly with people;
- AI that generates synthetic content;
- emotion recognition and biometric categorisation systems;
- deepfakes and AI-generated text published in the public interest.
The first two duties sit with providers, and the last two with deployers. A single system can fall under three paragraphs at once, and one organisation can be both provider and deployer of the same tool.
A customer-service agent that writes replies is a good example. It interacts with people, and it also generates text. Whether you count as provider, deployer or both depends on your role, so confirm the classification with your legal team before launch.
Chatbot and AI agent disclosure: in force since 2 August 2026
The rule itself is short. Providers must design AI systems that interact directly with people so that those people are told they are dealing with an AI system. The exception is where this is obvious to a reasonably well-informed, observant and circumspect person, given the circumstances and context.
Relying on that exception is risky in customer-facing products. A support widget with a human name, a phone line with a natural-sounding voice or an agent that sends emails may not look like AI to the person receiving it. Disclosing by default is the safer design choice.
What a clear disclosure looks like
A disclosure works when the user sees it before they rely on the answer. In practice, that means:
- stating at the start of the conversation that the user is talking to an AI;
- repeating it when the conversation moves to another channel, such as from chat to email;
- making it obvious when a human takes over, and when control returns to the AI.
The AI should also never claim to be a person, even when a user asks directly. Add a test case for this before release.
AI agents that act in other systems
Agents that send messages, book appointments or change orders reach people outside the original chat window. The recipient of an agent-written email may never have seen your chat interface. Review these outbound touchpoints with your legal team, because they may raise both 50(1) and 50(2) questions.
Machine-readable marking: who has until 2 December 2026
Under Article 50(2), providers of generative AI systems must mark outputs in a machine-readable format that makes them detectable as artificially generated. This sits alongside the user-facing disclosure. It is a technical signal embedded in the content itself.
If your product generates text, images, audio or video for users, you may be a provider under 50(2), even if the underlying model comes from a third party. Record the date each generative feature was placed on the market. Features launched before 2 August 2026 have until 2 December 2026; features launched later needed marking from day one.
The Commission has not prescribed a single technique. Its guidance on technical methods stays deliberately high level, while the Code of Practice expects providers to combine several machine-readable marking layers. Ask your model vendor which marking methods they already apply and what you must add yourself.
What the Commission guidelines and the Code of Practice add
The European Commission published its final Article 50 guidelines on 20 July 2026. They are not legally binding, and only courts can give an authoritative interpretation. They are still expected to be the main reference for national authorities when interpreting Article 50.
The Commission published the final Code of Practice on marking and labelling AI-generated content in June 2026. The Code is voluntary, but the Commission and the AI Board have confirmed it is an adequate way to demonstrate compliance with the marking and labelling duties.
The Code has two parts:
- marking and detection rules for providers of generative AI systems;
- labelling rules for deployers who publish deepfakes or AI-generated text on matters of public interest.
Who enforces Article 50 in Germany, and what breaches cost
Germany's national framework is the KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG). It entered into force on 29 July 2026 and makes the Bundesnetzagentur the market surveillance authority for the AI Act, unless the law assigns another body. BaFin supervises AI systems directly connected to regulated financial activity carried out by firms it oversees.
The Bundesnetzagentur also acts as the central complaints office for suspected breaches. Customers, competitors and associations therefore have one clear place to report a chatbot that does not disclose itself.
Breaches of the Article 50 transparency duties can be fined up to €15 million or 3% of total worldwide annual turnover, whichever is higher. For SMEs and start-ups, each fine is capped at whichever of the two figures is lower.
Many companies have not yet assessed their exposure. In Bitkom's survey of 604 German companies, carried out in summer 2025, 23% expected to be affected as AI deployers, 30% were still checking and 11% had not looked at the AI Act at all.
Implementation checklist for product and engineering teams
- List every AI touchpointInclude chat widgets, voice lines, email agents, content generators and internal assistants.
- Map each touchpoint to Article 50Note which paragraph applies and whether you are provider, deployer or both.
- Add disclosure at the first interactionPut it in the opening chat message, the voice greeting and the email footer.
- Make human hand-over visibleUsers should always know whether a person or the AI is responding.
- Test that the AI never claims to be humanInclude direct questions such as "Am I talking to a person?" in your release tests.
- Check marking for every generative featureAsk your model vendor what it marks, record each feature's launch date against 2 August 2026, and close any gaps before 2 December.
- Label public-facing deepfakes and public-interest textThis applies if you publish either type of content.
- Keep evidenceLog disclosure events and store screenshots of the live interface for each release.
- Assign an owner and a review dateGet written sign-off from your legal team, and review again whenever the system changes.
How Cypherox approaches disclosure in the agents it builds
Cypherox designs disclosure into an agent from the first sprint. Its customer service agents tell customers they are talking to an AI agent. Complex or sensitive cases go to staff with a full summary.
For generative AI systems such as chatbots and assistants, Cypherox builds the transparency measures into the product. The client's legal team confirms which obligations apply to the specific use case.
If you are unsure where your AI touchpoints sit, start with an inventory. Cypherox's technology consulting team can map your systems against Article 50 before you commit to changes. For the wider regulatory picture, read our guide to the EU AI Act after the Digital Omnibus. For data protection architecture, see building GDPR-compliant AI agents and RAG systems.