The EU AI Act's Transparency Rules for AI-Generated Content, Explained

Article 50 of the EU AI Act (Regulation (EU) 2024/1689) sets out transparency duties for artificial intelligence systems that generate or alter content people encounter. The rules became applicable on 2 August 2026, roughly two years after the regulation entered into force on 1 August 2024. They cover chatbots, synthetic audio and video, deep fakes, and AI-written text published on matters of public interest, and they apply to providers and deployers regardless of where those companies are based, as long as the output is used in the EU.

What Article 50 Requires

The first obligation, under Article 50(1), applies to providers of systems meant to interact directly with people, such as chatbots. They must design these systems so users know they are talking to a machine, unless that fact is already obvious to a reasonably attentive person. An exception exists for systems authorised by law to detect, prevent, investigate or prosecute crime, though it falls away if the public can use the system to report an offence.

Article 50(2) targets providers of systems, including general-purpose AI systems, that produce synthetic audio, images, video or text. Outputs must carry a machine-readable mark that lets people detect artificial origin, and the marking method must be effective, interoperable, resilient and reliable as far as technically feasible, given the content type, cost and the state of the art. Tools used only for standard editing that does not substantially change the input's meaning fall outside this duty.

Article 50(3) covers deployers of emotion-recognition or biometric-categorisation systems, who must tell exposed individuals that such a system is running. The duty applies whether the system works in real time or after the fact, for instance through a pop-up notice before a game begins or a visible sign at a shop entrance.

Article 50(4) turns to deployers directly. Those using systems that produce deep-fake image, audio or video content must disclose that it was artificially generated or altered, and the same applies to AI-written text published to inform the public on matters of public interest. Both duties fall away where the deployer's use is authorised by law for detecting, preventing, investigating or prosecuting crime.

Defining a Deep Fake

The regulation, in Article 3(60), defines a deep fake as AI-generated or manipulated image, audio or video that resembles a real person, object, place, entity or event and would falsely seem authentic to a viewer. Whether content falsely appears authentic does not turn on whether the deployer meant to deceive anyone. The word "existing" is read broadly: it covers realistic portrayals of fictional characters who could plausibly exist, while clearly fantastical material stays outside the definition.

When deep-fake content sits inside an evidently artistic, creative, satirical or fictional work, the disclosure duty narrows. It only requires that the disclosure not get in the way of displaying or enjoying the work itself.

Exemptions and Practical Limits

The exception for AI-written published text depends on genuine human review. Editorial control must involve substantive checks, such as fact-checking, before publication; spellchecking or grammar correction alone will not satisfy the exemption, and a natural or legal person must hold editorial responsibility for what is published.

A separate carve-out covers business-to-business use: outputs that are strictly technical and shared only with a limited, pre-defined group of professionals inside an organisation, without wider distribution, fall outside the marking duty. Ephemeral, real-time content that is never recorded or shared, such as in video games or virtual reality, is also exempt from marking where marking is not technically feasible and users are told the content's AI origin through an in-experience notice.

Who Must Comply

A provider is any entity that develops an AI system, or commissions its development, and places it on the market under its own name. A deployer is any person, public authority, agency or body using an AI system in a professional capacity, aside from purely personal use. Both obligations reach beyond the EU's borders: providers and deployers outside the bloc must still comply if a system's output is used, or meant to be used, inside the EU.

• Unacceptable risk – prohibited outright
• High risk – heavily regulated
• Limited risk – transparency required, where Article 50 sits
• Minimal risk – no extra obligations

Disclosure in Practice

Article 50(5) requires that any disclosure be clear, distinguishable and given no later than a person's first interaction or exposure, and it must meet applicable accessibility standards. Burying a disclosure inside terms and conditions, behind menu layers, or only in end credits does not meet that bar for deep fakes generally.

To help meet this standard, the European Commission created three icons: "AI GENERATED", "AI MODIFIED" and a general AI marker, free for deployers to use without attribution. Using them is optional, and the underlying labelling duty is not. Placing an icon on content does not by itself prove compliance.

The Code of Practice: Marking in Practice

Beyond the Act itself, the Commission's Code of Practice on Transparency of AI-Generated Content sets out how marking should work. It calls for a multilayered approach for most content: digitally-signed metadata paired with an imperceptible watermark embedded in the file. Free-form text gets only one layer, an imperceptible watermark, since metadata cannot attach to unstructured text, and very short passages under 200 tokens are exempt because reliable watermarking is not yet feasible at that length.

Signing up to the Code is voluntary, and doing so does not by itself prove compliance with the Act. Signatories relying on watermarking must still build an interoperable detection solution by 2 February 2027.

Enforcement and Penalties

Penalties under the AI Act scale with the type of breach. Figures cited for Article 50 transparency failures range from up to €15 million or 3% of global annual turnover down to €7.5 million or 1.5%, depending on the source consulted.

Timeline

1. 1 August 2024 – the AI Act enters into force
2. February 2025 – prohibitions on the highest-risk AI applications take effect
3. May 2025 – governance and transparency rules for general-purpose AI models take effect
4. 17 December 2025 – Commission publishes first draft Code of Practice on Transparency of AI-Generated Content
5. 5 March 2026 – second draft of the Code of Practice is published
6. 8 May 2026 – Commission publishes draft guidelines on Article 50
7. 3 June 2026 – stakeholder consultation on the draft guidelines closes
8. 20 July 2026 – Commission finalises its Article 50 guidelines
9. 22 July 2026 – initial sign-up window for the Code of Practice closes
10. 2 August 2026 – Article 50 transparency obligations become applicable
11. 2 December 2026 – proposed Omnibus deadline for Article 50(2) marking on existing general-purpose AI systems

Overlap with Other EU Law

Article 50 does not stand alone. It applies alongside GDPR transparency requirements, the Digital Services Act's content-labelling duties for very large online platforms, and the Unfair Commercial Practices Directive.

Taken together, these provisions point to one goal: people should be able to tell when they are dealing with a machine, or with content a machine helped make. Guidance from the Commission and the Code of Practice are still being finalised, so the practical detail of compliance is likely to keep moving through 2027.

Frequently asked questions