Article 50 in Practice: Chatbot Disclosure, AI Content Labels and Watermarking

When the Digital Omnibus pushed the high-risk deadline to December 2027, a lot of founders exhaled and moved the AI Act to next year's roadmap. For most SaaS companies, that was the wrong conclusion.

The obligation that actually touches most products, Article 50, wasn't postponed. It has applied since 2 August 2026. If your product has a chatbot, a voice agent, or anything that generates images, audio, video or text, it almost certainly applies to you right now.

The good news: Article 50 is the most fixable part of the AI Act. For most products it's days of work, not months. This guide covers what each obligation means in a real product, who is responsible for it, and how to close the gaps.

Five obligations, two roles

Article 50 contains five separate obligations. Each sits with either the provider (whoever develops the AI system and puts it on the market under their name) or the deployer (whoever uses it in their own business).

A note on roles. If you build a chatbot on top of GPT, Claude or Gemini and ship it as your product, you are the provider of that chatbot. The model company provides the underlying model, but the AI system your customers use is yours. If your customer embeds your chatbot on their website, they are the deployer.

1. Chatbots and AI that talks to people

The rule: providers must design AI systems that interact directly with people so that those people are informed they're dealing with an AI. The only exception is when it's obvious to a reasonably well-informed, observant person, given the context.

What this means in practice:

• Customer support chatbots: say so up front. "Hi, I'm an AI assistant" in the first message is the simplest compliant pattern. A small "AI" badge next to the bot's name helps, but don't rely on a badge alone if the bot has a human-sounding name and avatar.
• Voice agents and AI phone calls: disclose at the start of the call, out loud. A caller can't see a badge.
• AI agents that email or message people: if an AI is conducting the conversation, our reading is that it interacts directly with people and needs disclosure. A one-line signature such as "This message was written and sent by an AI assistant on behalf of [Company]" covers it.
• "Obvious" is a narrow exception. An AI image editor is obviously AI. A support chat called "Sarah" with a stock photo is not.

Timing and format: the information has to be clear and distinguishable, given at the latest at the first interaction, and accessible (think screen readers, and audio for voice channels).

Where teams get caught out: the human handover. If your chat switches between an AI and a human agent, make the switch visible both ways. People shouldn't have to guess which one they're talking to.

2. Machine-readable marking of generated content

The rule: providers of AI systems that generate synthetic audio, images, video or text must mark the outputs in a machine-readable format so they're detectable as artificially generated or manipulated. The technical solution has to be effective, interoperable, robust and reliable, as far as technically feasible given the type of content, the costs and the state of the art.

The exception: AI that performs an assistive function for standard editing, or that doesn't substantially alter the input or its meaning. Grammar correction, cropping and basic enhancement typically fall here. Rewriting a paragraph from scratch or generating a new image does not.

The deadline: for generative systems launched on or after 2 August 2026, marking applies now. For systems already on the market before 2 August 2026, the Digital Omnibus allows until 2 December 2026. That grace period covers marking only, not the chatbot disclosure above.

What it looks like in practice:

The Commission's Code of Practice on marking and labelling AI-generated content, finalised in June 2026, sets out the practical approach. It's voluntary, but it's the clearest route to showing you comply. In broad terms it combines more than one technique, because each one alone is easy to defeat:

• Metadata and provenance information attached to the file. Content Credentials (the C2PA standard) is the most widely adopted format.
• Imperceptible watermarks embedded in the content itself, which survive when metadata is stripped.
• Supporting measures such as fingerprinting or logging, so content can be checked against what your system generated.

The Code also distinguishes fully AI-generated content from AI-assisted content, which affects how strongly it needs to be marked.

If you build on someone else's model: check what your model vendor already does. Several major image and audio models embed watermarks or Content Credentials by default. But the obligation sits with you as the provider of your system, so verify it survives your own pipeline. Resizing, re-encoding, format conversion and CDN image optimisation routinely strip metadata. Test the files your users actually download, not the ones the API returns.

Text is the hard case. Watermarking text reliably is still technically immature, which is exactly why the "as far as technically feasible" qualifier exists. Do what is feasible for your system, document why, and follow the Code of Practice as it develops.

3. Emotion recognition and biometric categorisation

The rule: deployers of emotion recognition or biometric categorisation systems must inform the people exposed to them, and process their data in line with GDPR.

First check whether you're allowed to run the system at all. Emotion recognition in the workplace and in education has been prohibited since February 2025, apart from narrow medical and safety uses. Biometric categorisation that infers sensitive traits (race, political opinions, religion, sexual orientation and others) is also banned. Article 50 only governs the uses that remain lawful, such as some retail analytics or driver-drowsiness detection, and some of those may also be high-risk.

4. Deepfakes

The rule: deployers who use AI to generate or manipulate image, audio or video content that resembles real people, objects, places or events, and would falsely appear authentic, must disclose that it's AI-generated.

What counts: a photorealistic image of a "customer" who doesn't exist, an AI voice clone of your CEO in a product video, a generated video of a real-looking street scene. Stylised illustrations that nobody would mistake for reality generally aren't deepfakes.

Creative and satirical work: if the content is evidently artistic, creative, satirical or fictional, the disclosure can be limited to acknowledging that AI was used, in a way that doesn't spoil the work. A credit line or caption usually does it.

In practice: label photorealistic AI images and video in marketing, ads and social posts. A visible caption ("AI-generated image") is the safest pattern. Many ad platforms and social networks now require their own AI labels as well, so align the two.

5. AI-generated text on matters of public interest

The rule: deployers who publish AI-generated or manipulated text to inform the public on matters of public interest must disclose that it's AI-generated, unless a human has reviewed or edited it and a person or organisation holds editorial responsibility for it.

What this means: a news-style article, public policy explainer or public health update produced by AI and published without real editorial control needs a disclosure. The same article, reviewed and edited by a named editor who takes responsibility, doesn't.

Most ordinary marketing copy, product descriptions and customer emails aren't "informing the public on matters of public interest" in this sense. A blog about regulation, health or politics might be. If in doubt, keep a human editor in the loop and record it. That's good practice anyway.

Penalties

Breaching Article 50 can be fined up to €15 million or 3% of global annual turnover, whichever is higher. For SMEs and start-ups, it's whichever is lower. Expect national authorities to start with the visible cases: undisclosed chatbots and unlabelled deepfakes are easy to spot from the outside.

Your Article 50 checklist

This week:

1. List every place your product or business uses AI that talks to people or generates content. Include voice, email agents and marketing tools.
2. For each one, decide whether you're the provider or the deployer.
3. Add AI disclosure to every chatbot and voice agent: first message, out loud on calls, and visible handovers.

This month: 4. Check whether your generative features mark their output. Download real files from your production app and inspect them for watermarks or Content Credentials. 5. Add visible labels to photorealistic AI images, audio and video you publish. 6. Put a human editorial step on any AI-written public-interest content, or label it.

Before 2 December 2026: 7. If your generative system launched before 2 August 2026, finish machine-readable marking. 8. If you offer image, video or voice generation, review your safeguards against the new ban on nudifier and CSAM-generating systems, which applies from the same date.

Ongoing: 9. Record what you implemented and when. A short transparency notice per system is the easiest proof. 10. Re-check when you add a new AI feature or change model vendor.

Check which Article 50 obligations apply to you →

The free classifier flags Article 50 obligations for each of your systems in about five minutes. From the Starter plan (€39/month), ActScope generates the transparency notices for you and keeps them on file.

---

Common questions

Does Article 50 apply if my AI isn't high-risk? Yes. Article 50 applies on its own, whatever the risk tier. A minimal-risk chatbot still needs disclosure. A high-risk system that talks to people needs both.

Is a line in our terms of service enough? No. The information has to be clear and distinguishable, and given at the latest at the first interaction or exposure. A clause nobody reads before chatting doesn't meet that.

We use an AI writing tool for our blog. Do we need to label every post? Usually not, if a person reviews and edits the posts and your company takes editorial responsibility for them. The labelling duty targets text published to inform the public on matters of public interest without that human control. Machine-readable marking is the tool provider's obligation, not yours as the user.

Does the grace period to 2 December 2026 apply to our chatbot disclosure? No. The grace period covers only machine-readable marking of generated content, and only for systems already on the market before 2 August 2026. Chatbot disclosure has applied since 2 August 2026.

Our model vendor watermarks images. Are we covered? Possibly, but you're responsible as the provider of your own system. Make sure the marking survives your processing pipeline, and keep evidence of how it works.

What if we're outside the EU? Article 50 applies when your AI system is placed on the market or used in the EU, or its outputs are used in the EU. A US chatbot serving European users is covered.

---

Run the free classifier →

Related guides:

• The Digital Omnibus Explained: The New EU AI Act Timeline
• The EU AI Act Compliance Checklist: What to Do Now, and What Can Wait
• Is My AI System High-Risk Under the EU AI Act?
• EU AI Act vs GDPR: How They Overlap and Where They Don't