EU AI Act Article 50: transparency rules, the Code of Practice and the 2 December deadline

Article 50 of the EU AI Act sets transparency duties: telling people when they interact with an AI system, marking generated or manipulated content in a machine-readable way, disclosing deepfakes and labelling certain public-interest text. This article explains each duty in product terms, summarises what the final Code of Practice of June 2026 asks of providers and deployers, and sets out the transition the AI Omnibus gave to systems already on the market, which ends on 2 December 2026. It reviews the research on watermarking and detection, and closes with a product checklist and answers to common questions.

Keywords Article 50 AI Act · AI Act Article 50 · transparency · Code of Practice · watermarking · C2PA · deepfakes · AI labels

Article 50 of the EU AI Act is no longer a future requirement. Its transparency obligations have applied since 2 August 2026^[1].

Two things have changed since the text was adopted. In June 2026 the European Commission published the final Code of Practice on Transparency of AI-generated Content, which turns "machine-readable and detectable" into concrete techniques^[2]. And the AI Omnibus, in force since 27 July 2026, gave providers whose generative systems were already on the market until 2 December 2026 to mark their output^[3].

For product teams this is an interface, metadata and pipeline problem, not a footer disclaimer.

Content generated and made available before 2 August 2026 does not need to be marked retroactively^[2].

Article 50 of the Regulation sets transparency duties for systems that interact with people or generate content^[1]. The technical question behind "detectable" is still open in the literature. Watermarking can embed a signal in generated text with negligible effect on quality, detectable from a short span of tokens without access to the model^[4], and a text watermark of this kind now runs in production with minimal latency overhead^[5]. For images, a watermark can be built into a diffusion model's decoder so that every generated image carries it^[6].

The same literature shows the limits. Recursive paraphrasing significantly reduces the detection rates of a range of text detectors, including watermark-based ones^[7], and pixel-level invisible image watermarks can be removed by regenerating the image^[8]. This is why the Code asks for more than one technique, and why marking belongs in the generation pipeline rather than in after-the-fact detection.

Legal scholarship adds a point about responsibility: duties should be tailored to the actors along the value chain, distinguishing developers, deployers, professional and non-professional users, and recipients of output^[9]. Article 50 does exactly that, which is why the first question is always "are we the provider or the deployer?"

A company that builds a chatbot on a general-purpose model and puts it on its own website is usually a provider of that chatbot for 50(1), and a deployer for anything it publishes with it under 50(4). The obligations stack.

Providers of AI systems intended to interact directly with people must design the system so that users are informed they are interacting with AI, unless that fact is obvious in context^[1].

For chatbots and agentic interfaces, the safest pattern is explicit disclosure in the product rather than relying on branding or user assumptions:

• a visible "AI assistant" or equivalent label;
• onboarding text explaining that responses are generated by an AI system;
• disclosure at the start of a voice or chat interaction where a user could reasonably assume a human is involved.

Providers of generative AI systems must make their outputs machine-readable and detectable as AI-generated or manipulated^[1]. The final Code of Practice describes how^[2]:

• At least two marking techniques, for example signed, tamper-evident metadata together with an imperceptible watermark. One technique is enough for free-form text, which cannot carry metadata.
• Short text is exempt from watermarking: text under about 200 tokens, a threshold the Code expects to lower as watermarking improves.
• A detection mechanism, free of charge in principle, with free access for regulators, media, fact-checkers and researchers.
• Interoperable watermark detection across providers by 2 February 2027.
• No stripping: providers must prohibit users from stripping the metadata.

The Code is voluntary, but the obligation it implements is not. Signing it is a practical way to show that a marking approach follows the agreed state of the art. We explain how C2PA manifests and watermarks fit together in C2PA and AI watermarking for Article 50.

Deployers who use AI to generate or manipulate image, audio or video content that resembles real people, objects, places or events must disclose that it is artificially generated or manipulated^[1].

The Code sets out what a good label looks like^[2]: immediately recognisable without user interaction, visible long enough, embedded in the content where possible, and perceivable at first exposure. The Code includes three EU icons for this: fully AI-generated, AI-modified, and a basic icon with an interactive second layer. Where there is no visual channel, as in audio-only content, an audible disclaimer is needed.

Hiding the information only in metadata is not the same as user-facing disclosure. Marking (50(2)) and labelling (50(4)) are two different duties, often held by two different companies.

AI-generated or manipulated text published to inform the public on matters of public interest must be disclosed, unless it has undergone human review or editorial control and someone holds editorial responsibility^[1]. Under the Commission's Article 50 guidelines, a spell-check or a cursory sign-off is not editorial review, and the Code expects the review workflow to be documented^[2].

A practical control is to record, for every public-facing piece:

• whether it was generated by AI;
• whether it was materially modified by AI;
• who reviewed it, and when;
• which editorial owner approved it.

This creates evidence that can be audited later.

The AI Omnibus gave a four-month transition only for the marking duty in Article 50(2), and only to providers whose generative systems were placed on the market before 2 August 2026^[3]. They must mark output by 2 December 2026. Everything else in Article 50 already applies: interaction disclosure, deepfake labels and the public-interest text rule were not deferred. Systems placed on the market from 2 August 2026 had no transition at all.

The same date brings new prohibitions: from 2 December 2026, AI systems that generate non-consensual intimate material or child sexual abuse material are banned^[3]. For a generative image or video product, the marking work and the safety work land in the same sprint.

With six weeks left, the realistic plan for a system already in production is: choose the two marking layers, wire them into the generation path, test that they survive the export paths your users actually take, publish or point to a detector, and document all of it.

1. Are you the provider, the deployer, or both, for each AI feature?
2. Is AI interaction disclosed clearly in the interface, at the first interaction?
3. Are generated outputs marked with two techniques (one for free-form text), above the short-text threshold?
4. Do the marks survive export, re-encoding and the platforms your content goes to?
5. Is there a detection mechanism, and can third parties use it?
6. Are deepfake labels visible at first exposure, with an audible disclaimer where there is no screen?
7. Does public-interest text have a documented human-review and editorial-responsibility workflow?
8. Are transparency decisions logged with the system version, so you can show them in an audit or complaint?

Article 50 should not be handled by legal copy in a footer. A durable implementation needs product, engineering and governance controls working together.

LMXAI treats transparency as part of the delivery pipeline: interface disclosure, provenance manifests, watermarks, audit logs and review states are system features. That keeps compliance close to how the product actually behaves, and it is what an LLM Production Check reviews.

When does Article 50 of the AI Act apply?

Since 2 August 2026. The only exception is the marking duty in Article 50(2) for generative systems already on the market before that date, which has until 2 December 2026 under the AI Omnibus.

Does the 2 December 2026 transition cover chatbot disclosure or deepfake labels?

No. It covers only machine-readable marking of output by providers of generative systems placed on the market before 2 August 2026. Interaction disclosure, deepfake labels and the public-interest text rule have applied since 2 August 2026.

Is the Code of Practice mandatory?

No, it is voluntary. The obligations in Article 50 are mandatory, and the Code describes how to meet them. Signing it is a practical way to show your marking and labelling approach follows the agreed state of the art.

Do we need both metadata and a watermark?

Under the Code, yes for images, audio and video: at least two techniques, such as signed metadata and an imperceptible watermark. Free-form text, which cannot carry metadata, can rely on one technique, and text under about 200 tokens is exempt from watermarking.

We only use a model through an API. Are we a provider under Article 50(2)?

If your product generates content and puts it in front of users under your name, you are likely the provider of that system for Article 50(2), even if the model comes from someone else. Check what the model provider already marks, and add what your own pipeline needs, such as a manifest signed with your credentials.

• Regulation (EU) 2024/1689 — the AI Act
• Regulation (EU) 2026/1744 — the AI Omnibus
• European Commission — Code of Practice on Transparency of AI-generated Content
• European Commission — Article 50 guidelines
• European Commission — Article 50 FAQ

• C2PA and AI watermarking for Article 50
• Practical EU AI Act guide
• High-risk classification and the 2027 timeline
• GPAI provider vs downstream integrator
• EU AI Act FAQ for enterprise teams
• What an EU AI Act compliance deliverable contains