Article 50 of the AI Act: when people must be told they are dealing with AI
Transparency obligations apply from 2 August 2026. Who must disclose a chatbot, who must label a deepfake, and when an AI-written press release may go unlabelled.
· 6 min read
In brief
Article 50 of the AI Act lays down transparency obligations that apply to certain AI systems regardless of their risk class. People must be told when they are dealing with AI; the output of a content-generating system must be marked in a machine-readable way; those subjected to emotion recognition or biometric categorisation must be informed; and a deepfake, as well as AI text that informs the public, must be disclosed as artificially generated. Some of the obligations fall on the provider, some on the deployer, and the line decides what your own organisation has to do. The obligations apply from 2 August 2026.
Whose obligation is which
Article 50 divides the obligations between two actors. The provider develops the system and places it on the market. The deployer uses the system in its own operations: a municipality, a company, a school. Most Finnish organisations are deployers, and their share is smaller but not nothing.
| Paragraph | Obligation | Whose |
|---|---|---|
| 50(1) | People are informed that they are interacting with an AI system, unless it is obvious | The provider designs the system so |
| 50(2) | Synthetic audio, image, video and text is marked in a machine-readable way and detectable as artificial | Provider |
| 50(3) | Those subjected to emotion recognition or biometric categorisation are informed of the system's operation | Deployer |
| 50(4) | A deepfake is disclosed as artificially generated or manipulated; text informing the public on matters of public interest is disclosed as AI-generated | Deployer |
| 50(5) | The information is given clearly and distinguishably no later than the first interaction or exposure, meeting accessibility requirements | Both, for their own part |
Our skills catalogue makes one point here that bears repeating: machine-readable marking is the provider's obligation, and the deployer's task is to recognise when it is missing from a system it acquired, not to implement it. An organisation that buys an image generator does not watermark files by hand; it asks the vendor how Article 50(2) has been implemented and records the answer.
Chatbots, phone services and obviousness
The obligation in paragraph 1 is worded for the provider, but the deployer is the one whose customer meets the system. The deployer's task has two parts: to make sure in procurement that the system says it is AI, and to see that the disclosure actually happens in its own service in a clear and distinguishable way before the first interaction, as paragraph 5 requires.
The exception covers situations where the AI is obvious from the point of view of a "reasonably well-informed, observant and circumspect" person, taking the circumstances into account. A chat window in the corner of a website called "Assistant" is not obvious. A phone service where a synthetic voice answers with a name is not obvious. Whoever discloses is always on the safe side.
Deepfakes and press releases
Paragraph 4 concerns the deployer in two situations. The first is a deepfake: image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear authentic. Its deployer must disclose that the content has been artificially generated or manipulated. Where the content is part of an evidently artistic, creative, satirical or fictional work, the disclosure is made in a way that does not hamper the display of the work.
The second is text published with the purpose of informing the public on matters of public interest. It must be disclosed as artificially generated or manipulated, unless the AI-generated content has undergone human review or editorial control and someone holds editorial responsibility for the publication. A municipal press release that communications staff drafted with a language model and read before publishing therefore needs no label. The same release straight from the model to the website does.
This is where organisational practice decides. If every published text has a reader and a responsible person, the labelling question for text is settled by process rather than case by case. If images are produced with AI, the practice says which of them are deepfakes, that is realistic-looking, and how they are disclosed.
What the Omnibus changed and what it did not
The AI Act's general application began on 2 August 2026, and Article 50 with it. Regulation (EU) 2026/1744 postponed the application of the high-risk obligations to December 2027 and August 2028, but it did not postpone the transparency obligations. It did two other things. It added to Article 111 a paragraph under which providers of content-generating systems placed on the market before 2 August 2026 must take the measures needed for machine-readable marking by 2 December 2026. And it removed from Article 50(7) the Commission's power to approve codes of practice on marking by implementing act, because the legal effects of such codes are limited.
For a deployer this means that a system placed on the market before 2 August 2026 may be in a transition period for marking until 2 December 2026, and that it is worth asking the vendor. Your own obligations, disclosing a chatbot and a deepfake, are in force now. The transition dates as a whole and the amended Article 4 on AI literacy are covered in Article 4 of the AI Act.
When the obligation does not apply
Each paragraph of Article 50 carries its own exception for systems that may lawfully be used to detect, prevent, investigate or prosecute criminal offences, subject to safeguards for third parties. The exception is not general: under paragraph 1 people must still be told about AI where the system is publicly available for reporting a criminal offence, and the text obligation in paragraph 4 is separately lifted by human review and editorial responsibility. Machine-readable marking is not required where the system performs an assistive function for standard editing or does not substantially alter the input provided by the user or its meaning: spell-checking and colour correction do not make a text or an image artificial. And an illustration that depicts no real person, object, place or event in a realistic way is not a deepfake; a realistic AI image of a real building, on the other hand, is.
Paragraph 6 recalls that these obligations do not replace others. Under Article 26(11) the deployer of a high-risk system must additionally tell people that they are subject to a high-risk system when it makes or helps make decisions about them, and the GDPR's information obligations remain in force regardless of AI.
Who needs to know this
Our skills catalogue treats transparency obligations as a four-level skill. Everyone knows that people must be told about AI and that a deepfake must be labelled. Someone who publishes content labels their deepfakes and recognises a service that fails to say it is AI. The head of an area is responsible for the disclosures in that area. The AI officer defines the organisation's transparency practice and resolves the edge cases: what counts as an artistic work, when a label may be unobtrusive, what to do when an acquired system does not meet the provider's obligation.
The AI officer's role as a whole is described in Who in the organisation is responsible for AI use?. A criminal does not comply with Article 50, so labelling does not protect against scams; that is covered in Phishing and AI-assisted scams.
Frequently asked questions
Must a website chatbot say that it is AI?
Yes, unless it is obvious in the circumstances to a reasonably informed and attentive user. Under Article 50(1) the obligation is the provider's: the system must be designed so that users are informed they are interacting with AI. An organisation that deploys a chatbot checks in procurement that the system does so, and good practice is to state it additionally in its own service, clearly and before the first interaction, as Article 50(5) requires of the form of the notice.
Must an AI-made image or text be labelled?
It depends on what it is. A deepfake, meaning an image, audio or video resembling a real person, place or event, must be disclosed by the deployer as artificially generated or manipulated. Text published to inform the public on matters of public interest must be disclosed as AI-generated unless it went through human review and someone holds editorial responsibility for publishing it. A deepfake is, in the regulation's definition, content that resembles existing persons, objects, places, entities or events and would falsely appear authentic; an ordinary illustration that depicts nothing real in a realistic way is not covered. Machine-readable marking of the file itself is the provider's obligation, not the user's.
From what date do the obligations apply?
The AI Act's general application, and Article 50 with it, began on 2 August 2026. Regulation (EU) 2026/1744 postponed the high-risk obligations but not the transparency obligations. It gave providers of content-generating systems placed on the market before 2 August 2026 until 2 December 2026 to implement machine-readable marking, and removed the Commission's power to approve codes of practice on marking by implementing act.
What do emotion recognition and biometric categorisation require?
Under Article 50(3) the deployer must inform the people exposed to the system of its operation and process their personal data in accordance with the GDPR. In workplaces and educational institutions emotion recognition is additionally a prohibited practice under Article 5, with narrow medical and safety exceptions, so in practice the question is rarely about disclosure but about whether the system may be used at all.