Published on
EU AI Act Article 50 sets the transparency obligations for chatbots, generative AI and deep fakes, and it has applied since 2 August 2026. It binds providers and deployers, including UK and US companies whose AI output is used in the EU. As a Dutch lawyer at MAAK Advocaten in Amsterdam, I help businesses work out which of these duties are theirs.
Part of our overview of EU cybersecurity and digital product laws, within EU product law.
What does EU AI Act Article 50 require?
Article 50 of the EU AI Act requires providers to make AI interaction recognisable and to mark generated content in a machine-readable way. Deployers must disclose deep fakes, certain AI-generated text and the use of emotion recognition or biometric categorisation.
The rules are in Article 50 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744.
| Paragraph | Who | What | Applies from |
|---|---|---|---|
| Art. 50(1) | Provider | design AI systems intended to interact directly with natural persons so that those persons are informed they are interacting with an AI system, unless that is obvious | 2 August 2026 |
| Art. 50(2) | Provider, also of general-purpose AI systems | mark synthetic audio, image, video or text output in a machine-readable format, detectable as artificially generated or manipulated | 2 August 2026; systems placed on the market before that date: by 2 December 2026 (Art. 111(4)) |
| Art. 50(3) | Deployer of an emotion recognition or biometric categorisation system | inform the persons exposed and process personal data under the EU data protection rules | 2 August 2026 |
| Art. 50(4), first subparagraph | Deployer | disclose that a deep fake has been artificially generated or manipulated | 2 August 2026 |
| Art. 50(4), second subparagraph | Deployer | disclose AI-generated or manipulated text published to inform the public on matters of public interest | 2 August 2026 |
| Art. 50(5) | Provider and deployer | give the information clearly and distinguishably, at the latest at the first interaction or exposure, in line with accessibility requirements | 2 August 2026 |
Under Article 50(6), these duties leave unaffected the high-risk requirements of Chapter III, whose Sections 1 to 3 apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I, Section A), and other transparency duties for deployers under EU or national law.
Are you the provider or the deployer?
You are the provider if you develop an AI system, or have it developed, and place it on the market or put it into service under your own name or trademark. You are a deployer if you use an AI system under your own authority.
Both definitions are in Article 3(3) and (4). Paragraphs 1 and 2 of Article 50 are provider duties, paragraphs 3 and 4 deployer duties; in a white-label or API arrangement, the facts decide who is the provider, in particular whose name or trademark the system carries. The contract records that assessment and who handles which Article 50 duty in practice.
As a lawyer at MAAK Advocaten, I do not start with the technology but with two questions: does the system talk to people, and does it produce text, images, audio or video? Then we determine the role. Whoever offers the system under its own name is the provider and must arrange the notice that people are talking to AI and the machine-readable marking of generated content. Whoever uses the system, for example for a deep fake in a campaign, must disclose that itself. A business is often both. So I make one line per system: what it does, who you are, which duty belongs to it.
Does Article 50 apply to companies outside the EU?
Yes. Article 50 applies to providers placing AI systems on the EU market wherever they are established, and to providers and deployers in a third country where the output produced by the AI system is used in the EU.
That follows from Article 2(1)(a) and (c); an open-source licence does not change this (Article 2(12)). For the wider scope question, see our overview of the EU AI Act and recent AI regulation.
What must a chatbot tell the people who use it?
A chatbot must tell people that they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person, given the circumstances and context of use.
Under Article 50(1) this is a design duty of the provider. Article 50(5) requires the notice to be clear and distinguishable, at the latest at the first interaction, and accessible. The extra time in Article 111(4) covers only marking under Article 50(2), so the chatbot notice has applied since 2 August 2026.
How must generative AI output be marked?
Providers of AI systems that generate synthetic audio, image, video or text content must ensure that the output is marked in a machine-readable format and detectable as artificially generated or manipulated.
Under Article 50(2), the technical solutions must be “effective, interoperable, robust and reliable” as far as technically feasible. The duty does not apply to the extent the system performs an assistive function for standard editing, or does not substantially alter the input data provided by the deployer or its semantics.
The AI Act does not prescribe a specific technique; watermarks or metadata are examples of technical options. Under Article 50(7), the Commission encourages codes of practice at Union level for detecting, marking and labelling such content, assesses whether adherence to them is adequate for paragraphs 2 and 4, and may adopt an implementing act if it is not.
Your generative AI service is already live: what must you do by 2 December 2026?
If you are the provider of a system generating synthetic audio, images, video or text that was placed on the market before 2 August 2026, you must take the necessary steps to comply with the marking duty of Article 50(2) by 2 December 2026.
That transition is in Article 111(4). Other dates (Article 113):
- 2 February 2025: prohibited practices (Article 5);
- 2 December 2026: two prohibited practices added to Article 5(1) by Regulation (EU) 2026/1744;
- 2 December 2027 and 2 August 2028: high-risk obligations for Annex III systems and for Annex I, Section A systems.
I would do three things now: establish which output is synthetic, choose with your developers how that output is marked in a machine-readable way, and check whether a function falls under the exception because it only assists with standard editing or does not substantially change the input. Where the technology allows, I recommend marking all generative output, even where an exception may apply: that is easier to explain to customers and regulators. If you do rely on the exception for a function, I write that out in a short internal memo, so that you can later show why you apply it.
Is your generative AI service already live in the EU? I can check which output needs marking before 2 December 2026: contact me as your product law partner in the Netherlands.
When must a business disclose a deep fake or AI-generated text?
A deployer that uses AI to generate or manipulate a deep fake must disclose that the content has been artificially generated or manipulated. The same applies to AI-generated text published to inform the public on matters of public interest.
A deep fake is AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful (Article 3(60)). For an evidently artistic, creative, satirical, fictional or analogous work, an appropriate disclosure that does not hamper the display or enjoyment of the work is enough (Article 50(4)).
For text, the duty does not apply where the content has undergone human review or editorial control and someone holds editorial responsibility for the publication.
Do you need an EU authorised representative for Article 50?
No, not for Article 50 alone. A provider outside the EU needs an authorised representative only for high-risk AI systems (Article 22) and general-purpose AI models (Article 54).
The Article 22 duty applies with the high-risk rules, from 2 December 2027 or 2 August 2028. Article 54(1) has applied since 2 August 2025; for models placed on the market before that date, by 2 August 2027 (Article 111(3)). Certain open-source models without systemic risk are exempt (Article 54(6)).
As a UK or US business, you do not need one for the transparency obligations of Article 50 alone. An authorised representative in the EU is required if you place a high-risk AI system on the European market, and for providers of general-purpose AI models. The AI Act does apply to you as soon as you offer in the EU or the output is used in the EU. I often see businesses appoint a representative as a precaution when there is no need, or forget that their HR tool will later be high-risk. Both cost money.
How does Article 50 work in the Netherlands?
The AI Act is directly applicable in the Netherlands, so the Article 50 duties bind you there without Dutch implementing rules.
The Dutch Uitvoeringswet verordening artificiële intelligentie (AI Act implementing act) is a draft. In its implementation and enforcement review of 23 June 2026, published 1 September 2026, the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) notes that the draft designates it as market surveillance authority for several supervisory domains of the AI Act. Which Dutch authority becomes competent in your situation will follow from that act.
For context: Member States lay down the penalty rules (Article 99(1)). For Article 50, fines go up to EUR 15 000 000 or, for an undertaking, 3% of worldwide annual turnover for the preceding financial year, whichever is higher; for SMEs, including start-ups, and small mid-cap enterprises, whichever is lower (Article 99(4)(g), (6) and (6a)).
Example: a US chatbot provider with Dutch retail customers
Under Article 50, a provider outside the EU and its Dutch customer can each carry their own transparency duty for the same AI tool, with different dates.
Suppose a US company has offered an AI shopping assistant under its own brand since 2025. Dutch web shops use it to chat with shoppers and generate product images; one retailer makes a campaign video with a realistic AI version of a well-known presenter.
The US company is the provider: its chatbot notice has been required since 2 August 2026, and it must mark the generated images by 2 December 2026 (Articles 50(1), 111(4)). The retailer is a deployer and must disclose the deep fake (Article 50(4)). If the retailer asks for a compliance guarantee, the contract decides who bears the commercial risk between them; it does not move the Article 50 duties themselves.
This is a hypothetical example for illustration, not a description of one of our cases.
When do you need a Dutch lawyer for Article 50?
You need a Dutch lawyer when the role split between provider and deployer is unclear, when you want to rely on an exception, when an EU customer asks for guarantees, or when a campaign uses deep fakes.
You can arrange much yourself: an inventory of systems that talk to people or generate content, a marking method chosen with your engineers, and disclosure texts in your interface. Since 2 February 2025, Article 4 has also required measures to support the AI literacy of your staff and others operating AI systems on your behalf, without requiring a guaranteed level for any individual. A lawyer adds value here:
- White-label or API solution (Articles 3, 50): we analyse who marks and who discloses, and draft the clauses.
- Generative service already on the market (Article 111(4)): we check whether the Article 50(2) exception covers a function.
- EU customer asks for guarantees (Article 99(4)(g)): we draft guarantees, indemnities and information duties, as in other AI contracts and smart contracts under Dutch law.
- Deep fake in marketing (Article 50(4)): we review the campaign, including whether the lighter disclosure for evidently artistic, creative, satirical or fictional work applies.
- EU representative (Articles 22, 54): we draft the mandate.
A guarantee that you comply with the AI Act is reasonable in itself. The risk lies in the detail: an open guarantee without limits, an indemnity for everything the customer does with the system, or a duty to help the customer when it changes the purpose. I would limit the guarantee to your own role as provider, exclude the customer’s own use and agree which information you supply.
How does MAAK Advocaten work on Article 50 questions?
As a law firm in Amsterdam, we advise AI providers outside the EU and the EU businesses that deploy their systems, and we can act for them in contract negotiations and in disputes at first instance and on appeal.
In the first days we map, per system, what it does, who the provider and the deployer are, and when it was placed on the market. Then we review your contracts with EU customers and suppliers.
Frequently asked questions about EU AI Act Article 50
Do non-EU companies have to comply with Article 50 of the EU AI Act?
Yes. Since 2 August 2026, Article 50 applies to providers placing AI systems on the EU market, wherever established, and to non-EU providers and deployers whose AI output is used in the EU (Article 2(1)(a) and (c)).
Do we need an EU representative for the AI Act transparency obligations?
No. Article 50 alone does not require an authorised representative. A non-EU provider needs one for high-risk AI systems (Article 22, applying from 2 December 2027 or 2 August 2028) and, unless the open-source exception of Article 54(6) applies, for general-purpose AI models (Article 54, since 2 August 2025).
What is the deadline for generative AI systems already on the market?
Generative AI systems placed on the market before 2 August 2026 must meet the marking duty of Article 50(2) by 2 December 2026 (Article 111(4)). Systems placed on the market from 2 August 2026 must comply from the start.
Does the EU AI Act require a watermark on AI-generated content?
The EU AI Act does not prescribe a specific technique. Article 50(2) requires output to be marked in a machine-readable format and detectable as artificially generated or manipulated. A watermark is one technical option, not a legal requirement.
Does Article 50 apply in the Netherlands without a Dutch law?
Yes. The EU AI Act applies directly in all Member States, including the Netherlands. A Dutch implementing act is still a draft; according to the Autoriteit Persoonsgegevens, the draft designates it as market surveillance authority for several domains. Which Dutch authority becomes competent will follow from that act.
When should we involve a Dutch lawyer for Article 50?
Involve a Dutch lawyer when it is unclear who is the provider and who is the deployer, when you want to rely on an exception, when an EU customer asks you to guarantee compliance, or when a marketing campaign uses deep fakes.
Primary sources
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), consolidated version of 27 July 2026: Articles 2, 3, 4, 5, 22, 50, 54, 99, 111 and 113
- Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), OJ L of 24 July 2026
- Autoriteit Persoonsgegevens: Uitvoerings- en handhaafbaarheidstoets Uitvoeringswet verordening artificiële intelligentie, 23 June 2026, published 1 September 2026
Last checked on 2 November 2026 · next relevant date: 2 December 2026 (Article 50(2) for generative AI systems placed on the market before 2 August 2026)
Does your chatbot or generative AI tool reach users in the EU? Put your situation to me through my page as product law partner in the Netherlands. — Martin Krüger
