Most AI regulation arrives looking like a policy problem.
The EU's newest transparency rules arrive looking like a product requirement.
On August 2, 2026, Article 50 of the EU AI Act starts to apply. For many AI teams, the practical work is surprisingly concrete: add a disclosure to an agent, preserve a machine-readable signal in generated media, label a deepfake, or prove that a human editor actually reviewed public-interest text.
The button, badge, metadata pipeline, and editorial approval log are no longer just interface details. They can be compliance controls.
The timing is easy to misread. The EU's recent AI Omnibus extended several high-risk-system deadlines, but the Commission's current implementation timeline still says Article 50 transparency rules begin on August 2. The Commission also says enforcement starts for the rules that are already applicable.
That makes this a launch checklist, not a distant policy forecast.
This article is a practical reading of official EU materials, not legal advice. Scope depends on the facts of a specific system and deployment.
The Rule Has Four Interfaces, Not One
The cleanest way to understand Article 50 is to stop asking, "Do we need an AI label?" and start asking two questions:
- Are we the provider of the AI system, the deployer using it, or both?
- Is the obligation meant for a machine to detect or a person to notice?
The Commission's Article 50 guidance reduces the core duties to four recurring cases:
| Responsible party | Trigger | Product implication |
|---|---|---|
| Provider | A person directly interacts with an AI system | Clearly inform the person that the interaction is with AI, unless that fact is obvious |
| Provider | A system generates or manipulates synthetic text, audio, image, or video | Add an effective, detectable, machine-readable mark, subject to scope limits and exceptions |
| Deployer | People are exposed to emotion recognition or biometric categorisation | Inform the people exposed to the system |
| Deployer | Deepfakes or certain public-interest text are published | Provide a clear, perceivable disclosure when the relevant conditions are met |
This distinction matters because one company can occupy different roles in different flows.
A startup that builds and sells an AI avatar may be a provider. A retailer that uses the avatar for customer support may be a deployer. A platform that builds the model, ships the experience, and publishes its outputs may be both.
The Commission's FAQ also says providers outside the EU can fall within the Act when their system's output is used in the EU. "We are not headquartered in Europe" is not a reliable routing rule.
The Biggest Product Trap: A Machine Mark Is Not a Visible Label
Article 50 creates two transparency layers that are easy to collapse into one.
The first is provider-side provenance. Generative systems in scope must produce outputs marked in a machine-readable format so the content can be detected as AI-generated or manipulated.
The second is deployer-side disclosure. When a deployer publishes a deepfake, for example, the disclosure must be understandable and perceivable by a person. The Commission explicitly says the deployer cannot rely only on the embedded machine-readable mark.
In product terms, these are separate acceptance criteria:
- The exported asset retains a detectable origin signal after the normal generation workflow.
- The person encountering covered content sees or hears an appropriate disclosure at the required moment.
Passing one test does not automatically pass the other.
This is especially relevant to synthetic media teams. Our earlier look at Sora 2 and AI-generated reality focused on the trust problem. Article 50 turns part of that abstract trust debate into an implementation decision: provenance must travel with the output, while disclosure must survive all the way to the audience.
Chatbots and Agents Need Disclosure Before Trust Forms
For systems that directly interact with people, the official FAQ says the notice should appear from the start of the first interaction, in a clear, distinguishable, and accessible manner.
There is an exception when it is obvious that the person is interacting with AI. But the guidance says that exception should be interpreted restrictively.
The practical product lesson is straightforward: do not make a user hunt through a privacy policy to discover that the helpful "specialist" in the chat window is automated.
An inline disclosure near the first exchange is easier to test, easier to localize, and easier to preserve across web, mobile, voice, and embedded surfaces. Teams running agents in production should add this requirement alongside permission, monitoring, and fallback controls like those in our AI agents production guide.
The disclosure also needs to survive handoffs. If an AI agent starts a conversation and a human joins later, the interface should not erase the nature of the earlier interaction or make the current speaker ambiguous.
Human Review Is a Real Process, Not a Checkbox
One of the most consequential rules concerns AI-generated or manipulated text published to inform the public on matters of public interest.
The obligation is not a blanket label for every AI-assisted sentence. The official FAQ describes three conditions: the text is published, it informs the public, and it concerns a matter of public interest. It also lists a human-review and editorial-control path that can remove the labelling requirement for this category of text.
But "human reviewed" means more than running spell-check.
According to the Commission, substantive review involves a person with relevant knowledge and professional judgment examining the content. Editorial control means someone has authority to approve, change, or reject the substance, including fact-checking and source evaluation. A superficial or purely grammatical check does not qualify.
That turns editorial governance into an auditable workflow:
- Who reviewed the substance?
- What sources did they check?
- Could they reject or materially rewrite the draft?
- Who holds responsibility for publication?
- Is that decision recorded?
If your "human in the loop" is a contractor clicking approve under time pressure, you may have a workflow label rather than meaningful editorial control.
This is also why the broader question of when AI feels too human now has a less philosophical answer: people need enough information to calibrate trust before they act on synthetic interaction or content.
The Exceptions Are a Routing Table, Not a Loophole
The Commission's guidance includes important limits. The machine-marking obligation does not treat every output identically.
The FAQ identifies examples that can fall outside Article 50(2), including source code, short sequences of numbers or symbols, machine-to-machine outputs with no human exposure, and certain closed-loop industrial or product-development uses. It also describes an exception for standard editing that does not substantially alter the input or its meaning, plus a narrow route for qualifying business-to-business or industrial contexts.
These details matter, but they should be handled as classification logic—not a one-line company policy.
"We only sell to businesses" does not settle whether an output ultimately reaches a person. "A human touched it" does not settle whether the system merely assisted standard editing. "It is metadata" does not settle whether it remains machine-readable and detectable through the delivery chain.
Good compliance engineering looks like a decision tree with evidence attached to each branch.
The Grace Period Is Much Narrower Than It Sounds
There is a limited transition, but it is not a universal delay.
The Commission says systems placed on the market before August 2, 2026 get until December 2, 2026 for the specific marking and detection obligation in Article 50(2). Content generated before August 2 does not require retroactive labelling, though the Commission encourages voluntary disclosure where possible.
Other Article 50 duties are not swept into that same four-month window.
This is the sentence product leaders should repeat internally: the grace period belongs to a particular obligation and a particular class of existing systems, not to Article 50 as a whole.
Record the date each system was placed on the market, the role your company plays, and the exact paragraph behind any delayed work. If the evidence is fuzzy, treat that as a risk to resolve rather than a reason to assume the later date.
A 48-Hour Checklist for AI Product Teams
You do not need to solve every question with one giant policy document. Start with the product surface and work backward.
1. Inventory every EU-facing AI touchpoint
Include chatbots, voice agents, avatars, image and video generators, content pipelines, emotion-analysis tools, and AI features embedded inside a larger product.
2. Assign a role per flow
Mark whether you are acting as provider, deployer, or both. Repeat the exercise when the same system is sold, embedded, or operated under another company's name.
3. Test first-interaction disclosure
Open each interactive AI experience as a new user. Confirm the disclosure is immediate, clear, accessible, and preserved on every supported surface.
4. Split provenance from presentation
Create separate owners and tests for machine-readable output marking and human-visible labels. Verify what happens after export, compression, reposting, and format conversion.
5. Review synthetic-media and public-interest publishing
Identify deepfakes and public-interest text. Document where visible disclosure is added and, for text, whether substantive human review and editorial responsibility are present.
6. Write down every exception
For code, standard editing, machine-to-machine output, or another claimed exception, capture the facts and official guidance that support the decision.
7. Preserve evidence
Keep screenshots, accessibility results, provenance tests, model and product versions, review logs, system launch dates, and named owners. A control that cannot be demonstrated is difficult to defend.
8. Decide whether to use the voluntary Code of Practice
The EU's Code of Practice on Transparency of AI-generated Content is voluntary, but Article 50 is not. The Commission says signatories can rely on the code's measures to demonstrate compliance with the marking and labelling duties; companies using another approach must show that it is equivalently adequate.
Then have qualified legal counsel validate the scope and final implementation for your products.
The Stakes Are Real, but the Strategic Opportunity Is Bigger
The Commission says penalties for relevant violations can reach €15 million or 3% of worldwide annual turnover, with proportionality considered for smaller companies.
That number will get attention. But fear is not the most useful product strategy.
The deeper shift is that AI transparency is becoming a reusable product primitive. Teams that build disclosure components, durable provenance, editorial controls, and auditable ownership now will be better prepared for new models, new media formats, and new jurisdictions.
The winning implementation will not be the loudest warning badge. It will be the one that gives people meaningful context without breaking the experience—and gives the company evidence that the context was delivered.
Final Take
August 2 is not the day every part of the EU AI Act suddenly lands at once. Several high-risk-system deadlines have moved.
But Article 50 is real, current, and unusually close to the interface.
For AI builders, the first move is not to add "AI-powered" to a footer. It is to map the flow:
Who built the system? Who deployed it? What did it generate? What must a machine detect? What must a person understand? Who can prove the answer?
That is the new transparency stack.
Sources
- European Commission: Guidelines on transparency obligations for providers and deployers of certain AI systems
- European Commission: Article 50 transparency obligations FAQ
- European Commission: Quick Facts — Transparency rules for AI systems
- EU AI Act Service Desk: Implementation timeline
- European Commission: Code of Practice on Transparency of AI-generated Content
- European Commission: AI Omnibus enters into force