EU AI Act Article 50: what you must disclose, and the evidence to keep

The four duties, in plain language

Article 50 creates transparency obligations for two roles. Providers build AI systems; deployers use them in a professional context. Many SaaS teams are both at once. The duties are:

• Interaction disclosure. If a person is interacting with an AI system — a support chatbot, a voice agent, an AI receptionist — they must be informed of that fact, unless it is obvious from the circumstances. "Obvious" is a higher bar than most teams assume: a chat widget named "Support" with a human name and photo is not obvious.
• Machine-readable marking of generated content. Providers of generative systems must mark their output — text, image, audio, video — in a machine-readable format that identifies it as artificially generated or manipulated. In practice this means provenance metadata such as C2PA content credentials and embedded metadata (for example XMP fields), applied at generation time.
• Deepfake and synthetic-content disclosure. Deployers who publish deepfakes or AI-generated/manipulated content must disclose that it is artificial. This covers the marketing team publishing an AI-generated product video just as much as it covers political content.
• Emotion recognition and biometric categorisation. Deployers of these systems must inform the people exposed to them. Separately, AI-generated text published to inform the public on matters of public interest must be disclosed as AI-generated, unless it passed through human review with editorial responsibility taken by a named person or entity.

The Article 50 obligations apply from 2 August 2026. Breaches sit in the Article 99 penalty tier of up to €15 million or 3% of worldwide annual turnover, whichever is higher — the same tier as most other substantive breaches of the Act. National market-surveillance authorities enforce; in practice, the first enforcement actions in regimes like this target operators who made no visible effort at all.

Three worked examples

1. A support chatbot on a SaaS dashboard

You are the deployer (and, if you fine-tuned or white-labelled the model under your own brand, possibly the provider too). The compliant pattern is a disclosure at the point of interaction, in the interface itself: "You're chatting with an AI assistant. A human can take over at any time." A line in your terms of service does not count — the duty is to inform the person at the time of interaction, in a way they will actually see. Keep a dated screenshot of the disclosure as shipped, and the release version that introduced it.

2. An AI-written help-centre article

Help-centre articles are not usually "matters of public interest," so the strictest text-disclosure clause may not bite — but the moment the same pipeline publishes commentary on public issues, it does. The robust approach does not depend on that line-drawing: label AI-drafted public content ("Drafted with AI, reviewed by [team]"), and if a person with editorial responsibility reviewed and approved it, record who, because that human-review fact is exactly what the exception turns on. A review log with names and dates is evidence; a memory that "someone probably checked it" is not.

3. An AI-generated product image in an ad

Two duties meet here: the generation tool's provider should have marked the file (C2PA/XMP), and you as deployer should disclose the artificial nature where the law requires it. The practical failure mode we see constantly: the metadata does not survive the journey. Ad platforms and social networks recompress uploads, and recompression strips or mangles embedded provenance metadata. A file that was correctly marked in your asset library can arrive on Instagram or a display network with the mark gone. That is why our DisclosureGuard embed offers a free label drift check: upload the creative, put it through a simulated platform-style recompression, and see whether the disclosure metadata is still there. If it is not, the fix is a visible disclosure on the creative or caption — the layer you control end-to-end.

The evidence trail: what to keep

Disclosure law is enforced against records. When an authority or an enterprise customer asks "show me how you comply," these are the artifacts that answer:

• Disclosure inventory. A list of every AI surface in your product (chatbots, generated emails, synthetic media, voice agents) with the disclosure each one shows and where. If a surface is not on the list, assume it is non-compliant until proven otherwise.
• Dated proof of placement. Screenshots or release records showing each disclosure live, with dates. Disclosures quietly removed in a redesign are a classic finding.
• Generation and marking logs. For generated media: which tool produced it, when, and what provenance marking was applied — plus periodic drift checks that the marking survives your distribution channels.
• Human-review records for AI text published on matters of public interest: reviewer, date, and the version approved.
• Vendor paperwork. Your model providers' own Article 50 documentation. Their marking duty is theirs, but your disclosure duty is yours; the contract file should show you asked.

This record-keeping is the reason DisclosureGuard exists: it checks AI-generated content against disclosure requirements and keeps the evidence trail as a by-product of the check, instead of as a separate compliance chore. The free tier is enough to run a first pass over your public surfaces.

A one-afternoon compliance pass

• List every place a user or reader meets AI in your product and content (an hour with your team beats a week of tooling).
• For each: is there a disclosure at the point of contact? Photograph it. If not, add one — interface copy is a same-day fix.
• Take your five most-distributed AI media assets and run them through the channels you publish on; check the provenance metadata on the far side.
• Start the review log for public-interest text. One shared document, names and dates.
• Put the inventory and proofs in one folder your future self — or an auditor — can open.

Related guides: the AI vendor terms changes that quietly move your compliance duties and how to keep tamper-evident audit trails for AI agent actions.