EU AI Act Article 50: AI Labelling Checklist for Developers (2026)

Scroll through any European feed today and a quiet question hangs over every image, voice and chat bubble: was a human behind this? Since 2 August 2026, EU law expects an honest answer. EU AI Act Article 50, the rule behind AI labelling and AI transparency obligations, is now live, and developers shipping chatbots, image generators or synthetic media to EU users sit on the front line. Here is what it demands, what changed this year, and a practical checklist you can run against your product this week.

What Is EU AI Act Article 50?

Article 50 of Regulation (EU) 2024/1689 sets transparency duties for AI systems that talk to people or create content. It applies whether or not a system is classed as high-risk, so even a simple marketing chatbot is in scope. It contains four core duties, plus a rule on how disclosures must look and when they must appear:

- Article 50(1): providers must design AI systems that interact with people so users are told they are dealing with AI, unless that is obvious from context.

- Article 50(2): providers of systems generating synthetic audio, images, video or text must mark outputs in a machine-readable format so they are detectable as AI-generated or manipulated.

- Article 50(3): deployers of emotion recognition or biometric categorisation systems must inform the people exposed to them.

- Article 50(4): deployers must disclose deepfakes, and AI-generated text published to inform the public on matters of public interest.

- Article 50(5): disclosures must be clear, distinguishable, accessible, and given at the latest at first interaction or exposure.

Was Article 50 Delayed by the Digital Omnibus? Mostly No

This is the question developers keep asking, and the answer matters. The Digital Omnibus on AI, in force since 27 July 2026, postponed high-risk obligations: Annex III systems now follow on 2 December 2027, and AI embedded in regulated products (Annex I) on 2 August 2028. Article 50 was not postponed and has applied since 2 August 2026.

There is one narrow exception. For generative systems already on the EU market before 2 August 2026, the Article 50(2) machine-readable marking duty applies from 2 December 2026. Anything placed on the market from 2 August 2026 must comply from day one. With that date less than two months away, treat the grace period as a countdown, not a reprieve.

Provider or Deployer? Know Your Role

Providers build AI systems or place them on the market; deployers use them under their own authority. Many teams are both. A SaaS company that fine-tunes a model and embeds it in its product is a provider for Articles 50(1) and 50(2), and a deployer for 50(4) when it publishes outputs itself. Map your role per feature, not per company.

The AI Labelling Checklist for Developers

1. Inventory every AI touchpoint. List chatbots, voice agents, image, video, audio and text generators, and any emotion or biometric features. You cannot label what you have not found.

2. Disclose AI interaction by design (50(1)). Show a clear "you are talking to an AI" notice at or before the first message. Skip it only where context makes AI use genuinely obvious, and document why.

3. Apply machine-readable marking (50(2)). Embed watermarks, metadata or equivalent signals into generated audio, image, video and text. Aim for solutions that are effective, interoperable, robust and reliable as far as technically feasible. Assistive editing that does not substantially alter the input is carved out.

4. Make marks detectable. A mark nobody can read is a failed control. Test that your signals survive compression, cropping and format conversion, and that detection works for third parties.

5. Label deepfakes visibly (50(4)). Where your product publishes realistic synthetic media, add a clear visible or audible disclosure. For evidently artistic, creative, satirical or fictional works, disclosure can be lighter so it does not spoil the experience.

6. Flag AI text on public-interest topics. Published AI-generated text that informs the public needs a label, unless a human has reviewed it and a person holds editorial responsibility. Record that review.

7. Notify people exposed to emotion recognition or biometric categorisation (50(3)). Pair the notice with GDPR-compliant processing.

8. Make disclosures timely and accessible (50(5)). Show them at first exposure, in plain language, and in formats everyone can use. Audio-only content needs an audio disclaimer.

9. Log, test and document. Keep evidence of design decisions, marking tests and review workflows. Include your marking and disclosure flows in security testing so they cannot be stripped or spoofed easily.

Your Shortcut: The Code of Practice and Commission Guidelines

Two official resources make life easier. The European Commission published the final Code of Practice on marking and labelling AI-generated content on 10 June 2026. It is voluntary, and the Commission and the AI Board have assessed it as adequate, so signatories can rely on it to demonstrate compliance. On 20 July 2026, the Commission added non-binding guidelines that explain scope, with practical examples for each Article 50 duty. Read both before you finalise your design.

What Happens If You Ignore It?

Breaches of Article 50 can draw administrative fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher; for SMEs and start-ups the lower amount applies. National authorities enforce the rules, and unlabelled synthetic content also puts customer trust at risk in a market that already expects strong data protection.

Turn the Checklist Into Compliance Evidence

A checklist is a start; evidence is what regulators and enterprise buyers ask for. VISTA InfoSec's EU AI Act compliance services can help you scope your obligations and close gaps, and the EU AI Act compliance checklist offers a wider walkthrough. Because AI systems process personal data, align your labelling work with GDPR compliance consulting and the AI and GDPR preparation expert roundup.

Finally, prove your controls hold up. Penetration testing can show whether your marking and disclosure flows can be bypassed, while ISO 27001 consulting gives you a management system to keep them governed. Ready to move? Book a free compliance consultation and turn Article 50 from a risk into a trust signal.