What Article 50 of the EU AI Act asks of UK and North American firms, what changes on 2 December 2026, and a checklist to start now.
Article 50 of the EU AI Act is the transparency rule: since 2 August 2026 it has required firms to tell people when they are talking to an AI system and to mark or label AI-generated content, and it can reach UK and North American firms whose AI output is used in the EU.
The Digital Omnibus moved the EU's high-risk deadlines to December 2027 and beyond. It didn't move this one. This guide covers what Article 50 asks in plain terms, what changes on 2 December 2026 and how to tell whether you're a provider or a deployer, then gives you a checklist to start this week.
What does Article 50 of the EU AI Act require?
Article 50 isn't about whether your AI is accurate or safe. It's about whether people know it's AI. It sets four kinds of transparency duty, and they fall on different parties.
| Duty | Who it falls on | Applies from |
|---|---|---|
| Tell people they are interacting with an AI system, such as a chatbot or voice agent | Mainly the provider, which has to build the disclosure in. If you put the system in front of customers, check it's there | 2 August 2026 |
| Mark AI-generated content in a machine-readable way, so it can be detected as AI-generated | Providers of generative AI systems | 2 August 2026 for new systems. 2 December 2026 for systems already on the market before then |
| Disclose deepfakes, and AI-generated text published to inform the public on matters of public interest | Deployers | 2 August 2026 |
| Tell people when they are exposed to emotion recognition or biometric categorisation | Deployers | 2 August 2026 |
Everything in that table has applied since 2 August 2026, except marking by older generative systems. If your web chat still doesn't tell customers they're talking to an AI system, 2 December isn't your deadline. You've already passed it.
The article also has conditions and exceptions this table leaves out. Read the text before you decide something is out of scope, and write down why.
What changes on 2 December 2026?
Two things.
The marking grace period ends for older generative AI systems. Generative AI systems placed on the EU market before 2 August 2026 were given until 2 December 2026 to meet the Article 50(2) duty to mark their output in a machine-readable way. Systems placed on the market from 2 August never had a grace period. The duty sits with providers, so for most firms it's a question for vendors. Ask it now, in writing.
A new prohibition applies. From 2 December 2026, AI systems that generate non-consensual intimate imagery or child sexual abuse material are a prohibited practice. Most regulated firms don't build image generators. If you offer image or video generation to customers, or embed a tool that does, ask the vendor what stops it producing this material, and keep the answer.
The Annex III high-risk deadline stays at 2 December 2027. The list you build for Article 50 is the first page of the inventory you'll need for it, so build it properly once.
Does the EU AI Act apply to UK and North American firms?
It can. Article 2 covers providers that place AI systems on the EU market, wherever they are established. It also covers providers and deployers outside the EU where the output of the AI system is used in the EU. The test is where the output is used, not where your head office is.
The usual ways a UK, US or Canadian firm's AI output reaches the EU:
- a web chat or AI agent on a site that serves customers in EU countries
- a voice agent that answers calls from EU customers
- AI-generated images, audio or video in campaigns that run in EU markets
- a generative AI product or feature sold to EU customers
How far "used in the EU" reaches at the edges is still argued over. If your only EU contact is the odd visitor to your website, take advice rather than guessing. If you have EU customers, work on the basis that you're in scope.
Am I a provider or a deployer under the EU AI Act?
This is the decision that matters most, because the duties differ.
- A provider develops an AI system, or has one developed, and puts it on the market or into service under its own name.
- A deployer uses an AI system under its own authority in the course of its business.
The trap is assuming you're only a deployer because you bought the model. If you took a vendor's model, built your own customer chatbot around it and launched it under your brand, you may well be the provider of that chatbot as well as its deployer. The vendor provides the model, not what you built.
| What you do | Likely role | What Article 50 asks of you |
|---|---|---|
| Built a chatbot or voice agent on a model API, run under your brand | Provider and deployer | Build in the AI disclosure. Check whether the marking duty applies to its output |
| Bought a vendor's chatbot or voice agent and switched it on | Deployer | Check the disclosure is on and clear. Get the vendor's position in writing |
| Use a vendor's tool to make campaign images, audio or video | Deployer | Label deepfakes. Ask the vendor how its output is marked |
| Publish AI-written updates to inform the public | Deployer | Disclose that the text is AI-generated, unless an exception applies |
| Use emotion recognition or biometric categorisation | Deployer | Tell the people exposed to it. First check the use isn't prohibited outright |
| Sell a generative AI product to EU customers | Provider | Machine-readable marking, by 2 December 2026 for older systems |
Where the answer isn't clear, write down which role you've assumed and why. A reasoned decision you can show beats a confident one you can't.
What is the Code of Practice on transparency of AI-generated content?
The European Commission published a voluntary Code of Practice on transparency of AI-generated content on 10 June 2026. It has two sections, signed separately: one for providers on marking and detecting AI-generated content, and one for deployers on labelling deepfakes and public-interest text. More than 180 organisations were on the first signatory list.
Signing is optional and the duty applies either way. For most deployers the Code is more useful as a question for vendors: have you signed the provider section, and if not, how do you mark output instead? An answer in writing is evidence. A reassurance on a sales call isn't.
What are the penalties for breaching Article 50?
Breaches of the transparency duties sit in the Act's general penalty tier: fines of up to EUR 15m or 3% of global annual turnover. Prohibited practices, including the new one from 2 December, sit in the top tier: up to EUR 35m or 7%.
The Article 50 checklist
Copy this into a spreadsheet and put a person's name in the owner column. A role isn't an owner.
| Item | Who owns it | Done (yes or no) |
|---|---|---|
| Every customer-facing chatbot and voice agent listed, including vendor tools with AI switched on | Head of operations or digital | Yes / No |
| Every flow producing AI-generated images, audio, video or published text listed | Marketing or communications lead | Yes / No |
| Provider or deployer decision recorded for each system, with the reason | Compliance or legal | Yes / No |
| Disclosure wording agreed, and checked where customers first meet the system | Product owner, signed off by compliance | Yes / No |
| Deepfake labelling rule added to the content guidelines | Marketing lead | Yes / No |
| Position on AI-generated public-interest text decided and written down | Communications lead and compliance | Yes / No |
| Emotion recognition and biometric categorisation confirmed not in use, or covered by a notice | Compliance | Yes / No |
| Each generative vendor's marking position received in writing, including systems on the market before 2 August 2026 | Procurement or vendor manager | Yes / No |
| Named owner and review date set for each system | Accountable executive | Yes / No |
| Decision record filed where audit can find it | Compliance | Yes / No |
What should we do first?
You don't need a programme to start. You need five things done in order.
- List every customer-facing chatbot, voice agent and AI-generated content flow. Include pilots, vendor tools where AI was switched on by default, and anything a team bought on a card. Ask marketing and the contact centre directly. They'll know things IT doesn't.
- Decide provider or deployer for each. Use the table above. If you built it and it carries your name, start from the assumption that you're the provider.
- Check the disclosure wording and where it appears. Open each chatbot as a customer would. Ring the voice line. Does it say it's AI before the customer shares anything, in plain words, in every language you serve EU customers in?
- Ask vendors for their marking position in writing. Does the system mark its output in a machine-readable way, and how? Was it on the EU market before 2 August 2026, and will marking be in place by 2 December? Have you signed the Code of Practice? What stops it generating prohibited content?
- Record the decision. One page per system: what it is, your role, which duties apply, the disclosure wording and where it shows, the vendor's answer, the owner and a review date. Our practical guide to AI governance shows where that record fits, and our guide to the AI evidence pack, coming on 1 December, covers what to keep.
Running AI agents? Our AI agent governance framework, coming on 11 November, covers identity and ownership.
This is a business view, not legal advice.
How ETT can help
ETT Group delivers governed AI and automation for regulated firms in the UK, US and Canada, mostly on UiPath. If you want to work through your list with us, request an AI session.
FAQ
Did the Digital Omnibus delay Article 50?
No. The transparency duties have applied since 2 August 2026. The Omnibus moved the Annex III high-risk obligations to 2 December 2027 and Annex I to 2 August 2028. The only Article 50 relief was for generative AI systems already on the market, which have until 2 December 2026 to meet the marking duty.
Is a line in our terms and conditions enough to tell people they're dealing with AI?
Treat it as no. The point of the duty is that people know they're dealing with AI, and almost nobody reads the terms. Put the disclosure where the conversation starts, and check the article's wording on timing.
Is signing the Code of Practice on AI-generated content mandatory?
No. It's voluntary, and the Article 50 duties apply whether you sign or not. Deployers mostly use it to ask vendors the right questions.
Does ISO/IEC 42001 cover Article 50?
Not on its own. ISO/IEC 42001 isn't a harmonised standard under the EU AI Act, and no harmonised standard has been cited yet. It's a sound frame for the inventory and ownership work, but you still need specific decisions on disclosure and marking. More in ISO 42001 and the EU AI Act.
Sources
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex, adopted 8 Jul 2026, published in the Official Journal 24 Jul 2026, in force 27 Jul 2026
- EU Digital Omnibus on AI enters into force, K&L Gates via National Law Review, 31 Jul 2026
- EU AI Act, Article 50: transparency obligations, artificialintelligenceact.eu, accessed 9 Oct 2026
- EU AI Act, Article 2: scope, artificialintelligenceact.eu, accessed 9 Oct 2026
- EU AI Act implementation timeline, artificialintelligenceact.eu, accessed 9 Oct 2026
- EU AI Act timeline, revision 2, Future of Privacy Forum, Jul 2026
- Code of Practice on transparency of AI-generated content: FAQ, European Commission, 2026
- AI Office enforcement notice and Code signatories, European Commission (Futurium), 3 Aug 2026
- EU AI Act high-risk deadline after the Omnibus (penalty tiers), Cloud Security Alliance, 1 Aug 2026
- prEN 18286, ISO/IEC 42001 and the EU AI Act, Cloud Security Alliance, 28 Apr 2026