Labelling AI-generated content under Article 50 of the EU AI Act

Two duties, two actors

Article 50 of Regulation (EU) 2024/1689 separates the technical layer from the human-facing layer, and the two should be kept apart. The provider of a generative AI system, the person that develops the system, or has it developed, and places it on the market or puts it into service under its own name, including for its own use, must ensure that the system's outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. That duty covers synthetic audio, images, video and text, and it is implemented in the infrastructure: watermarks, metadata, provenance signatures, fingerprinting. The duty attaches to the system, including a general-purpose AI system built on someone else's model; supplying a bare general-purpose AI model triggers the separate model obligations, and this one does not apply.

It is not a visible label, and it is qualified by feasibility, of which more below. It also does not apply to the extent the system performs an assistive function for standard editing or does not substantially alter the deployer's input or its meaning, which is where much everyday AI-assisted drafting sits; the Commission's guidelines give examples of what counts as standard editing and exclude, among other things, short strings, source code and machine-to-machine outputs.

The provider also owes the interaction duty in Article 50(1): a system intended to interact with natural persons must be designed and developed so that the people concerned are informed they are dealing with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person. The chatbot disclosure is therefore a design obligation of the system's provider. A business that only deploys a vendor's chatbot as supplied is not that provider, and should check before roll-out that the system complies; a business that has a chatbot built for it, or builds one on a third-party model, and puts it into service under its own name is the provider of that system as well as its deployer.

The deployer, the business using an AI system, owes duties to inform the people exposed, but only in defined cases: disclosure for deepfakes and for certain public-interest text, and, under Article 50(3), a duty to inform the persons exposed where the deployer operates an emotion-recognition or biometric-categorisation system. The Commission's Article 50 FAQ and the AI Act Service Desk (whose text has not yet been updated for the Digital Omnibus amendments) lay the structure out authoritatively.

Text: what the deployer duty covers

Take the question in the two layers. At the provider layer, text is covered: a provider of a system that generates synthetic text must mark those outputs machine-readably. At the deployer layer, the disclosure duty for text is deliberately narrow: it applies where AI-generated or AI-manipulated text is published with the purpose of informing the public on matters of public interest, and even then it falls away where the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility for its publication. That exception is the practical centre of gravity.

Two further limits sit in the text: where a deepfake forms part of an evidently artistic, creative, satirical, fictional or analogous work, the disclosure duty is limited to an appropriate disclosure that does not hamper the display or enjoyment of the work, and each paragraph carries its own criminal-law carve-out: the chatbot duty in Article 50(1) is lifted for systems authorised by law to detect, prevent, investigate or prosecute criminal offences, subject to safeguards for third parties and never for a system the public can use to report an offence; the marking duty in Article 50(2) and the deepfake and text duties in Article 50(4) are lifted where the system or its use is so authorised; the emotion-recognition and biometric-categorisation duty in Article 50(3) is lifted only for systems permitted by law to detect, prevent or investigate offences, subject to safeguards and in accordance with Union law.

A news organisation publishing unreviewed machine-written articles about current events must disclose. A company's AI-drafted contract, client memo or internal report is outside the duty to begin with: it is not published to inform the public on a matter of public interest. The document type does not settle the point; a marketing publication or a report released to inform the public on such a matter is within it, and escapes only if a person has substantively reviewed it and someone holds editorial responsibility. Review means examination of the substance by someone with relevant knowledge and judgement; the Commission's FAQ excludes "superficial, solely formal, or procedural checks" such as spell-checking. The exception belongs to the deployer's duty under Article 50(4) and leaves the provider's machine-readable marking under Article 50(2) untouched. A disclaimer on every AI-assisted email has no basis in the text.

Machine-readable marking: what it does and does not guarantee

Three points matter for anyone building compliance expectations on the marking duty. First, the duty sits with the system provider; as a user your company carries none of it: your company does not watermark anything by using a model, and cannot usually influence whether the provider does. Second, the obligation is expressly calibrated: technical solutions must be effective, interoperable, robust and reliable as far as technically feasible, taking into account the specificities and limitations of content types, implementation costs and the state of the art, language that leaves room for the technical reality. Text watermarking is widely regarded as the most fragile technique, since paraphrasing and light editing can remove the signal; image and video provenance metadata can also be stripped from a file, which is why provenance standards pair it with soft bindings such as invisible watermarks or fingerprints to recover the association. Resilience depends on the technique, and none is complete.

Third, the timing: under the transitional rule in Regulation (EU) 2026/1744 of 8 July 2026, the Digital Omnibus on AI, which entered into force on 27 July 2026, providers of systems already placed on the market before 2 August 2026 have a four-month grace period under Article 111(4) and must comply with the marking and detection duty only from 2 December 2026. The duty is framed prospectively, as an obligation to ensure that the system's outputs are marked; it is not a duty to label material already in circulation, and the Commission's FAQ confirms that content generated before 2 August 2026 need not be labelled retroactively. Expect model providers to embed and progressively harden markers, expect detectability to remain imperfect for text, and do not build a business process that assumes a reliable universal detector exists; no such detector exists today.

Guidelines and the code of practice

Article 50 does not stand alone. On 20 July 2026 the Commission published its Guidelines on transparency obligations for providers and deployers of AI systems, which set out how the Commission reads the Article 50 duties, and the AI Office has driven a Code of Practice on Transparency of AI-generated Content that operationalises the marking and labelling duties; by the end of July 2026 about 190 companies and organisations had signed, and the Commission (opinion of 8 July 2026) and the AI Board (assessment of 9 July 2026) have confirmed the code as an adequate voluntary tool for demonstrating compliance. Signing the code is optional; the underlying obligations are not.

For deployers the code matters twice over. Its Section 2 addresses the deployer's own Article 50(4) duties directly, with guidance on the design, placement and presentation of labels and an optional EU icon, and deployers can sign that section themselves. In procurement, an AI vendor that has signed, and implements, Section 1 gives you a documented answer to the question of whether the tools you use meet the provider-side duties, although the Commission's opinion notes that adherence is not conclusive evidence of compliance, and a vendor's signature does not discharge your own disclosure duties.

What companies in Europe should do now

The work is an inventory exercise. Map where the organisation deploys generative AI with external effect: customer-facing chatbots (the duty to design the system so that people know they are dealing with a machine sits with the provider under Article 50(1), but a deployer should verify before roll-out that its systems in fact say so), image, audio or video content that could constitute a deepfake (disclosure to the audience, visible or audible, clear and distinguishable, no later than first exposure, and meeting accessibility requirements), any emotion-recognition or biometric-categorisation system (the deployer must inform the persons exposed to it, Article 50(3)), and any publication stream that informs the public on matters of public interest (either disclose, or install the human editorial review that lifts the duty, and document it).

Check whether any part of the group is a provider without knowing it: a company that puts its own name on a system, has one built for it, or substantially modifies one, and then places it on the market or puts it into service, including for internal use, can carry provider duties it never budgeted for. The exposure is material: under Article 99(4) of the AI Act, non-compliance with Article 50 can attract administrative fines of up to EUR 15 million or, for undertakings, up to 3% of total worldwide annual turnover for the preceding financial year, whichever is higher. For SMEs, including start-ups, the cap is the lower of the two figures (Article 99(6)), and the Digital Omnibus extends that lower calculation to small mid-cap enterprises for this tier of fines (Article 99(6a), inserted by Regulation (EU) 2026/1744).

Fix the contracts: AI vendor agreements should warrant Article 50-compliant marking, and content workflows with agencies should allocate the deepfake and disclosure duties explicitly. And write the one-page internal rule for staff: AI-assisted business text needs no label; public-interest publication does unless a person has substantively reviewed it and takes editorial responsibility; when in doubt, route through editorial review.

What this means for you

• Do not label everything. Ordinary AI-assisted business text carries no disclosure duty; the test is publication to inform the public on a matter of public interest without editorial review.
• Check that your chatbots say what they are. The design duty is the provider's under Article 50(1), but the interaction disclosure is the most visible, most easily checked obligation in the article; verify it before roll-out and cover it in the vendor contract.
• Use editorial review as the compliance tool it is. For public-interest text, documented substantive review and editorial responsibility are the difference between a duty and none.
• Push the provider question into procurement. Ask vendors for their Article 50 marking approach and code-of-practice status before you rely on their outputs.

Isak Legal advises companies on EU AI Act readiness, transparency and deployment governance, vendor contracts and the interaction of AI, data protection and sector rules, across the EU and Switzerland. See our AI, Data & Technology page, or get in touch.

This client update is provided for general information only, reflects the position as at 27 September 2026 and does not constitute legal advice or create a lawyer-client relationship. The general application date, the Article 50 start date and the four-month grace period under Article 111(4) are taken from Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744 and from the Commission's published guidance. The code of practice continues to develop. For advice on a specific matter, please contact us.