The EU AI Act’s transparency rules, set out in Article 50, have applied in full since 2 August 2026. They require businesses, in certain situations, to tell people when they are dealing with artificial intelligence or with content that AI has produced. These rules reach far more organisations than those that regard themselves as technology companies. Any business that runs a chatbot, generates content with AI, or uses AI tools that interact with its customers or the public may be affected. This article sets out who the rules apply to, what each of the four obligations requires, and what a compliant approach looks like in practice.
Providers and deployers: who the rules apply to
Two roles run through Article 50, and the obligations that apply to you depend on which role you are in.
You are a provider if you develop an AI system and make it available to others under your own name or brand, whether you built it yourself or had it built for you. You are a deployer if you use an AI system in your own business, whatever its source. A single chatbot shows how the two roles differ: the software company that develops the chatbot and offers it to the market is the provider, while the retailer that buys it and puts it on its website is the deployer. A business can hold both roles at once, for example where it builds an AI tool in-house and then uses that tool in its own operations.
The four obligations of Article 50 are divided between these two roles. The first two apply to providers and concern how AI systems are designed and built. The other two apply to deployers and concern how AI systems are used once they are in service.
1. Systems that interact with people
The first obligation applies to providers of AI systems designed to interact directly with people, such as chatbots, virtual assistants and AI agents. The system must be built so that users are made aware they are dealing with artificial intelligence rather than a person.
The duty concerns genuine, responsive interaction. Simple automated tools, such as a rule-based out-of-office reply or a spam filter, fall outside it, as do systems that operate only in the background or that observe passively without engaging. AI agents carry an additional duty. They must disclose not only that they are artificial but also the person or business on whose behalf they are acting, and they must do so at each new interaction.
What matters in practice is how the disclosure is made. It must be clear, easy to notice, and given at the point of first contact. A notice hidden in the terms and conditions or on a separate help page does not satisfy the obligation. Neither does a vague label such as “your assistant”, a blanket statement that “this website uses AI”, or a technical description such as “this service uses large language models”. What is required is a plain signal at the start of the interaction, in the flow of the conversation itself. A chatbot should identify itself as AI in its opening message; a voice assistant should say so at the beginning of a call. Where the interaction is long, or is aimed at children, older people or others less likely to recognise it, the signal should be repeated or reinforced.
A limited exception applies where the artificial nature of the interaction is obvious. It is read narrowly, and it is judged by reference to a reasonably alert member of the actual audience. It may cover a coding assistant used only by professional developers, or an internal tool used by trained staff who know they are working with AI. It will not cover a lifelike assistant that an ordinary customer could mistake for a person.
2. Marking AI-generated content
The second obligation applies to providers of AI systems that generate or manipulate synthetic images, audio, video or text. Such systems must do two things. First, the output must be marked in a machine-readable format, meaning a signal embedded in the file that software can recognise. Second, the output must be detectable as artificial, which requires the provider to make a working means of detection available. Meeting one requirement without the other is not compliance.
This marking is a technical layer built into the content, such as a watermark, embedded metadata or a cryptographic signal. It is not the same as the visible label a viewer sees on a deepfake, which is dealt with under the fourth obligation below. The marking must be effective, must function across different systems, must be robust enough to survive common alterations and deliberate attempts to strip it out, and must be reliable, judged against what is technically achievable at the time.
The exceptions are practical ones. Marking is not required where AI is used only for standard editing that does not change the substance of the content, such as spellchecking, formatting or minor image correction. Nor does it apply to very short outputs such as single words or captions, to software code, or to content used only within closed industrial or business-to-business systems. If your system is built on another company’s AI model, you may rely on marking applied by that company, but you remain responsible for compliance.
3. Emotion recognition and biometric categorisation
The third obligation applies to businesses that deploy systems which infer people’s emotions from biometric data, or that sort people into categories on a biometric basis, such as estimating age or other characteristics from a facial image. The people exposed to such a system must be told that it is operating, whether it works in real time or afterwards.
Note that the AI Act bans some uses of these systems outright. Using emotion recognition on employees in the workplace, or on students in education, is prohibited except for narrow medical or safety reasons, and using it on job candidates falls into the same territory. In those cases the issue is not how to disclose the system but whether you may use it at all. Many permitted uses are also subject to a separate and more demanding set of rules that apply to higher-risk systems. Where a system is permitted, the notice must reach everyone exposed to it. A clear sign at the entrance to a space where visitors’ faces are analysed, or a message displayed before a session begins, would meet the requirement.
4. Deepfakes and text on matters of public interest
The fourth obligation applies to businesses that use AI to create deepfakes or AI-generated published text. The Act defines a deepfake in a specific way: AI-generated or manipulated image, audio or video that resembles real people, objects, places or events and would give a false impression of being authentic. Plainly unreal content, such as an obviously fantastical image, is not caught. A realistic synthetic video of your chief executive addressing staff, a cloned voice, or a product image altered to misrepresent the goods is caught. Where content is a deepfake, you must disclose that it is artificial in a way an ordinary person will actually notice, such as a visible or audible label. The technical marking described in the second obligation does not satisfy this requirement, because a viewer cannot perceive it.
A lighter approach is permitted for content that is clearly artistic, creative, satirical or fictional. Disclosure is still required, but it can be made in a way that does not spoil the work. This is read strictly. A satirical image of a public figure in an obviously humorous context can use the lighter approach; a lifelike advertisement, or a synthetic influencer promoting a real product, cannot. Where content combines a creative element with an informative or commercial purpose, the informative purpose prevails and full labelling is required.
For AI-generated text, the obligation is narrower. It applies only to text published to inform the public on matters of public interest, such as politics, public health, consumer safety, the environment or financial information. Ordinary marketing and product copy falls outside it, unless that copy makes claims about matters such as health or safety. There is an important exception. The obligation does not apply where the text has been genuinely reviewed by a person and a named individual or organisation takes editorial responsibility for it. A superficial check is not enough, and any substantive change made by AI after that human sign-off removes the benefit of the exception. If you publish AI-assisted commentary on public-interest topics, keep a record of who reviewed it and who stands behind it.
What this means for your business
A sound approach begins with a short but deliberate review. List the AI systems your business builds or uses that interact with people or that produce content. For each one, ask first whether the use is permitted at all, since some uses are banned and others carry heavier obligations, and then establish whether you are the provider, the deployer, or both, because that determines which duties apply. Make any required disclosure clear and place it at the first point of contact rather than in the small print. If you use tools that generate content, confirm with your supplier that the output is both marked and detectable, and record that in your contract. Label deepfakes visibly and keep evidence of human review for any AI-assisted text on matters of public interest.
Take Action
The transparency obligations are now in force, and they reach many more businesses than those that consider themselves technology companies. Whether a particular system is caught, and what a compliant disclosure looks like, turns on the detail of how you use it. Schedule a free discovery call with our lawyers, and we will help you identify which obligations apply to your systems and set out a practical path to compliance.
Picture from FreePik
