The EU AI Act’s transparency rules are now live: what organisations need to do

The countdown is over.

As of 2 August 2026, the EU AI Act’s transparency obligations under Article 50 are now in effect, with one limited exception for providers of AI systems generating synthetic audio, image, video or text content that were already placed on the market or put into service before 2 August 2026, who have until 2 December 2026 to implement the machine-readable marking requirements. This marks one of the most significant compliance milestones since the regulation entered into force in 2024. Organisations developing, deploying or integrating AI into products and services should be reviewing their transparency measures now, as enforcement powers and substantial financial penalties are also in effect.

The rules apply far more broadly than many organisations realise and, importantly, they are not limited to “high-risk” AI systems. They may also apply to organisations established outside the EU where AI systems are placed on the EU market, put into service within the EU or otherwise fall within the AI Act’s extra-territorial scope.

What Has Changed?

Article 50 introduces transparency requirements designed to help individuals understand when they are interacting with AI or consuming AI-generated content. Some obligations fall on providers: those who develop and place AI systems on the market. Others fall on deployers: those who use AI systems within their own products or services. Understanding which category your organisation falls into is essential to identifying your specific obligations.

Four key obligations are now in force:

1. AI must identify itself (obligation on: providers)

Providers of AI systems that interact directly with people, such as chatbots, virtual assistants, AI agents and avatars, must ensure users are informed that they are interacting with an AI system, unless this is already obvious from the context.

For many organisations using customer service bots, HR assistants or internal AI tools, this may require reviewing user interfaces, onboarding messages and interaction flows.

2. AI-generated content must be detectable (obligation on: providers)

Providers of AI systems that generate or manipulate text, audio, images or video must implement technical measures that make outputs machine-readable and detectable as AI-generated or AI-manipulated. The regulation requires technical solutions that are effective, interoperable, robust and reliable where technically feasible.

A limited transition period applies. Providers of AI systems generating synthetic content that were already placed on the market or put into service before 2 August 2026 have until 2 December 2026 to implement the machine-readable marking requirements. The transitional period applies only to this specific obligation and does not delay the other Article 50 transparency requirements.

This obligation is particularly relevant for organisations that develop or supply generative AI platforms used for content creation, media production and marketing.

3. Individuals must be informed about emotion recognition and biometric categorisation (obligation on: deployers)

Where emotion recognition or biometric categorisation systems are deployed, the deployer, not the system’s developer, must ensure that affected individuals are informed that such systems are being used.

This has direct implications for organisations deploying AI-enabled workplace monitoring, security or customer analytics solutions. It is also worth noting that these obligations operate alongside, and do not replace, existing data protection requirements under the GDPR, particularly where biometric data, a special category of personal data under Article 9 GDPR, is being processed.

4. Deepfakes and AI-generated public interest content must be disclosed (obligation on: deployers and those who publish AI-generated content)

Deployers and others who publish AI-generated or AI-manipulated content that could be perceived as authentic must clearly disclose that it has been artificially generated or altered. Similar transparency obligations apply to AI-generated text published for the purpose of informing the public on matters of public interest, unless the text has been subject to human review and editorial control and a natural or legal person assumes editorial responsibility for its publication.

Given the increasing prevalence of synthetic media, this is likely to become one of the most visible aspects of AI compliance.

Enforcement has started

The compliance conversation is no longer theoretical.

From 2 August 2026, national market surveillance authorities and other competent authorities designated under the AI Act can supervise and enforce compliance with Article 50 transparency obligations.

The European AI Office has separate supervisory and enforcement powers in relation to providers of General-Purpose AI (GPAI) models and certain other systems falling within its direct competence. Enforcement of Article 50 transparency obligations for most AI systems remains primarily a matter for national authorities.

Non-compliance with Article 50 transparency obligations may attract administrative fines of up to €15 million or, in the case of an undertaking, up to 3% of total worldwide annual turnover in the preceding financial year, whichever is higher. The higher penalty tier remains reserved for violations of certain prohibited AI practices.

An important nuance: not everything was delayed

Many businesses had been preparing for the broader “high-risk AI” compliance regime expected to take effect in August 2026. However, the Digital Omnibus on AI (Regulation (EU) 2026/1744), part of a wider EU simplification initiative, postponed the application of many high-risk AI obligations. Stand-alone Annex III high-risk AI systems are now deferred until 2 December 2027. AI embedded in regulated products (such as medical devices and machinery) is generally deferred until 2 August 2028.

Crucially, the postponement does not apply to Article 50 transparency obligations, which are in effect from 2 August 2026, subject only to the limited transition period for machine-readable marking requirements noted above.

What should organisations be doing now?

For legal, risk and compliance teams, the immediate priorities should include:

• Identifying AI systems within your organisation that interact directly with customers, employees or the public, and confirming whether your organisation is acting as a provider, a deployer or both.
• Reviewing whether AI-generated content is appropriately labelled and technically detectable and understanding which party in your supply chain bears responsibility for implementing machine-readable marking.
• Assessing the use of biometric categorisation or emotion recognition technologies and ensuring affected individuals are informed, bearing in mind that this obligation falls on the deployer.
• Establishing governance around synthetic media and AI-generated public communications, including clear disclosure processes for content that could be perceived as authentic.
• Reviewing contracts with AI vendors to understand the allocation of responsibility for compliance with Article 50 obligations as between providers and deployers.
• Updating AI governance frameworks to align with both current Article 50 requirements and the future high-risk AI regime.
• Reviewing existing GDPR compliance programmes to ensure they are aligned with the new AI Act transparency obligations, particularly where biometric or emotion recognition data is involved.

Final thought

The EU AI Act is often discussed in the context of future compliance obligations. However, Article 50 demonstrates that AI regulation is already moving from policy into enforcement.

For many organisations, the key question is no longer “Will these rules apply to us?” but rather “Can we demonstrate compliance if regulators ask tomorrow?”

The transparency obligations may be some of the first widely enforced provisions of the AI Act, and they provide an important indication of how regulators expect organisations to build trust and accountability into AI-enabled services.

If you would like to discuss any of the issues raised, please get in touch with Chris who will be happy to help.