From 2 August 2026, Article 50 of the AI Act sets out specific transparency obligations for anyone who supplies or uses certain AI systems, chatbots and generative systems among them. Picture a furniture company in Brianza that put a virtual assistant on its website in the spring to answer questions about delivery times. It works well, customers use it, the support team can finally breathe. Then in July someone in a meeting asks: "Are we supposed to write somewhere that this is an artificial intelligence?" The answer is yes, and it is Article 50 that asks for it.

Of all the transparency obligations in the AI Act, Regulation (EU) 2024/1689, the ones in Article 50 sit closest to the daily life of a business. They cover chatbots, generated images and text, deepfakes, systems that read emotions. In other words, the tools that marketing, customer care and communications have adopted over the past two years, often without ever passing by the legal department.

Three pieces arrived in the summer of 2026 that finally make the picture readable: the Digital Omnibus, which moved some deadlines; the Code of Practice on marking and labelling generated content, published by the Commission on 10 June; and the guidelines on Article 50 adopted on 20 July. Below you will find what the rule says, how practitioners are reading it, where grey areas remain, and where to start if you are an SME.

What Article 50 of the AI Act requires, in plain terms

What is Article 50 of the AI Act? It is the provision of the European regulation on artificial intelligence that imposes transparency obligations on anyone who supplies or uses chatbots, generative systems, deepfakes and emotion recognition systems. It applies from 2 August 2026 and concerns both those who build the systems and those who use them at work.

The underlying idea is easy to grasp: people have the right to know when there is a machine on the other side, and when content that looks real was fabricated or retouched by an algorithm. The regulation turns that principle into four distinct obligations, each with a precise addressee.

Paragraph 1 covers systems that interact with people. Chatbots, voice assistants, agents that reply to emails: whoever supplies them must design them so that users know they are talking to an AI, unless this is obvious from the context to a reasonably attentive person.

Paragraph 2 covers systems that generate synthetic content, meaning text, images, audio and video. Whoever supplies them must ensure the output carries machine-readable marking that allows it to be recognised as artificial.

Paragraph 3 covers anyone using emotion recognition or biometric categorisation systems: the people exposed to them must be informed.

Paragraph 4 covers anyone publishing deepfakes, and anyone publishing AI-generated or AI-manipulated text to inform the public on matters of public interest: it must be declared.

Closing the article is paragraph 5, which applies to everyone: the information must be given clearly, no later than the first interaction or the first exposure to the content, and must be accessible to people with disabilities too.

Provider or deployer: working out which role your company is in

The whole of Article 50 rests on a distinction worth clearing up straight away, because what you actually have to do depends on it. The provider is whoever develops an AI system and places it on the market under their own name or trademark. The deployer is whoever uses it under their own authority, for professional purposes.

Most SMEs using tools such as ChatGPT, Gemini, Copilot or an image generator are deployers. Things change when a company builds something of its own on top of a third-party model and offers it to customers: a software house that integrates a conversational assistant into its own management platform and sells it under its own brand becomes the provider of that system, with all the design obligations that follow. For an agency developing a chatbot for a client, the role has to be checked case by case: what counts is who places the system on the market or puts it into service under their own name or trademark. A "turnkey" delivery does not, on its own, settle who the provider is. It often happens that the same company is a deployer for some tools and a provider for others, so the role has to be assessed tool by tool.

When Article 50 applies, and what the Digital Omnibus changed

2 August 2026 was the date circled in red on the AI Act calendar: general application of the regulation, start of the high-risk regime, transparency obligations. At the end of June the calendar was rewritten, but only in part.

The Digital Omnibus on AI was proposed by the Commission on 19 November 2025, adopted by the European Parliament on 16 June 2026 and definitively approved by the Council on 29 June. It was signed on 8 July. The most substantial postponement concerns high-risk systems: those in Annex III, used for example to screen job candidates, assess creditworthiness or in education, move to 2 December 2027. Those embedded in products regulated by Annex I, such as machinery and medical devices, move to 2 August 2028.

On Article 50, by contrast, the legislator was far more cautious. The only easing concerns paragraph 2, the technical marking of content: providers of generative systems already on the market before 2 August 2026 have until 2 December 2026 to comply. For systems placed on the market from August onwards, marking is due immediately. Everything else, meaning chatbot notices, deepfake labels, declaration of public-interest text and emotion recognition disclosure, applies from 2 August.

In recent weeks the idea that "the AI Act has been postponed" has been circulating widely. It is a misreading, and a slightly dangerous one, because it leads people to put off precisely the obligations that are simplest to meet. It is also worth remembering that Article 4, applicable from 2 February 2025 and amended by the Digital Omnibus, requires providers and deployers to take measures supporting AI literacy among their staff and anyone using the systems on their behalf. It does not require guaranteeing a specific level of competence for every individual. Supervision of this obligation began in August 2026.

Chatbots and the AI Act: the duty to say people are talking to an AI

Here the formal obligation falls on the chatbot's provider, who must design it transparently. In practice, though, the question lands squarely on the desk of whoever installs the chatbot on their own website, because it is the company that faces the customer.

The "obviousness" exception should be handled with care. An assistant with an invented name, a smiling avatar and a very natural tone can easily be mistaken for a human agent, and in that case the exception falls away. Even an obviously robotic bot may look obvious to you, who configured it, and much less so to a 70-year-old customer typing on a phone. The choice most advisers suggest is the simplest one: always display a notice, and take it off your list of worries.

How do you write a good notice? It should appear when the conversation opens, before the user enters any information, in a visible position and in words people understand. Something like "Hi, I'm the virtual assistant of [company name], a system based on artificial intelligence. If you'd rather speak to a person, type 'agent'." Hiding the information in the terms of use or behind a footer link goes against the spirit of the rule. On phone channels, the notice must be given at the start of the call.

A practical tip for anyone buying a chatbot from a supplier: before signing, ask in writing how the product handles the notice required by Article 50, whether the wording can be customised and in which languages. While you are at it, do the same for the personal data collected in conversations, which remains subject to the GDPR.

AI-generated content and Article 50: machine-readable marking

The marking required by paragraph 2 is a technical obligation for whoever develops generative systems. In essence, every image, video, audio file or text produced must carry a signal that automated tools can read to trace its artificial origin.

The Code of Practice describes a layered approach. On one side, metadata embedded in the file; on the other, digital watermarks inserted into the content itself, which are harder to strip out. Supporting techniques include fingerprinting and logging of outputs. The regulation asks for solutions that are effective, interoperable, robust and reliable as far as the state of the art allows, taking into account the differences between content types and the costs involved. It is a way of admitting that the perfect technology does not exist yet, especially for text, where watermarking is far more fragile than on an image.

There is also an exemption that matters to many companies: marking is excluded for systems performing a standard editing assistance function or leaving the data provided by the user substantially unchanged. A grammar checker may fall within the exemption; for a tool that rewrites text, you need to assess how much the content changes and whether it still performs a standard editing function.

For an SME using commercial generative tools, two checks are worth making. The first is to choose suppliers that declare compliance with Article 50. The second is to avoid stripping metadata during post-production: this happens more often than people think, for example when an image is exported and compressed for the web with settings that clean the file. Anyone developing and distributing their own generative tool, even one built on a third-party model, has to implement the marking themselves.

Deepfakes and public-interest text: the labels the AI Act requires

This is the part that matters most to people working in communications. The declaration obligation under paragraph 4 falls on the deployer of the system that generates or manipulates the content. The Code of Practice devotes an entire section to it.

When content counts as a deepfake

The AI Act defines a deepfake as AI-generated or AI-manipulated image, audio or video content resembling existing persons, objects, places, entities or events, which would falsely appear authentic to a person. The key phrase is "falsely appear authentic". A stylised illustration of an imaginary office is unlikely to fool anyone. A realistic photo of your plant with a production line that has yet to be built, a video of the CEO reading a message never recorded, a cloned voice of a brand ambassador: all cases that need labelling.

The Code indicates how and where to place the label, allows for the use of a common EU icon or an equivalent label, and suggests alternatives such as an audio disclaimer for audio-only content, where a visual label is impossible. In social campaigns the delicate point is persistence: the label must travel with the content even when it is shared or reposted.

If content that constitutes a deepfake forms part of an evidently artistic, creative, satirical or fictional work, the declaration may be made in a way that does not hinder enjoyment of the work. Clearly fantastical content, on the other hand, may not be a deepfake at all: what matters is whether, in the context where it is shown, it could appear falsely authentic.

Generated text and the role of human review

AI-generated or AI-manipulated text published to inform the public on matters of public interest must be declared. The regulation does, however, provide an important way out: the obligation falls away if the text has undergone human review or editorial control and a natural or legal person has assumed editorial responsibility for it.

For a company publishing blog articles, newsletters or press material written with AI support, there are two questions to ask. Does the content inform on a matter of public interest? A regulatory guide, a commentary on a new law, an article on a health topic probably does. Has a competent person checked the substance of the content, verifying facts and sources, and does someone assume editorial responsibility? In that case the label can be omitted. A simple grammar fix or a formal sign-off is not enough. It is worth keeping the reviewed version, the corrections, and the name of whoever approved publication.

The Code of Practice and the Commission's guidelines on Article 50

The text of Article 50 is short and leaves a lot of room for interpretation. That is why the Commission paired the regulation with two instruments designed for the people who have to apply it in practice.

The Code of Practice on marking and labelling AI-generated content, published in final form on 10 June 2026, is the product of work that began in November 2025 with independent experts and hundreds of participants from industry, academia and civil society. It has two sections: the first, on marking and detection, addresses providers of generative systems; the second, on labelling deepfakes and public-interest text, addresses deployers. It is voluntary. The Code was positively assessed by the Commission and by the European Artificial Intelligence Board. Signatories can point to its measures to demonstrate compliance with the marking and labelling obligations. Anyone choosing a different route will have to demonstrate for themselves that their measures are adequate.

The Commission's guidelines on Article 50, adopted on 20 July 2026, clarify the scope of the transparency obligations. They address providers, deployers and supervisory authorities, and they tackle the cases the regulation leaves blurred: what counts as an interaction, when content is a deepfake, how the editorial exception works, how transparency interacts with other rules. For anyone making decisions on concrete cases, the guidelines offer examples and practical clarifications to read alongside the regulation.

Penalties for breaching Article 50, and who supervises in Italy

Article 99 of the AI Act provides that breaches of the Article 50 transparency obligations carry fines of up to €15 million or 3% of total worldwide annual turnover, whichever is higher. For SMEs and start-ups the opposite rule applies: the lower of the two amounts is used. It is a difference that counts, and one the legislator introduced precisely to avoid disproportionate penalties on small businesses.

In Italy, Law 132 of 2025, in force since 10 October 2025, designated the Agency for Digital Italy and the National Cybersecurity Agency as the national authorities for artificial intelligence. The Data Protection Authority remains competent for everything concerning personal data, and it is easy to predict that many transparency complaints will pass through there too, given that chatbots and emotion recognition process data.

When quantifying a fine, authorities look at the gravity and duration of the breach, the company's conduct, its cooperation and the measures taken to limit the damage. Translated: a company that has carried out an inventory, written a procedure and trained its people starts from a very different position than one that arrives at the inspection empty-handed.

How to comply with Article 50 of the AI Act: a work plan for an SME

The good news is that complying with Article 50 is mostly an exercise in organisation. It calls for order and a bit of method, rather than technology investment.

The starting point is knowing which AI tools are genuinely in use across the company, including the ones employees adopted on their own. People doing this exercise for the first time usually find twice as many tools as they expected: the browser extension that summarises emails, the image generator the sales team uses for presentations, the automatic transcription of meetings. For each one, it is worth noting who uses it, what for, which data ends up inside it and what kind of content it produces.

With the inventory in hand, you assign each tool the company's role (provider or deployer) and the Article 50 obligations that follow. This is where the concrete actions emerge: configuring the chatbot notice, defining when images need labelling, establishing who reviews text before publication, asking suppliers for declarations of conformity.

You then need someone to hold it all together, keep the inventory current and approve new tools as they arrive. In an SME this can be someone already on the team: often the IT lead, the privacy contact, or whoever already looks after the management systems. It helps to pair that person with an internal AI policy, two or three pages written in plain language, telling colleagues what they can use, with which data and under which transparency rules.

The final piece is training, covering both Article 50 and the AI literacy obligation in Article 4. People who write content need to know when a label is required, people handling customer service need to know the notices, people buying software need to be able to read supplier declarations. Training records, policy versions, content approvals and contracts become the evidence you show if anyone asks.

ISO 42001 and the AI Act: why a management system makes transparency provable

Everything Article 50 requires works for as long as somebody looks after it. The real risk, for many companies, is that the inventory gets done once and then sits still while the tools change every month.

ISO/IEC 42001, the international standard for artificial intelligence management systems, exists precisely for this: to turn compliance from a one-off project into a process that keeps itself current. It asks you to map your AI systems, assess their risks and impacts, define roles and responsibilities, control suppliers, ensure transparency towards interested parties and verify the whole thing through periodic audits. These are the same ingredients Article 50 needs, organised in a structure that holds up over time.

ISO 42001 certification attests to the quality of the management system, while legal compliance with the AI Act has to be assessed obligation by obligation. That said, a certified company already has its inventory, procedures and evidence in order, and in front of an enterprise customer or an authority that makes an enormous difference. For anyone who already holds ISO 27001, the step is a short one, because the two standards share the same harmonised structure and many processes, from supplier management to internal audits.

How we support you towards AI Act and ISO 42001 compliance

We usually start from exactly that: an inventory of the AI tools you use every day, and a definition of the role your company holds for each of them. From there we build together the procedures Article 50 genuinely requires: chatbot notices, content labelling rules, an editorial review flow, supplier checks. Our platform gathers documents and evidence in one place and keeps an eye on deadlines, so the inventory stays current even when new tools arrive. If you want to go one step further, we take you all the way to ISO 42001 certification with the certification body audit. And if your AI systems process personal data, our outsourced DPO service covers the GDPR side too, with the same point of contact.

Want to understand which Article 50 obligations apply to your company? Get in touch and we will put you in contact with one of our Lead Auditors.

Frequently asked questions about Article 50 of the AI Act

Do I have to state that a blog article was written with AI?

It depends on the topic and the editorial process. The obligation concerns text generated or manipulated by AI and published to inform the public on matters of public interest. The label can be omitted if the content has been checked on the substance by a competent person, or subjected to genuine editorial control, and someone assumes editorial responsibility for it. It is worth keeping a record of the review and the approval: a simple grammar correction is not enough.

Does a chatbot we only use with employees need the notice?

In principle yes, because the paragraph 1 obligation covers any system interacting with natural persons, employees included. The exception applies where the artificial nature is obvious from the context, and for an internal tool presented to everyone as an AI assistant it often is. A single line of notice when it opens removes any doubt anyway, and costs next to nothing.

Did the Digital Omnibus postpone Article 50?

Almost not at all. The transparency obligations apply from 2 August 2026. The only extension concerns the technical marking of generated content under paragraph 2, and only for systems already on the market before that date, which have until 2 December 2026. The broad postponement concerns high-risk systems, moved to 2027 and 2028.

We use ChatGPT to write posts: are we providers or deployers?

Deployers, for the purposes of Article 50. You are using a system developed by others in the course of your professional activity. You would become providers if you integrated the model into a product or service distributed under your own brand, for example an assistant sold to customers. For posts, the relevant obligations are those on deepfakes and public-interest text, with the human review exception.

Do AI-generated images for a campaign always need labelling?

Not always. The declaration obligation in Article 50(4) concerns images that constitute deepfakes: content capable of appearing falsely authentic or truthful in relation to real or plausible persons, objects, places, entities or events. A clearly fantastical illustration, which could not be mistaken for an authentic depiction, is normally not a deepfake. If a deepfake does appear in an evidently artistic, creative, satirical or fictional work, the declaration can be made in a way that does not hinder enjoyment of the work. Machine-readable technical marking is a separate obligation, placed on the system's provider.

Who supervises compliance with Article 50 in Italy?

Law 132 of 2025 designated AgID and ACN as the national authorities for artificial intelligence. The Data Protection Authority remains competent for aspects linked to personal data, which in the case of chatbots and emotion recognition are almost always present.

What does an SME risk by breaching the transparency obligations?

For breaches of Article 50 the ceiling set by the AI Act is €15 million or 3% of total worldwide annual turnover. For SMEs the lower of the two values applies. The actual amount depends on gravity, duration, the company's conduct and the measures adopted, and this is where a documented procedure makes the difference.

Is ISO 42001 enough to be compliant with the AI Act?

Certification attests that the company has a solid, verified AI management system. Compliance with the AI Act remains a legal requirement to be checked obligation by obligation. In practice, though, anyone running a working ISO 42001 system already has almost all the material needed to demonstrate it.