Not every part of the AI Act is about high-risk systems and conformity assessments. Article 50 is the one that touches almost everybody, because it is about something simple: honesty about when a person is dealing with a machine. It applies from 2 August 2026, and unlike the high-risk deadlines, it did not move in the 2026 reshuffle.

The four things it asks for

Article 50 sets out transparency duties for a handful of situations. In plain terms:

  • If people interact with an AI system such as a chatbot, they have to be told, unless it is obvious to a reasonably observant person.
  • If a system generates synthetic audio, image, video or text, that output has to be marked in a machine-readable way as artificially generated.
  • If you use emotion recognition or biometric categorisation on people, you have to inform them.
  • If you produce a deepfake, or AI-generated text published to inform the public on matters of public interest, you have to disclose that it is artificial, with some exceptions for artistic or clearly editorial work.

The Commission's regulatory framework pages are the place to watch for the detailed guidance, which tends to arrive close to the application date.

Why the machine-readable bit is harder than it sounds

Telling a user "you are chatting with a bot" is easy. Marking generated content in a machine-readable way is the part that trips teams up. It means watermarking or metadata that survives copying, screenshots and re-encoding, which is a genuinely unsolved problem for text and a partly solved one for images. The law is asking for something the technology does not do perfectly yet, and everyone involved knows it.

For most companies deploying an internal assistant, the practical exposure is narrow. You are not usually generating public deepfakes. You are running a tool that drafts emails and answers questions over your own files. The relevant duty is mostly the first one: make sure people know when they are talking to the assistant rather than a colleague, which is easy to design in.

A useful test. Walk through every place your AI touches a human who is not the operator. A customer on a support chat. A citizen filling in a form. An employee reading an AI-drafted notice. For each, ask whether that person can tell a machine was involved. If the answer is no and it matters, that is where Article 50 lives.

Where running things locally helps, and where it does not

Let me be honest about the limits here. Running a model on your own hardware does not exempt you from Article 50. The duty follows the use, not the location of the GPU. If you generate a deepfake on a local box, you still have to label it.

What local deployment does change is your ability to build the disclosure in and keep it there. When you control the whole stack, you can enforce a labelling policy at the point of generation, log every output, and prove after the fact what the system produced and how it was marked. When the generation happens behind a third-party API, you are trusting a supplier's implementation and their roadmap. For a duty that turns on being able to demonstrate what your system did, owning the system is a quieter life.

This briefing is general information and not legal advice. Article 50 has carve-outs and edge cases, particularly around journalism and creative work, so check the final text and any Commission guidance against your specific use with a qualified adviser.