EU AI Act Article 50 (the draft's "Article 52"): What Startups Actually Need to Do

Updated 2 October 2026 — correction. Earlier versions merged the provider's marking duty with the deployer's deep-fake disclosure, applied the 2 December 2026 grace period to content rather than to systems already on the market, said fines "accrue" daily, presented documentation as an Article 50 requirement, named companies as in scope without a source and offered a paid assessment Vigilia does not sell. The guide now follows Article 50(1) to (5), gives the Article 99(4) statutory maximum, and is tagged Article 50.

Updated 31 July 2026 — article numbering. Transparency obligations are Article 50 in the adopted Regulation (EU) 2024/1689. "Article 52" was the numbering in the draft text and is a common mis-citation. The substance below is unchanged; the obligation applies from 2 August 2026 and was not deferred by the Digital Omnibus.

If your product generates synthetic media — avatars, voice clones, AI-written copy marked up as human, chatbots masquerading as people — Article 50 of the EU AI Act applies to you. It has applied since 2 August 2026. Here's what you actually need to do.

What Article 50 covers

Article 50 is the EU AI Act's transparency chapter — a set of disclosure obligations for four categories of AI systems (text on EUR-Lex):

1. Systems that interact with humans directly (chatbots, voice assistants) — the provider must design them so people are told they are dealing with an AI system, unless that is obvious from context (Art. 50(1))
2. Emotion recognition and biometric categorisation systems — the deployer must inform the people exposed to them (Art. 50(3))
3. Generated or manipulated content — the provider of a system that generates synthetic audio, image, video or text must mark the output in a machine-readable format so it is detectable as artificially generated (Art. 50(2)); the deployer of a system that produces a deep fake must disclose that the content is artificial (Art. 50(4))
4. Text published to inform the public on matters of public interest — if AI-generated, the deployer must disclose it, unless it has undergone human review or editorial control and a person holds editorial responsibility for the publication (Art. 50(4))

Unlike Article 53 (GPAI obligations for foundation models), Article 50 applies to the AI systems — including the products startups ship on top of models. If you use OpenAI or Anthropic to build a customer-facing product that does one of the four things above, you are in scope.

Who's directly in scope

A non-exhaustive list of product types that Article 50 reaches:

• AI avatar platforms
• AI voice cloning services
• AI writing tools (the marking duty in Art. 50(2) applies to synthetic text too)
• Customer service chatbots, on any site — Art. 50(1) is not limited to regulated sectors
• Emotion-recognition and biometric-categorisation products — note that inferring emotions in the workplace or in education is prohibited outright by Article 5(1)(f), except for medical or safety reasons
• Generative image, video, audio or text products — the marking duty applies to the output whether or not it is shared

If your product falls in any of these, Article 50 is not optional.

What "compliance" actually looks like

The Article itself is short (about 700 words). It requires disclosure and marking, not paperwork; but showing that you meet it breaks down into four artefacts, of which only the first is required by the text:

1. Disclosure mechanisms in the product

For each scoped interaction, the information must be given "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure", and meet the applicable accessibility requirements (Art. 50(5)). A tiny watermark buried in the corner of a 4K video is unlikely to meet that test. Common patterns — the Act prescribes none of them:

• Chatbots: opening message states "You're chatting with an AI assistant"
• AI-generated images/video: C2PA content credentials embedded in the file (machine-readable marking), plus a visible watermark or badge where the content is a deep fake
• AI voice: spoken disclosure on first interaction ("This call is AI-assisted")
• AI text published to inform the public on matters of public interest: byline or footer disclosure

2. Documentation of what you're generating and how

Article 50 does not require this documentation, but it is how you show an authority what your product does:

• Model(s) used (including third-party APIs)
• Training data provenance (at the level you control)
• Moderation and safety guardrails
• Audit trail of what was generated, by whom, for whom
• Process for responding to takedown requests

3. User-facing notices

Privacy policy and terms of service updates. These do not replace the in-product disclosure, but a policy that never mentions AI-generated content will contradict the product it describes.

4. Internal governance records

These are recommended practice, not Article 50 requirements:

• Risk assessment specific to Article 50 scenarios
• Incident response process for misuse (deepfake impersonation, unauthorised voice cloning)
• Contact point for regulatory queries (a designated person is enough)

The timeline that matters

Date	What happens
2 Aug 2025	GPAI model obligations (Ch. V) and the penalty regime (Ch. XII) became applicable.
2 Aug 2026	Article 50 became applicable. From this date a breach can be fined under Art. 99(4).
2 Dec 2026	Grace period ends for machine-readable marking (Art. 50(2)) by systems already on the market before 2 August 2026.

The statutory maximum for a breach of Article 50 is €15M or 3% of global annual turnover, whichever is higher, under Art. 99(4)(g) — lower than the headline €35M / 7%, which applies only to the Article 5 prohibited practices. If you are an SME or a start-up, Art. 99(6) caps the fine at whichever figure is lower, so for a company on €8M turnover the maximum is €240,000, not €15M.

What you can do this week

If you're in scope and haven't started, here's the minimum viable prep:

1. Inventory your AI-generated content surfaces. List every place your product outputs AI-generated media, text, or conversation. Note which were user-triggered vs system-initiated.
2. Add disclosure language to each surface. A single sprint of engineering work for most products.
3. Update your privacy policy and ToS to reference AI-generated content and user rights under the EU AI Act.
4. Document your generation pipeline in a governance record. This can live in a Notion doc to start — the format matters less than having one.
5. Run a gap analysis against the specific Article 50 paragraphs that apply to your product.

Common misconceptions

"We're not in the EU so we're fine." False. The Act applies to providers placing AI systems on the EU market wherever they are established, and to providers and deployers outside the EU where the system's output is used in the EU (Art. 2(1)). US startups shipping to Europe are in scope.

"We'll wait until we get a warning." The law doesn't work that way. Market surveillance authorities can act on their own initiative, and any person who believes the Act has been infringed may lodge a complaint with them (Art. 85).

"Our terms of service already cover this." Unlikely. Article 50(5) requires the information to reach the person in a clear and distinguishable manner at the first interaction or exposure — in the product experience, not buried in legal docs.

Reading the source

Article 50 is short enough to read in full. Read it on EUR-Lex before relying on any summary, including this one, and map each paragraph to the surfaces in your inventory.

---

This post is written for the general compliance-curious reader and is not legal advice. For binding interpretation of the EU AI Act, consult qualified counsel in your jurisdiction.