AI Act Article 50: transparency in agent operations
How to meet EU AI Act Article 50 transparency duties in day-to-day agent operations by 2 August 2026 — AI disclosure, content labeling and deepfake marking, wired into your runtime.
Definition
Article 50 of the EU AI Act sets transparency obligations for certain AI systems: disclosing that users are interacting with AI, labeling AI-generated or manipulated content, and marking deepfakes. For autonomous agents these duties become enforceable on 2 August 2026.
Of all the EU AI Act’s obligations, Article 50 is the one most agent teams will meet first. It becomes enforceable on 2 August 2026, and unlike the high-risk regime, it can apply to ordinary, everyday agents. The good news: the engineering is modest if you start now.
Three duties, plainly
Article 50 imposes transparency, not a ban. For a typical agent, three duties matter:
- Disclose the AI. If a user interacts with your agent, they must be able to tell it is an AI system — unless that is already obvious from context.
- Label AI-generated content. Text, images, audio or video that your agent generates or meaningfully manipulates must be marked as AI-generated, in a machine-readable way where feasible.
- Mark deepfakes. Synthetic or manipulated media that resembles real people, places or events must be disclosed as such.
None of this restricts what your agent does. It governs how honestly the agent presents itself.
| Duty | Triggers when | How to implement |
|---|---|---|
| Disclose the AI | A user interacts with the agent | Clear in-interface notice, not a footer |
| Label AI content | The agent generates or edits text or media | Machine-readable provenance, e.g. C2PA |
| Mark deepfakes | Synthetic media resembles real people or events | Explicit disclosure on the artefact |
How do you implement it?
- Disclosure is usually a clear notice at the point of interaction — a labeled chat, an “AI-assisted” marker. Make it unmissable, not buried in a footer.
- Content labeling benefits from content-provenance standards (such as C2PA) so the mark is machine-readable and survives copying, not just a visible caption.
- A record that disclosure happened — part of your audit logs — turns “we comply” into something you can show.
The work is mostly plumbing: a notice, a provenance signal, and a log entry.
The honest penalty story
It is tempting to sell compliance with the scary number. Resist it. The 35 million euro / 7% of turnover tier is reserved for prohibited practices under Article 5, not transparency duties. Article 50 breaches sit in a lower band. Communicating this accurately — a real, dated obligation, not a mandate threat — is itself an E-E-A-T and trust signal that distinguishes you from fear-driven vendors.
What to do before August 2026
- Inventory every agent that talks to people or produces content.
- Add clear AI disclosure to those touchpoints.
- Adopt a content-provenance signal for generated media.
- Log disclosures alongside agent decisions.
Pair this with the broader governance work and you treat Article 50 as the dated, achievable milestone it is. If you want an external check that these operational duties map cleanly onto your systems, an AI Act compliance audit is a practical starting point. Terms are in the glossary.
Frequently asked questions
Which agents does Article 50 apply to?
Article 50 applies based on what an agent does, not what risk class it sits in, so it can catch ordinary, otherwise low-risk systems. The two triggers are interaction and content. If your agent interacts with people — a chatbot, a voice assistant, a support agent — the disclosure duty is likely to apply. If it generates or meaningfully manipulates content — drafting text, producing images, synthesising audio or video — the labeling duty applies to that output. Many agents do both and therefore meet both duties. Crucially, being low-risk under the rest of the Act does not exempt you here; transparency is a horizontal obligation that rides on the behaviour, not the domain. The practical test is simple: ask whether a person could mistake your agent for a human, or mistake its output for human-made, and if either is plausible, plan to disclose. Internal-only tooling with no human on the other side and no published content is the main case that falls outside.
What does compliant disclosure look like?
Compliant disclosure means a user can readily tell they are dealing with an AI system, unless that is already obvious from context, and the emphasis is on readily. In practice it is a clear notice at the point of interaction — a labeled chat window, an explicit AI-assistant identifier, a spoken disclosure in a voice channel — not a line buried in a privacy policy or footer that nobody reads. For generated content, the labeling should be machine-readable where feasible, which is why content-provenance standards such as C2PA matter: a visible caption can be cropped away, but an embedded provenance signal travels with the file. Deepfakes need explicit disclosure that the media is synthetic. A good implementation also records that the disclosure was shown, so compliance is something you can demonstrate rather than merely assert. The test a regulator effectively applies is whether an ordinary user would understand, not whether the information technically exists somewhere.
Is the 7% fine the relevant penalty here?
No, and repeating that figure in the context of Article 50 is one of the most common compliance inaccuracies. The 35 million euro or 7% of turnover tier is reserved for prohibited practices under Article 5 — systems the Act bans outright — not for transparency duties. Article 50 breaches fall in a lower penalty band, alongside most other obligations, with a ceiling of up to 15 million euro or 3% of global turnover, and smaller amounts can apply to SMEs. None of that makes the obligation optional: it is real, dated and enforceable from 2 August 2026. But describing it accurately — naming the correct tier rather than reaching for the scariest number — is both more honest and more persuasive, because customers and regulators alike notice when a vendor inflates a penalty to sell urgency. Communicate the real obligation and the real band, and let the fixed deadline supply the motivation.
When is disclosure not required?
Article 50 carves out the case where AI involvement is already obvious from the context, so you do not have to disclose what a reasonable person would plainly understand anyway. The judgement is about the ordinary user's perception, not your internal knowledge: if the average person interacting with the agent would clearly recognise it as AI, an extra notice may be unnecessary. In practice this exemption is narrower than teams hope and risky to lean on, because what feels obvious to the builder is often not obvious to a first-time user, and interfaces that blur the line between human and machine cut against you. There are also interactions the duty simply does not reach, such as purely internal tooling with no affected person on the other side and no published output. The safe default is to disclose unless non-disclosure is clearly justified, document why you concluded the context made it obvious, and revisit that judgement whenever the interface or audience changes. Treating the exemption as a routine escape hatch is exactly how teams end up non-compliant.