AI Act for builders · reviewed 2026-09-23
Article 50 for apps built on someone else's model
If you ship a chatbot, an agent or a generative feature under your own name, you are its provider, even when the model comes from an API. Article 50 has applied since 2 August 2026; for systems already on the market, machine-readable marking is due by 2 December 2026.
Who has which duty
| Art. | Duty | On whom | Details |
|---|---|---|---|
| 50(1) | Tell people they are interacting with AI | Provider (you, if you ship the chatbot or agent under your name) | At the latest at the first interaction, unless obvious to a reasonably well-informed person |
| 50(2) | Mark generated audio, image, video and text as artificially generated, machine-readably | Provider of the generating system | Effective, interoperable, robust and reliable as far as technically feasible; not for assistive editing that does not substantially alter the input |
| 50(3) | Inform people exposed to emotion recognition or biometric categorisation | Deployer | Also GDPR; emotion recognition at work and in education is prohibited outright (Art. 5) |
| 50(4) | Disclose deepfakes, and AI-generated text published to inform the public on matters of public interest | Deployer | Light-touch for evidently artistic, creative or satirical work; text exempt when a person reviews it and holds editorial responsibility |
The information has to be clear and distinguishable, given at the latest at the first interaction or exposure, and accessible (Art. 50(5)).
Disclosure: a first message that does the job
<div role="status" class="ai-disclosure">
You are chatting with an AI assistant from [Company].
It can make mistakes. Type "human" to reach a person.
</div>Put it in the first message, not only in the terms of service, and keep a short persistent label near the input. For voice, say it at the start of the call. Our disclosure generator writes the text in several variants.
Marking: check upstream, then keep it intact
- Find out what your model provider already marks: many image and video APIs attach C2PA content credentials or a watermark; text marking varies.
- Add what is missing for your outputs, and document the choice.
- Make sure your own pipeline does not remove it. Image optimisers, CDNs and format conversions can strip metadata unless configured to keep it (for example, Cloudflare's option to preserve content credentials).
The Commission's Code of Practice on marking and labelling of AI-generated content (final, June 2026) is voluntary; the Commission and the AI Board have confirmed it as adequate for showing compliance with Article 50. Following it is the simplest way to show that your marking is good enough.
Labels: deepfakes and public-interest text
These are deployer duties, which often means your customers. If your product publishes content for them, give them a label next to the content. The Commission's EU icons for labelling AI-generated content (SVG and PNG, updated 10 August 2026) are optional to use; the labelling duty is not.
Test checklist
- The AI disclosure appears in the first message on every channel: web widget, mobile app, email replies, voice (spoken at the start), and API responses that end users see.
- It survives localisation, A/B tests and prompt changes: test it like any other requirement, not as copy.
- Users can reach a person, and the chatbot says how.
- Generated images, audio and video carry the marking your model provider adds (often C2PA content credentials or a watermark) after every step of your pipeline: resizing, format conversion, CDN optimisation, re-encoding. Image optimisers and CDNs can strip metadata unless told to keep it.
- Streaming and exported text: decide what "marked" means for your text output and document it; text watermarking is technically immature, which is why the obligation applies "as far as technically feasible".
- Where your product publishes deepfakes or unedited public-interest text for your customers, the label is shown next to the content; the EU icons can help.
- Tests and screenshots are kept with dates: they are the evidence an inspector asks for.
Next
- Provider or deployer? Your role for each kind of feature.
- Worked example: a customer chatbot on a model API.
- ai-act-check: list your AI features in a YAML file and get the Article 50 duties and dates in your terminal or CI.
- The AI Compliance Kit has the transparency checklist (21 checks) and nine ready-to-use disclosure texts.