Art. 50 of the AI Act: transparency obligations explained by those who implemented them
Art. 50 of the AI Act imposes three transparency obligations on those who use AI in a product: disclose chatbots, mark synthetic outputs in machine-readable format, disclose AI-generated text of public interest with precise exemptions that almost no one mentions. We explain them as people who have actually implemented them in a production CMS: XMP marking, mandatory human review, tracked AI literacy. And art. 25: when integrating an LLM makes you a «provider». Articles cited, zero alarmism.
The AI Act is already in force as you read this
The general application of Reg. (EU) 2024/1689 came into effect on 2 August 2026. Art. 50 transparency for chatbots and generated content told by those who implemented it in a production CMS, exemptions included.
This is a technical read, not legal advice: every obligation cited refers to the relevant article of the regulation, and every implementation described is documented and in production.
In summary: what it asks and to whom
Art. 50 of the AI Act is the transparency provision that affects anyone using artificial intelligence within a software product: chatbots, image generation, published texts. It imposes three obligations declaring the systems with which the user interacts, marking synthetic outputs in a machine-readable format, declaring generated texts published on matters of public interest and each one has exemptions written into the text that almost no one cites.
- The timeline is staggered (art. 113): prohibitions and literacy from 2 February 2025, GPAI and penalties from 2 August 2025, general application from 2 August 2026.
- An "AI Assistant" label on the widget satisfies the obligation of para. 1: the user must be informed «unless this is obvious».
- AI texts with human review and editorial responsibility are exempt from the declaration of para. 4: the approval workflow is the evidence.
- Integrating an LLM may make you a «provider» of a high-risk system in three specific cases (art. 25): own brand, substantial modification, change of purpose.
When does the AI Act apply?
Asking «from when does it apply» in the singular is already a mistake: art. 113 staggers the application into four moments, and two are already behind us.
2 February 2025
Prohibitions and literacy
Chapters I-II apply: prohibited practices, general provisions and the AI literacy obligation under Art. 4 (Art. 113).
2 August 2025
GPAI, governance, penalties
The rules on general-purpose AI models, governance and the penalty framework apply (Art. 113).
2 August 2026
General application
The remainder of the regulation — including Art. 50 on transparency — is applicable. This is not a future deadline: it is the current regime (Art. 113).
2 August 2027
Embedded high risk
Art. 6(1) applies to high-risk systems embedded in already harmonised products (e.g. medical devices); by the same date, GPAIs already on the market must comply (Arts. 113 and 111).
2 February 2025
Prohibitions and literacy
Chapters I-II apply: prohibited practices, general provisions and the AI literacy obligation under Art. 4 (Art. 113).
2 August 2025
GPAI, governance, penalties
The rules on general-purpose AI models, governance and the penalty framework apply (Art. 113).
2 August 2026
General application
The remainder of the regulation — including Art. 50 on transparency — is applicable. This is not a future deadline: it is the current regime (Art. 113).
2 August 2027
Embedded high risk
Art. 6(1) applies to high-risk systems embedded in already harmonised products (e.g. medical devices); by the same date, GPAIs already on the market must comply (Arts. 113 and 111).
What art. 50 requires, obligation by obligation
-
Declared Chatbots (c. 1)
Anyone interacting with an AI system must be informed of it, «unless this is obvious». A clear label on the widget — «AI Assistant» — satisfies the obligation.
-
Marked Outputs (c. 2)
Synthetic texts, audio, images and videos must be marked «in a machine-readable format» — metadata that machines can verify, not just a visual label.
-
Declared Public Texts (c. 4)
Text generated «published for the purpose of informing the public on matters of public interest» must be declared as such — except for the most important exemption of all.
The exemptions are written in the text, they are not interpretations. Para. 2 sets two explicit limits on labelling: technical solutions are required «to the extent that this is technically feasible», taking into account costs and the state of the art, and the obligation does not apply to systems that perform «a standard editing assistance function» or that do not substantially modify the input data — crops, resizes, non-semantic corrections.
And the exemption in para. 4, the one that concerns every company with a blog: the disclosure is not required «if the AI-generated content has been subject to a human review or editorial control process and a natural or legal person holds editorial responsibility». Translated: a workflow in which no AI content goes online without human approval is not just good practice — it is the implementation of the exemption. The point is being able to prove it.
How we implemented it, with the evidence
What follows is not theory: it is the compliance matrix for Art. 50 and Art. 4 that we maintain on AraLith COS, our CMS with integrated AI. The internal rule is that an entry is added to the matrix only after the implementation has been verified: everything you read here is in production, with date and technical evidence.
-
Machine-readable marking (c. 2)
Every generated image receives an XMP metadata package with DigitalSourceType «trainedAlgorithmicMedia», provider, model and date — re-injected on every variant after re-encoding. It cannot be disabled.
-
Visible transparency (c. 4)
«AI generated» badge on images and a frontend notice on flagged content. Disabling the badge is logged with the user who assumes editorial responsibility for it.
-
Mandatory human review
AI edits on published content never go live on their own: they go through a review queue with a field-by-field diff, and approval records who reviewed it and when. This is the evidence for the c. 4 exemption.
-
Demonstrable AI literacy (art. 4)
Mandatory in-platform guides with tracked acknowledgement per user and version, server-side enforcement and exportable inspection report. Literacy is not just declared: it is demonstrable.
Two notes of engineering honesty. First: proportionality is documented — videos are not re-watermarked locally (shared hosting does not allow it, the provider's watermarking is preserved) and a watermarking error never destroys content. Second: what is described represents specific verified implementations, not a complete compliance programme — the legal side is a parallel track still in progress. The complete positioning, norm by norm, is on the Security and compliance page.
When integrating an LLM makes you a «provider» (art. 25)
It is the question that anyone integrating AI into products should ask themselves before signing: using a third-party model does not automatically make you liable as the one who built it — but art. 25, para. 1 lists three cases in which a third party becomes a provider of a high-risk system, with all the obligations that follow:
-
You put your brand on it
Affixing your own name or brand to a high-risk system already on the market — the allocation of obligations remains negotiable by contract (Art. 25, para. 1, point a).
-
You substantially modify it
A substantial modification to a high-risk system already placed on the market shifts the role of provider onto you (Art. 25, para. 1, point b).
-
You change its intended purpose
Changing the intended purpose of a system — even one not classified as high-risk — so as to make it high-risk (Art. 25, para. 1, point c).
The practical corollary is in c. 4: whoever provides tools, services or components integrated into a high-risk system has the right — and the interest — to a written agreement on information and technical access. It is the same logic we saw regarding product liability, where documenting the instructions received from the client is a legal defence: AI integration contracts are no longer a detail to be attached — they are the place where it is decided who is responsible for what.
What penalties does the AI Act provide, and what changes for SMEs?
Art. 99 of the AI Act sets three tiers of maximum fines and, for SMEs including start-ups, changes how the cap is calculated: the lower of the fixed amount and the percentage of turnover applies, instead of the higher. Violations of Art. 50 fall into the second tier: up to €15 million or 3% of annual worldwide turnover.
| Infringement | Maximum fine | Large companies | SMEs and start-ups |
|---|---|---|---|
| Prohibited practices under Art. 5 (para. 3) | €35 million or 7% of turnover | whichever is higher | whichever is lower |
| Obligations of providers, deployers, importers, distributors and transparency, including Art. 50 (para. 4) | €15 million or 3% of turnover | whichever is higher | whichever is lower |
| Incorrect, incomplete or misleading information supplied to notified bodies or authorities (para. 5) | €7.5 million or 1% of turnover | whichever is higher | whichever is lower |
No data to show.
The difference lies in two words of para. 6: whichever is lower. For a large company the cap is the higher of the two values, for an SME the lower. An example on the second tier: with a worldwide turnover of €5 million, 3% is €150,000, and that is the maximum applicable to an SME, not €15 million. For a group with €1 billion in turnover, 3% is €30 million, and that applies because it is higher.
These are caps, not automatic amounts. Para. 1 requires penalties to take into account the interests of SMEs, including start-ups, and their economic viability, and allows warnings and non-monetary measures as well. Para. 7 lists the criteria for setting the amount case by case, including the size, annual turnover and market share of the operator (point d), cooperation with the authorities (point f) and the technical and organisational measures implemented (point g). The detailed rules are laid down by each Member State (paras. 1 and 2).
The other SME measures: none of them affects Art. 50
-
Simplified technical documentation
SMEs may provide the Annex IV elements in a simplified manner, using a form defined by the Commission that notified bodies must accept. It concerns high-risk systems (Art. 11, para. 1).
-
Simplified quality for microenterprises
Microenterprises without partner or linked enterprises may comply in a simplified manner with certain elements of the Art. 17 quality management system. All other high-risk obligations remain (Art. 63).
-
Free and priority sandboxes
Access to AI regulatory sandboxes is free of charge for SMEs, except for exceptional costs (Art. 58, para. 2, point d), with priority access for those with a registered office or branch in the EU (Art. 62, para. 1, point a).
-
Reduced fees and dedicated support
Conformity assessment fees are reduced in proportion to the size of the SME (Art. 62, para. 2). Member States organise training and dedicated channels to answer questions (Art. 62, para. 1, points b and c).
If you run a chatbot or publish generated content, being an SME does not change your Art. 50 obligations: it changes the cap on the fine. The simplifications on documentation and quality concern high-risk systems, while sandboxes, fees and dedicated channels are support measures, not exemptions. For the definition of SME and microenterprise the regulation refers to Recommendation 2003/361/EC.
This article does not cover the list of high-risk categories in Annex III or the prohibited practices of Art. 5, which deserve a dedicated reading. And the right reason to address Art. 50 is not the penalty: it is that transparency about AI is becoming what users expect and what generative engines reward, a market requirement before a legal one.
Frequently asked questions on Art. 50 of the AI Act
Three transparency obligations: informing those who interact with an AI system (para. 1), marking synthetic outputs — text, audio, images, video — in a machine-readable format (para. 2), and disclosing AI-generated texts published to inform the public on matters of public interest (para. 4). Each has exemptions written into the text of the regulation.
The user must be informed that they are interacting with an AI system, «unless this is obvious» (Art. 50, para. 1). A clear label on the widget — for example «AI Assistant» — satisfies the obligation.
The obligation under para. 4 applies to texts published «for the purpose of informing the public on matters of public interest» — and does not apply if the content has undergone human review or editorial oversight and someone holds editorial responsibility for it. A documented human approval workflow implements the exemption.
Only in three cases (Art. 25, para. 1): if you affix your brand to a high-risk system, if you substantially modify it, or if you change its purpose making it high-risk. In other cases, the obligations of your category remain — and a written agreement on information and technical access is advisable in any case (para. 4).
Yes, in stages (Art. 113): prohibitions and AI literacy from 2 February 2025, GPAI and penalties from 2 August 2025, general application — including Art. 50 — from 2 August 2026. The last stage (Art. 6, para. 1) comes into effect on 2 August 2027.
Art. 99 sets three tiers of maximum fines: up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for breaches of the obligations of providers, deployers and transparency, including Art. 50, and up to €7.5 million or 1% for incorrect information supplied to the authorities. For large companies the higher value applies, for SMEs the lower (para. 6).
Yes: the Art. 50 transparency obligations apply to SMEs and start-ups exactly as to any other provider or deployer, because the regulation provides no size-based exemption. For SMEs what changes is the cap on the fine, which is the lower of €15 million and 3% of worldwide annual turnover (Art. 99, paras. 4 and 6).
Are you integrating AI into a product?
The difference between a well-done integration and a compliance issue is decided at the design stage: who is the supplier of what, what needs to be marked, what needs to be documented. We are happy to discuss it, from someone who has already made these choices.
Sources and methodological note
Primary sources: Reg. (EU) 2024/1689 (AI Act), text published on EUR-Lex; reference check carried out on 3 August 2026. Articles cited: 4, 25, 50, 99, 111, 113. For the implementation section: AraLith COS AI Act compliance matrix (internal documentation, July 2026) — each cited entry corresponds to a verified, production implementation.
This article reflects the technical reading of a software developer, not legal advice: for application to your specific case, the opinion of a professional is required. Annex III, art. 5, third penalty tier and SME regime are not cited as they have not yet been verified by us against the text. Information accurate as of the publication date.
