EU AI Act Article 50: Three Deadlines, One Transparency Rule — Developer Guide 2026

Post #898 in the sota.io EU Cyber Compliance Series

The EU AI Act Omnibus deal closed on 7 May 2026 and immediately generated a wave of compliance questions: which deadlines changed? The answer for Article 50 is clear — none. Article 50 was untouched by the Omnibus agreement.

But even without the Omnibus confusion, Article 50 is already one of the most misunderstood provisions in the AI Act. It contains three distinct deadlines for three different obligations targeting three different types of actors. Many developer compliance guides collapse them into a single date. That is incorrect and will leave you non-compliant.

This guide maps every Article 50 obligation to its exact deadline, explains who it targets, what "technical marking" means in practice, and how EU-hosted infrastructure intersects with your compliance posture.

Article 50 in One Paragraph

Article 50 of the EU AI Act imposes transparency obligations on AI systems that interact with humans or generate synthetic content. The rule has two structural halves: disclosure obligations for AI that talks to humans (chatbots, voice assistants) and labelling obligations for AI that creates synthetic content (images, audio, video, text). The disclosure half is simpler. The labelling half is technically demanding and has a nuanced grace period that most developer guides miss.

Deadline 1 — 2 August 2026: Provider Obligations for Deployed Systems

The primary Article 50 deadline is 2 August 2026 — the same date GPAI obligations under Chapter V take effect.

From this date, providers of AI systems intended to interact directly with natural persons must ensure those systems are designed so users are informed they are interacting with an AI (Article 50(1)). This covers:

• Customer service chatbots embedded in your SaaS product
• AI-powered support agents
• Voice interfaces with AI backends
• Any conversational AI component your service exposes to end users

The disclosure must be clear and given at the latest at the first interaction. Simply putting "AI-powered" in small print in your footer does not satisfy this obligation. The disclosure must be delivered by the system itself, at the point of interaction.

Who this targets: Providers of AI systems — meaning the company that places the AI system on the market or puts it into service under its own name. If you deploy a third-party AI model (from OpenAI, Anthropic, Mistral, or similar) in your product, you are the provider for the purposes of Article 50(1).

Exception: Article 50(1) has a narrow exception for systems authorised by law for the purpose of preventing, investigating, detecting, or prosecuting criminal offences, or systems where the interaction context makes the AI nature obvious.

Deadline 2 — 2 August 2026: New AI-Generated Content Must Be Labelled

Article 50(2) requires providers of AI systems that generate synthetic image, audio, video, or text content to mark that content in a machine-readable format using technical methods, and to ensure the content includes a marking detectable as artificially generated or manipulated.

This obligation applies from 2 August 2026 for new deployments.

The scope is broader than most developers initially assume:

What "technical marking" means in practice: The AI Act does not specify a single technical standard. However, the Commission is empowered to adopt implementing acts specifying technical standards (Article 50(7)). Until those standards are adopted, developers must use available state-of-the-art methods. As of May 2026, this means:

• C2PA (Coalition for Content Provenance and Authenticity) metadata — a W3C-adjacent standard supported by Adobe, Microsoft, Google, and major AI labs
• Invisible watermarking embedded in image and audio content (e.g., SynthID from Google DeepMind, or equivalent)
• EXIF/XMP metadata with AI-generation flags for image content

For text content, technical watermarking is less mature. The implementing acts are expected to address this. In the interim, visible disclosure labels alongside any available technical metadata satisfy the intent of Article 50(2).

Deadline 3 — The Grace Period: Existing Systems Until 2 December 2026

This is the provision most developer guides miss.

Article 50(4) states that obligations under Article 50(2) apply to existing AI systems that were already lawfully placed on the market or put into service before 2 August 2026 — but only from 2 December 2026, giving those systems a four-month grace period.

The Omnibus deal (7 May 2026) did not change this grace period.

What counts as an "existing system" for the grace period?

• A system placed on the market before 2 August 2026
• A system put into service before 2 August 2026
• A system that was substantially finalized before 2 August 2026, even if minor updates are released after

What does NOT qualify for the grace period?

• New AI capabilities added after 2 August 2026 (these are new deployments subject to immediate obligations)
• New AI systems launched after 2 August 2026, even if they use existing model versions
• Substantial modifications to existing systems that change their AI-generated content output

Practical implication: If your SaaS already includes AI-generated content features today (May 2026), you have until 2 December 2026 to implement technical content marking for those specific features. But any new AI features you ship after 2 August 2026 must be compliant from day one.

Article 50(3): Deepfake Disclosure

Article 50(3) addresses a specific category of synthetic content: deepfakes.

When an AI system generates or manipulates image, audio, or video content that bears resemblance to existing persons, places, objects, or events such that a person could reasonably believe it is authentic (a deepfake), the provider must ensure the content is labelled as artificially generated or manipulated.

The same 2 August 2026 deadline applies for new systems. The grace period to 2 December 2026 applies for existing systems.

Notable difference from Article 50(2): The deepfake disclosure must be visible and legible — not just machine-readable. Technical watermarking alone does not satisfy Article 50(3). You must display a human-readable notice on or adjacent to the deepfake content.

This matters for:

• AI avatar generation tools
• AI voice cloning services
• Face synthesis or modification in video
• Any "AI twin" or digital-replica product

Article 50(5): The News Exception

Article 50(5) provides a limited exception for AI-generated text published for purposes of reporting on matters of public interest when the AI system is used as a minor assistance tool and the natural or legal person responsible applies standard editorial review.

This exception is narrow and unlikely to apply to SaaS products. It was designed for news publishers using AI drafting assistance, not for AI-first content generation platforms.

The Omnibus Deal and Article 50: What Precisely Did NOT Change

The Omnibus provisional agreement of 7 May 2026 modified:

• Annex III high-risk AI application timelines (extended to December 2027)
• Annex I safety component scope (extended to August 2028)
• Added specific prohibitions on nudification AI and CSAM generation
• Extended Annex II to include Machinery Regulation AI systems
• Adjusted some notification procedures

Article 50 was not on the Omnibus negotiating table. The transparency obligations for AI-generated content, including all three deadlines mapped above, are unchanged from the original AI Act text published in the Official Journal (EU) 2024/1689.

The Three-Deadline Summary Table

What You Need to Build Before 2 August 2026

Tier 1 — Conversational AI disclosure (immediate, low effort):

Add an AI disclosure message to your chatbot, voice assistant, or AI agent UI. This should be:

• Shown automatically at the start of the first interaction
• Not dismissible until acknowledged on first use
• Available in the user's language if your system is multilingual

Tier 2 — Content marking for new AI features (medium effort):

For any AI-generated image, audio, or video output your system produces:

1. Integrate C2PA metadata generation into your content pipeline — most major AI model APIs (including those from providers like Stability AI, DALL-E, and open-source alternatives) now support C2PA manifest generation
2. If using audio synthesis: embed SynthID-equivalent watermarks or integrate with a C2PA-compatible audio watermarking library
3. Implement content signing with your organization's C2PA identity certificate
4. Store content manifests for audit purposes — the AI Act's recordkeeping obligations (Article 12 for high-risk, but analogous best practice for all) recommend retaining evidence of compliance

Tier 3 — Deepfake visible disclosure (low effort, high visibility):

If your product generates any form of realistic synthetic image or video:

• Add a visible "AI-generated" label to all output — HTML overlay, watermark text, or mandatory disclosure screen
• Include the disclosure in any download or export of AI-generated content
• Log each generation event with timestamp and disclosure confirmation

EU-Hosted Infrastructure and Article 50

Article 50 compliance is not directly affected by where your infrastructure is hosted. The obligations follow the AI system, not the server location.

However, EU-hosted infrastructure intersects with Article 50 compliance in two practical ways:

Data sovereignty for content logs: When you implement content marking, you will generate metadata logs that may include personal data (user identifiers linked to AI-generated content). These logs must comply with GDPR. If your AI service generates content for EU users, storing those logs on EU-hosted infrastructure eliminates CLOUD Act jurisdictional exposure.

GPAI model access: If your Article 50 compliance depends on technical marking capabilities provided by your underlying GPAI model provider, verify that those capabilities are available through EU API endpoints. Several US AI providers operate EU-specific infrastructure (Azure OpenAI EU regions, Google Vertex AI EU regions) with different data handling terms than their global endpoints. Using a model hosted on EU infrastructure through an EU entity reduces your supply chain compliance risk.

Article 50 Enforcement Timeline

The European AI Office became operational on 21 May 2024 and has been building enforcement capacity since then. Member State market surveillance authorities are designated to handle Article 50 violations for systems not meeting the GPAI threshold.

Penalties for Article 50 violations are capped at €15 million or 3% of global annual turnover (whichever is higher) for providers of AI systems. For SMEs, the calculation uses the SME-specific threshold.

Enforcement in the first year post-August 2026 is expected to focus on egregious violations — particularly deepfake content without disclosure, and AI systems falsely claiming to be human. Compliant marking infrastructure, even if imperfect, significantly reduces enforcement risk.

Key Takeaways

1. The Omnibus did not change Article 50. Any compliance plan that assumed otherwise needs immediate correction.
2. Two August 2026 dates for new systems. Both conversational AI disclosure and content marking are required from 2 August 2026 for anything you ship after that date.
3. Existing systems get until December 2026 for content marking. Use this grace period to implement C2PA or equivalent — not to delay indefinitely.
4. Deepfakes require visible disclosure, not just technical marking. Machine-readable watermarks alone do not satisfy Article 50(3).
5. Start with C2PA. It is the most widely supported technical standard and aligns with the Commission's direction for implementing acts.

sota.io is a European PaaS platform built for EU regulatory compliance. Deploy any language or framework on infrastructure that never leaves the EU — no CLOUD Act exposure, full GDPR alignment. Start for free.