EU AI Act Article 50: transparency requirements

Three consequences follow that are easy to miss. An organisation that builds a generative tool and also publishes with it is both, and the obligations apply cumulatively — map them per system per use case, not per company. Light fine-tuning does not make you a provider; putting your own name on the system, substantially modifying it, or changing its intended purpose does. And a platform that merely distributes third-party AI content is not a deployer — it exercises no authority over the generating system, and applying a label does not make it one. It is encouraged to preserve upstream marks, not obliged to.

"Machine-readable" means marks structured so software can identify, recognise and extract them without human intervention. The Act names no technology; a recital lists watermarks, metadata identifications, cryptographic methods for proving provenance, logging methods and fingerprints as candidates.

The reviewed Article 50 instruments do not establish a harmonised-standard route to a presumption of conformity. The standardisation request given to the European standards bodies covers the high-risk chapter only; Article 50 sits outside it entirely. The Commission's 51-page guidance on this article does not contain the phrase "harmonised standard" even once. So there is no presumption of conformity available here — a fact worth internalising before budgeting for one.

The final Code and Guidelines reviewed for this page do not name C2PA. A named technology alone does not establish compliance. Evaluate the marking and detection solution against the applicable requirements, content format and qualifications.

Marking is also not the whole duty. Outputs must be detectable, which means the means of detection must be available to the people exposed to the content and must produce human-readable results. Providers may implement marking anywhere in the value chain and may rely on an upstream model provider or a third-party solution — without displacing their own responsibility to demonstrate compliance.

The guidance does not oblige providers to keep a full provenance chain of a content item’s origin and modifications. The marking and detection duties are distinct from any additional evidence process you choose to maintain.

Start here, because the single most common error about this article right now is that it moved. It did not. The Digital Omnibus deferred the high-risk obligations and left Article 50 alone — while quietly rewriting one of its paragraphs and adding a transitional nobody expected.

1. 1 August 2024 The AI Act enters into force

   Regulation (EU) 2024/1689, published in the Official Journal on 12 July 2024, with duties phased across four years.

2. 27 July 2026 The Digital Omnibus on AI enters into force

   Regulation (EU) 2026/1744 moves the Annex III high-risk obligations to 2 December 2027 and the Annex I ones to 2 August 2028. Article 50 appears nowhere in the deferral. It does replace Article 50(7) in full and insert a new transitional.

3. 2 August 2026 · applies Article 50 begins to apply

   All four transparency duties, for systems placed on the market from this date. California's SB 942 becomes operative the same day — the alignment was deliberate.

4. 2 December 2026 The transitional closes

   Providers of systems generating synthetic audio, image, video or text that were already on the market before 2 August 2026 have until this date to comply with the Article 50(2) marking duty. The other duties bite on 2 August regardless.

5. 2 February 2027 Detection interoperability deadline

   Under the Code of Practice, signatories must by this date route detection through a publicly available interoperable method, or signal in the content which detection solution to use.

Source status checked 9 September 2026: EUR-Lex now provides a consolidated text dated 27 July 2026. It is a reading aid; the original regulation and amending regulation published in the Official Journal remain the authoritative texts.

The record vocabulary describes the evidence you choose to submit. It does not impose a requirement to record each act, or establish that the underlying duty was met.

exemption_relied can commit a hash of the rationale you retained. A rationale record does not endorse the exception or independently prove when the underlying decision was made.

Save the JSON as article50-review.json, replace the sample values, and use a test workspace key. This example creates a record when you submit it; reading or copying it does not send a request.

curl --request POST https://api.planisphere.ooo/v1/record \
  --header "Authorization: Bearer $PLANISPHERE_API_KEY" \
  --header "Content-Type: application/json" \
  --data-binary @article50-review.json

Compare the retained reviewed text and the later text by computing their hashes. A mismatch shows that the bytes differ; the record does not itself identify who edited them. Other record events follow their own required fields. The API reference covers authentication, idempotency, batching and rate limits; see pricing for the current allowance.

Our system launched last year. Do we have until December?

For the marking duty only. The new transitional gives providers of synthetic-content systems placed on the market before 2 August 2026 until 2 December 2026 to comply with Article 50(2). Everything else — the interaction disclosure, the deployer duties, the manner-and-timing rule — applies from 2 August. A system that is partly interactive and partly generative gets the extension for its marking and not for its disclosure.

Do we have to go back and mark everything we generated before?

No. There is no retroactive marking duty for outputs generated before 2 August 2026. But note one asymmetry in the guidance: text generated before that date and published on or after it does need to be labelled.

We signed the Code. Are we covered?

You are in a much better supervisory position and you have a mitigating factor available at the fining stage. You do not have a presumption of conformity, because none exists for this article, and the Commission has said adherence is not conclusive evidence of compliance. What signing does is change the question from "is your marking adequate?" to "did you adhere?" — which is a question about what you can show over a period.

Does Article 50 apply to us from outside the EU?

It reaches providers and deployers whose output is used in the Union. The guidance narrows this at the edges — incidental, unforeseeable or unauthorised downstream use should not on its own trigger the obligations — but publishing to the open internet does not obviously fall on the safe side of that line.

How does this compare with California, which starts the same day?

Different shape entirely. California binds one class of duty holder, prescribes four data elements in the disclosure, requires a public detection tool, and runs a 96-hour licence revocation clock. Article 50 splits duties between provider and deployer, prescribes no data elements, and has no detection-tool duty. California SB 942 disclosure and detection requirements