Much of the commentary on the EU’s Digital Omnibus on AI focused on what was delayed: obligations for high-risk AI systems listed in Annex III now apply from December 2, 2027, and those embedded in regulated products from August 2, 2028. Less attention went to what was not delayed. The transparency obligations in Article 50 of the AI Act have applied since August 2, 2026, and as Holistic AI notes, they reach far more organizations than the high-risk rules. Any company whose chatbot, content generator or synthetic media reaches people in the EU may be in scope, wherever it is headquartered.
There is also a near-term deadline. The Omnibus gave AI systems placed on the market before August 2, 2026 a grace period until December 2, 2026 to comply with the machine-readable marking requirement for AI-generated content. For many organizations, that leaves only weeks. This playbook explains the obligations, who carries them, and how to implement disclosure, labeling and marking in a way that is defensible and maintainable.
What Article 50 Requires
Article 50 sets out four main groups of transparency duties, split between providers (those who develop an AI system or place it on the market under their name) and deployers (those who use an AI system in a professional capacity).
- AI interaction disclosure (providers): AI systems intended to interact directly with people must be designed so that those people are informed they are interacting with an AI system, unless this is obvious to a reasonably well-informed person from the context.
- Machine-readable marking (providers): providers of systems that generate synthetic audio, images, video or text must ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated, using technical solutions that are effective, interoperable, robust and reliable as far as technically feasible. Assistive editing functions that do not substantially alter the input are carved out.
- Emotion recognition and biometric categorization notices (deployers): deployers must inform people exposed to these systems that they are in operation, in addition to complying with data protection law.
- Deepfake and public-interest text disclosure (deployers): deployers who generate or manipulate image, audio or video content that constitutes a deepfake must disclose that it is artificial, with lighter requirements for evidently artistic, satirical or fictional works. Deployers who publish AI-generated or manipulated text to inform the public on matters of public interest must disclose this, unless the content has undergone human review or editorial control and someone holds editorial responsibility.
Information must be provided in a clear and distinguishable manner, at the latest at the time of first interaction or exposure, and must meet accessibility requirements. Penalties for non-compliance with these obligations can reach €15 million or 3% of worldwide annual turnover, whichever is higher.
The Timeline After the Digital Omnibus
The Omnibus was published in the Official Journal and entered into force on July 27, 2026. For transparency, the key dates are:
- August 2, 2026: Article 50 obligations apply. Stephenson Harwood’s analysis emphasizes that the core transparency obligations cover all in-scope AI systems from this date, regardless of when they were first placed on the market.
- December 2, 2026: end of the grace period for the machine-readable marking obligation in Article 50(2) for generative systems placed on the market before August 2, 2026.
- December 2, 2027: high-risk obligations for Annex III systems apply. Some systems will be subject to both transparency and high-risk requirements.
Organizations should also follow the European Commission’s guidance and the code of practice work on transparency of AI-generated content, which is intended to give practical direction on marking and labeling techniques. These instruments will shape what regulators consider “effective” and “state of the art.”
The high-risk deadline moved; the transparency deadline did not. If your AI talks to people or generates content that reaches the EU, Article 50 applies now, and legacy generative systems have until December 2, 2026 to mark their outputs.
Step 1: Inventory and Classify Your Exposure
Transparency compliance starts with knowing where AI meets people and content. Many organizations underestimate this because generative features are embedded in purchased tools, marketing workflows and customer channels rather than in a single “AI program.” Build an inventory that captures, for each system:
- Whether it interacts directly with people (customers, employees, partners) and through which channels: web chat, voice, email, messaging apps
- Whether it generates or manipulates audio, images, video or text, and where that content is published or sent
- Whether it uses emotion recognition or biometric categorization
- Your role: provider (you built it or market it under your name), deployer (you use it), or both
- Whether the system or its outputs reach people in the EU
- Whether it was placed on the market or put into service before August 2, 2026, which affects the marking grace period
Role classification matters because obligations differ. A company that fine-tunes and brands a customer assistant may be a provider for interaction disclosure, while a marketing team using a third-party image generator is a deployer with deepfake disclosure duties but relies on the vendor for marking.
Step 2: Design Disclosure That People Actually Notice
Interaction disclosure sounds simple: tell people they are talking to an AI. Doing it well requires design choices.
Chat and messaging
Display a clear statement at the start of the conversation, not hidden in terms of service. Use plain language, such as “You are chatting with an AI assistant,” and keep a persistent indicator visible during the session. If the conversation is handed to a human, make the transition explicit, and vice versa.
Voice
Voice agents should announce themselves at the start of the call. This is particularly important as synthetic voices become indistinguishable from human ones. Consider how disclosure works for outbound calls, transfers and voicemail.
Email and documents
Where AI systems send messages autonomously, include a clear indication in the message. For AI-assisted messages reviewed and sent by employees, assess whether the “interaction” obligation applies; many organizations adopt a policy position and document their reasoning.
Accessibility and languages
Disclosures must be accessible, including to people using screen readers, and should be available in the languages of the markets served. Test disclosures with real users to confirm they are noticed and understood.
Step 3: Implement Machine-Readable Marking
For providers of generative systems, marking is the most technically demanding obligation. No single technique is sufficient on its own, so most providers combine several layers:
- Provenance metadata: standards such as C2PA content credentials attach signed information about how content was created. Metadata is interoperable but can be stripped when files are re-encoded or screenshots are taken.
- Invisible watermarks: signals embedded in images, audio or video that survive common transformations. Robustness varies by technique and modality.
- Fingerprinting and logging: storing hashes or fingerprints of generated content so that it can be identified later, useful for detection services and investigations.
- Text approaches: watermarking text remains technically difficult and less robust; providers typically combine statistical watermarking where feasible with metadata in delivery channels and documentation of limitations.
The AI Act’s standard is effectiveness, interoperability, robustness and reliability “as far as technically feasible,” taking into account content type, implementation costs and the generally acknowledged state of the art. Document which techniques you use, why, their known limitations and how you test them. A practical test program generates sample outputs, runs them through the transformations they will encounter in real use (resizing, compression, cropping, format conversion, upload to common platforms) and checks whether marks remain detectable. Repeat these tests whenever models, pipelines or vendors change, and keep the results as compliance evidence. Detection matters as much as embedding: decide whether you will offer a verification tool or API so that platforms, journalists and users can check content you generated. If you rely on a model vendor for generation, confirm in writing what marking the vendor applies and whether your downstream processing (compression, editing, format conversion) preserves it.
Step 4: Govern Deepfakes and Public-Interest Text
Deployer obligations for deepfakes and public-interest text are often relevant to marketing, communications and media teams, which may not consider themselves AI users. Practical governance includes:
- A content policy defining when synthetic or manipulated media may be used, with approval for depictions of real people
- Standard disclosure labels and placement rules for images, video and audio across channels, including social media where platform labels may also apply
- An editorial review process for AI-generated text published to inform the public, with named editorial responsibility, which can remove the disclosure obligation under the Act’s exception
- Records showing which content was AI-generated, which tools were used and who approved publication
Ownership is a frequent gap here. Communications and marketing teams typically own content decisions, while AI governance sits with technology, risk or legal functions. Assign a clear owner for synthetic content policy, give that owner authority over tools and workflows used by agencies and freelancers as well as internal staff, and include synthetic media in brand and content audits. Agencies producing campaign assets for you should be contractually required to follow the same labeling standard and to report which assets were generated or materially altered with AI.
Treat these as data governance artifacts. The same metadata that supports marking can feed content management systems so that labeling decisions are automated and auditable.
Edge Cases and Common Pitfalls
Transparency obligations look straightforward on paper but raise practical questions once teams start implementing them. Several issues come up repeatedly:
- “Obvious” is narrower than it seems. The exception for interactions where AI use is obvious to a reasonably well-informed person should be used cautiously. A friendly, human-sounding assistant with a human name is rarely obvious.
- Embedded AI in purchased software. SaaS tools increasingly add generative features through updates. If these features interact with your customers or generate published content, you may have deployer obligations even though you never chose to “deploy AI.”
- Agents acting on behalf of the organization. AI agents that send messages, book appointments or negotiate with people outside the organization need disclosure just as chatbots do, including when they contact other businesses’ staff.
- Metadata stripping. Content management systems, image optimizers and social media uploads often remove metadata. Marking that is applied correctly at generation can be lost before content reaches its audience.
- Overlapping regimes. Platform rules, consumer protection law, advertising standards and data protection requirements may impose their own disclosure duties. Aligning them in one policy avoids conflicting labels.
- Evidence gaps. Regulators will ask how you know disclosures were shown and marking applied. Logging disclosure events and marking outcomes is inexpensive and valuable.
Treating these edge cases explicitly in policy, with documented positions and rationale, is far better than leaving individual teams to interpret the rules differently.
A Worked Example: A Bank’s Customer Assistant and Marketing Studio
Consider a generic retail bank operating in several EU markets. It runs a generative AI customer assistant on its website and app, launched in 2025, and its marketing team uses an image and video generator to produce campaign assets. A third team is piloting a voice agent for card activation calls.
The inventory shows the bank is a provider of the customer assistant, because it customized and brands it, and a deployer of the marketing generator. The assistant already discloses that it is an AI, but only in a footer; the team moves the disclosure to the first message, adds a persistent badge and makes human handoffs explicit. Because the assistant generates text responses and was placed on the market before August 2, 2026, the team reviews whether and how its outputs must be marked by December 2, 2026, documents its technical approach and limitations, and records the decision.
For marketing, the bank confirms that the image vendor applies content credentials and watermarks, and adjusts its asset pipeline so that editing tools do not strip metadata. A labeling standard is introduced for synthetic people in campaigns. The voice agent pilot is updated to announce itself at the start of every call. Finally, the bank notes that if it later uses AI to support credit decisions, those systems will fall under high-risk obligations from December 2027, and adds them to its AI governance roadmap.
Making Transparency Sustainable, and Conclusion
One-off fixes will not hold as AI features multiply. Organizations should embed transparency into their AI governance and delivery processes:
- Add Article 50 checks to AI intake and change management, so new features are assessed before launch
- Create reusable disclosure components for web, app, voice and email channels
- Standardize marking in content pipelines and test that it survives real-world processing
- Include transparency obligations in vendor due diligence and contracts
- Monitor guidance, codes of practice and enforcement activity, and update practices accordingly
Article 50 is often seen as the lighter part of the AI Act, but it is the part already in force, and it touches customer experience, brand and trust directly. Organizations that treat transparency as a design principle rather than a legal footnote will meet the December 2026 marking deadline with less disruption and will be better positioned when the high-risk regime arrives in 2027. More importantly, they will give customers what the rules are ultimately about: the ability to know when they are dealing with a machine and when content is real.
How Hanoi Technology Can Help
Hanoi Technology helps organizations inventory AI systems and implement disclosure, content marking and governance controls aligned with the EU AI Act.