Transparency Obligations under Art. 50 EU AI Act: Chatbots, Deepfakes, AI Content

Obligation and recommendation: in this article, an obligation is what is formulated as an obligation together with a source reference; source references next to a practical recommendation merely name the provision the step relates to. Everything else is expressly marked as a practical recommendation or as this article's assessment.

1. What Art. 50 requires

Art. 50 EU AI Act distributes four transparency obligations across two roles: paragraphs 1 and 2 bind the provider, paragraphs 3 and 4 the deployer; paragraph 6 clarifies what remains alongside them. The obligations have applied since 2 August 2026 (Art. 113 AI Act); Regulation (EU) 2026/1744 (Digital Omnibus AI), in force since 27 July 2026, did not postpone this start of application.

Under Art. 3 no. 3, a provider is whoever develops an AI system or places it on the market; under Art. 3 no. 4, a deployer is whoever uses it under its own authority. The role is not fixed: under Art. 25, a deployer moves into the provider role if it substantially modifies the purpose or functionality or places the system on the market under its own name. Clarify the role per system before you agree disclosure texts — it decides whether you carry the obligation under paragraphs 1 and 2 yourself or have to demand it from your supplier.

Since when each obligation applies

All rows of the following table state statutory starts of application under Art. 113 AI Act in the version applicable since 27 July 2026; the status column reflects the legal status of this article (17 August 2026).

Germany and Austria

For Art. 50, the same text applies in both countries: the AI Act is a directly applicable EU regulation, and there is no need to rework the source references for Austria. Only the competent authorities are governed nationally — each Member State designates at least one notifying authority and at least one market surveillance authority, makes the latter the single point of contact, communicates the designation to the European Commission and makes the contact details publicly available (Art. 70(1) and (2) AI Act) — as well as the penalty regime within the framework of Art. 99(1). This article deliberately does not name which body that is in Germany and Austria: the state of the national designations is continually updated; what counts is the designation communicated and made publicly available under Art. 70(2) AI Act, the entry point to which is the EU AI Office (see Sources). Divergences arise only in the accompanying national law: in Germany, the German Telecommunications-Digital-Services Data Protection Act (§ 25 TDDDG) governs the storing of information in terminal equipment and access to it; the equivalent provision applicable in Austria is not covered in this article and must be checked separately before this approach is transferred. Data protection supervision must also be considered separately: in Germany, the authorities competent under Land law for non-public bodies (§ 40 of the German Federal Data Protection Act (BDSG)) and the Federal Commissioner for Data Protection (BfDI) for federal public bodies (§ 9 BDSG); in Austria, the Austrian Data Protection Authority (Datenschutzbehörde) (§ 18 of the Austrian Data Protection Act (DSG)).

2. Chatbot disclosure (para. 1)

The provider must ensure that an AI system intended to interact directly with natural persons informs those persons that they are interacting with an AI system (Art. 50(1) AI Act).

Minimum requirement: "You are speaking with an AI / a bot. We use AI to provide faster answers."

The core of the obligation lies in naming the counterpart as an AI or bot; the addition about the benefit is a matter of wording. Position: the bot's first message, visible in the UI; the channel-specific placement is this article's inference. The variants "chatting" and "bot" are channel-dependent formulations of the same obligation core; as its canonical short form, this article consistently uses "You are speaking with an AI".

Exception (Art. 50(1)): paragraph 1 excludes cases in which the AI interaction is obvious from the context — for instance a voice that clearly sounds synthetic. In this article's assessment, anyone relying on this bears the risk that the obviousness will be judged differently in a dispute; we therefore recommend an explicit disclosure.

Practical recommendation: keep the greeting text for each bot under version control in the configuration record and document the approval with a date and the approving body — without that documentation it cannot be established after the fact which disclosure was running at which point in time. The channel-specific implementation in web chat, voice bot, Discord/Slack, WhatsApp and app is covered by the companion article Chatbot labelling under Art. 50: 5 practical implementations.

3. Deepfake labelling (para. 4)

Deployers who generate or manipulate deepfakes must disclose that the content has been artificially generated or manipulated (Art. 50(4) AI Act).

Deepfake = artificially generated or manipulated content that resembles a real person, object or event to a deceptive degree. This short form stems from the first version of this article and does not reproduce the wording of the regulation verbatim.

Implementation under para. 4 — this article's inference:

• Visible disclosure "Created with AI" or similar
• Position: on/in the content, not hidden
• For video: disclosure at the start or a watermark
• For images: visual marking or caption

The core of the obligation is the disclosure under paragraph 4; which carrier delivers this in the respective format — an overlay, a caption, a watermark — does not follow from the wording and is this article's inference from paragraph 4. In practice this means: the disclosure must appear where the content is delivered.

Artistic/satirical exception: discreet but recognisable labelling. Here paragraph 4 does not withdraw the disclosure itself, but permits a restrained form — it cannot be omitted.

For AI-generated texts on matters of public interest, paragraph 4 contains its own, narrower exception; it is set out in section 5.

Practical recommendation: take stock of all published image, video and audio content from recent campaigns, record for each asset whether it was artificially generated or manipulated, and tie the labelling to the approval step before publication rather than to a subsequent check.

4. Watermarking under Art. 50(2)

Providers who generate synthetic audio, image, video or text content must mark the outputs in machine-readable form as artificially generated or manipulated (Art. 50(2)) — unlike paragraph 4, this is not about a visible disclosure on the content, but about the technical detectability of the output.

Methods on the market — market assessment of the first version of 2 May 2026, not re-surveyed for this update:

Paragraph 2 is often less a building task than a procurement task: whoever merely uses an image or text tool is a deployer under Art. 3 no. 4 — the obligation under paragraph 2 falls on the provider. It only shifts once you move into the provider role under Art. 25, for example because you place a system on the market under your own name or substantially modify its purpose. Practical recommendation for the standard case: ask the tool supplier whether and in which format it marks the outputs in machine-readable form, record the answer in the AI inventory with the system concerned, and add this point as a review question in procurement. Without that information, it cannot later be assessed or evidenced how an output came about.

The exception for assistive standard editing that paragraph 2 itself contains is set out in section 5.

5. Exceptions + hardship clause

The exceptions in Art. 50 are paragraph-specific and narrowly drawn: paragraph 1 excludes AI interaction that is obvious from the context, paragraph 2 assistive standard editing, paragraph 4 text publication under editorial responsibility as well as — only in form, not in principle — artistic use; alongside this, the reservation in favour of law enforcement powers remains.

• Law enforcement: the powers of law enforcement agencies (LEAs) are not to be impaired by the labelling obligations. This article does not name a paragraph-level source reference for this; do not therefore derive from this point an exception for your own use.
• Assistive standard editing (para. 2): the labelling obligation does not apply to the extent that the AI system performs only an assistive function for standard editing or does not substantially alter the input data provided by the deployer or the semantics thereof. This article's assessment of the words "to the extent that": the exception attaches to the individual editing step, not to the tool across the board — the same software may merely format in one work step and generate content in the next.
• Editorial responsibility for texts (para. 4): for AI-generated texts on matters of public interest, the disclosure is not required where the content has undergone a process of human review or editorial control and a natural or legal person holds editorial responsibility. Both conditions must be met together — the review process and the named responsible person. Practical recommendation: record for each publication stream who holds editorial responsibility and how the review runs.
• No exception for "lawful data processing": Art. 50 knows no such exception. Conversely, paragraph 3 expressly requires the processing of personal data in accordance with the GDPR, and paragraph 6 clarifies that paragraphs 1–4 leave the requirements of Chapter III and other transparency obligations unaffected — GDPR-compliant processing therefore does not release you from the transparency obligation. The two regimes run alongside one another with their own fine ranges: Art. 99(4) AI Act on the one side, and on the other the GDPR with up to EUR 20 million or 4% of the total worldwide annual turnover of the preceding financial year for infringements of the processing principles, the conditions for consent (Art. 5, 6, 7, 9) or the rights of the data subject (Art. 12–22) under Art. 83(5) GDPR, and up to EUR 10 million or 2% for the other infringements listed in Art. 83(4) GDPR.
• Artistic freedom (para. 4): discreet, but it cannot be omitted — see section 3.
• "Obvious from the context" (para. 1): see section 2.

What paragraph 6 additionally clarifies: labelling is not a risk classification — a labelled chatbot can at the same time be a high-risk system under Annex III (recital 26); the classification in detail is covered in the FAQ. Infringements of the transparency obligations under Art. 50 are sanctioned under Art. 99(4) with up to EUR 15 million or 3% of the total worldwide annual turnover of the preceding financial year, whichever is higher. The hardship clause in Art. 99(6) does not soften the obligation, only the range: for SMEs and start-ups, the lower of the two figures applies.

6. Practical checklist

Short answer: implementing Art. 50 involves eight steps — inventory chatbots and clarify the role per system, put the AI disclosure into the bot's first message, review marketing assets for deepfake disclosure (para. 4) and machine-readable marking (para. 2), ask the supplier about watermarking, put the deepfake rule into the acceptable use policy, check emotion recognition first against the prohibition in Art. 5(1)(f), label the voice bot announcement and name a contact point for feedback. The following order is a practical recommendation of this article; the source references given in brackets each name the provision the step relates to.

1. All chatbots in the company identified — web widget, telephone IVR, team messenger, app and embedded assistants in business applications. Record the role per system (provider under Art. 3 no. 3 or deployer under Art. 3 no. 4), because that determines whether you carry the obligation yourself or demand it from your supplier (Art. 50(1) AI Act, Art. 3 no. 3 and 4, Art. 25).
2. Chatbot greeting provided with an AI disclosure — the disclosure belongs in the bot's first message, visible in the UI (Art. 50(1) AI Act).
3. Marketing materials reviewed for AI-generated images/videos — separate two questions here: whether the content resembles a real person, object or event to a deceptive degree (then disclosure under para. 4) and whether the output is marked in machine-readable form (para. 2, provider obligation) (Art. 50(2) and (4) AI Act).
4. Watermarking pipeline for all AI image creation tools — as a pure deployer you will usually not build this pipeline yourself, but clarify with the supplier whether and in which format it marks outputs, and record the answer in the AI inventory; the obligation itself addresses the provider (Art. 50(2) AI Act). The step as such is a practical recommendation.
5. Deepfake prohibition in the acceptable use policy — practical recommendation: an internal use policy does not replace labelling, but it prevents unlabelled synthetic content from entering circulation in the first place. Refer in it to the disclosure obligation (Art. 50(4) AI Act) and to the approval steps from section 3.
6. HR tools with emotion detection (video interview software) labelled? — check admissibility first: emotion recognition in the workplace and in education institutions is prohibited under Art. 5(1)(f) AI Act, with the highest fine range of up to EUR 35 million or 7% of the total worldwide annual turnover of the preceding financial year, whichever is higher (Art. 99(3)). If the use remains outside that prohibition, the deployer informs the persons concerned (Art. 50(3) AI Act); in addition, Annex III no. 1 lists emotion recognition in the field of biometrics as a high-risk application.
7. Customer support voice bot with a bot disclosure? — in the telephone channel, the spoken greeting is the only carrier of the information; there is no visible UI to which it could be shifted (Art. 50(1) AI Act).
8. Supervision-compliant complaints address for AI content established? — practical recommendation: a named internal body that receives feedback on AI content, and alongside it knowledge of the market surveillance authority competent for you. In Germany, that has been the Federal Network Agency (Bundesnetzagentur) since 29 July 2026 under the German AI Market Surveillance and Innovation Promotion Act (§ 2(1) KI-MIG), unless sectoral authorities are competent; as at this article's date (17 August 2026), Austria has not designated an authority under Art. 70 AI Act, and the RTR AI service point is an information and advice body without supervisory powers; entry point via the EU AI Office (see Sources).

Sources reviewed as of: the legal statements in this article were reviewed as at 17 August 2026; the Digital Omnibus on AI is in force as Regulation (EU) 2026/1744 since 27 July 2026 and leaves the start of application of Art. 50 unaffected. Developments after that date — in particular the market adoption of the watermarking standards — are not reflected here; the start of application of Art. 50 follows directly from Art. 113 AI Act.