Guide

Article 50 transparency obligations: what has applied since 2 August 2026

The headline about the AI Act being delayed concerns high-risk systems. The Article 50 transparency obligations arrived on schedule, on 2 August 2026, and generative systems placed on the market before that date have until 2 December 2026 to bring their content marking in line. That is the deadline in front of you, not the 2027 ones.

In short

23Minds implements the Article 50 transparency obligations of Regulation (EU) 2024/1689 in digital products and content publishing workflows. Those obligations have applied since 2 August 2026 and were not covered by the postponement that Regulation (EU) 2026/1744 introduced for Annex III high-risk systems and for AI in regulated products. We translate three duties into engineering work: telling a user they are interacting with an AI system, machine-readable marking of generated content, and telling the audience, in a form they can see or hear, that a deepfake has been artificially generated or manipulated. Marking is verified at the end of the publishing path rather than inside the authoring tool, and we leave behind a test that repeats that check on every deployment. The legal reading is signed by counsel.

Who this is for

Who this guide is written for.

  • Product teams running a chat, an assistant or a voice channel backed by a model
  • Editorial and marketing teams publishing images, video and text made with AI
  • Companies that deployed an assistant in a support channel, their own or a partner's
  • Product compliance owners who received contradictory messages from the market about the deadlines

What moved and what did not

Regulation (EU) 2026/1744, the digital omnibus, entered into force on 27 July 2026 and postponed compliance deadlines for high-risk systems. It did not postpone the transparency obligations in Article 50.

What it did add is the transition the market talks about least: providers of generative systems placed on the market or put into service before 2 August 2026 have until 2 December 2026 to meet the technical content-marking duties. For most teams that is the date actually sitting in the calendar.

What moved and what did not
ObligationOriginal deadlineStatus after the change
AI literacy (Article 4)2 February 2025Unchanged, in force
Transparency obligations (Article 50)2 August 2026Unchanged, in force
Annex III high-risk systems2 August 2026Moved to 2 December 2027
AI in regulated products (Annex I)2 August 2027Moved to 2 August 2028
Content marking in generative systems placed on the market before 2 August 20262 August 2026Transition until 2 December 2026

Three duties translated into engineering work

Article 50 describes an outcome, not an implementation. Below is what follows from it for a product, split into where it shows up, how it is done, and how it is verified.

Three duties translated into engineering work
ObligationWhere it shows up in the productHow to implement itHow to verify it
Disclosing that the counterpart is an AI systemFirst message in the conversation and a persistent label in the header, on every entry point: widget, voice channel, email, partner integrationA message in the interface layer, not in the terms of service; wording clear to someone who has never seen your productWalk every entry point and capture a screenshot from each
Machine-readable marking of generated contentThe file leaving your system, and the same file fetched from the production URLContent Credentials under the C2PA standard or metadata in XMP and IPTC fields, plus an entry in the generated-asset registerFetch the published asset and read the marking with a reader, rather than checking the file in the tool
Disclosure that deepfake content has been artificially generated or manipulatedThe place of publication: page, video, post, ad creativeA label the audience can see or hear, in the material itself or directly next to it, independent of metadataReview published material channel by channel, with a list and a date

What to do with content already published

Start from the fact that takes the pressure out of this work: material generated and published before 2 August 2026 does not have to be marked retroactively. The duty covers what you produce now, and generative systems placed on the market before that date have until 2 December 2026 to comply with the technical marking requirements.

Marking older material retroactively is therefore your call, not a requirement. It earns its keep where the material could be taken as a record of a real event, and there it is worth deciding deliberately rather than deferring. The order of work that holds: inventory first, then priorities, then a decision recorded somewhere it can be found again.

  • Inventory: what was generated, when, with which model, and where it now lives
  • Priority for material showing a person and for anything that could be taken as a record of a real event
  • Re-mark where the channel allows replacement without losing the address and where you decide it is worth it
  • For assets that cannot or need not be marked retroactively: a recorded decision with a rationale and a date, so the question does not reopen every quarter
  • A generated-asset register with checksums, so the next change does not start from zero
Failure modes

Where this goes wrong, and what we do about it.

  1. 1
    The machine-readable marking is stripped in transit

    Content Credentials and XMP metadata survive the export from the authoring tool, and are then removed by the first step of the publishing path that re-encodes the file: a CDN converting images to WebP, compression inside the CMS, or an upload to a social platform. The team sees a correctly marked file in the repository and treats the matter as closed, while the asset in production carries nothing.

    What we do about it

    We verify the marking at the end of the path, on the asset fetched from its production URL, not on the file in the tool. We leave a test that repeats this on every deployment and reports the gap. Where a channel strips metadata and that cannot be changed, we add a human-readable label and record the decision in the asset register.

    What stays with you: marking conformance report per channel, plus a verification test wired into your deployment process
  2. 2
    The disclosure buried in the terms of service

    The statement that a user is talking to an assistant ends up in the privacy policy or in a tooltip, because the team does not want to spoil the first impression. The duty is about information given in a clear and distinguishable manner at the latest at the first interaction, so whether the duty is met depends on where the statement appears. On top of that it is usually missing from the entry point nobody remembers: the partner integration, the voice channel, the automated email reply.

    What we do about it

    We put the disclosure in the first message and as a persistent label in the conversation header, then walk every entry point into the system, partner surfaces included. Each entry point gets a status and a screenshot. The list of entry points stays with you, so when a new channel is added it is clear what has to be checked.

    What stays with you: inventory of entry points with a status and a screenshot for each
  3. 3
    A caption on the image instead of marking the content

    The team adds a line of text in the corner of an image and treats it as satisfying the machine-readable requirement. The caption is cropped by the first video frame or by a thumbnail in a social feed, and no machine will read it anyway. It fails in the other direction too: metadata in a file is not a label a person can see or hear, so on its own it does not satisfy the disclosure required for deepfakes.

    What we do about it

    We separate the two requirements and implement both, each with the technique that fits it: a label readable by a person, and marking readable by a machine. For every content type, image, video, audio and text, we write down exactly what appears and where. The result is checked with a C2PA reader and by visual review, separately.

    What stays with you: marking specification per content type, with verification results from both methods
  4. 4
    The vendor says it marks content and nobody checked

    The model vendor's documentation mentions watermarking or Content Credentials, so the item leaves the list. In practice the marking can depend on the model version, on the call mode and on which endpoint you use, and your integration may predate the feature or bypass it. The claim lives in the vendor's documentation, not in your artifact.

    What we do about it

    We sample your actual integration, per model and per call mode, and check what really comes out. Differences from the documentation are recorded with a date and a model version and escalated to the vendor. Whatever the vendor does not add, we mark on your side rather than waiting for their release.

    What stays with you: sampling results with date, model version and call mode
  5. 5
    The market talks about a delay, so the team defers everything

    The headline about the AI Act being postponed concerns high-risk systems, but it lands in the plan as a single sentence: we have until 2027. The transparency duties arrived on time and apply to products that are live now. The plan is built from the headline rather than from the table of deadlines, and the difference only becomes visible when somebody outside asks about a specific feature.

    What we do about it

    We hand over a deadline table with the legal basis for each row and map it onto your systems, stating for each one what applies now and what applies later. The summary fits on one page, so it can go to the board without translating a regulation. We update it whenever the legal position changes.

    What stays with you: one-page deadline summary per system, with the legal basis next to every line
Artifacts

What stays with you.

  • Inventory of the points where a user meets an AI system, with a status and a screenshot
  • Marking specification per content type: image, video, audio, text
  • Verification test that checks the marking on the published asset, wired into your deployment process
  • Generated-asset register with model, version, date and checksum
  • Deadline summary per system: what moved, what did not, and what follows for you
  • List of questions for counsel wherever the decision is interpretation rather than engineering
Process

How we work.

  1. 1
    1. Inventory of touchpoints and assets

    We walk every entry point into a conversation with the system and every channel that publishes generated content. The output is a list with statuses, not an opinion.

    Days 1-3
  2. 2
    2. Specification and fixes

    We agree what appears in the interface and how each content type is marked, then implement the changes together with your team.

    Week 1-2
  3. 3
    3. Verification in production

    We check the marking on assets fetched from production URLs, channel by channel, and leave a test that repeats the check on every deployment.

    Week 2
  4. 4
    4. Handover and review at model change

    We hand over the specification, the register and the test. We come back when a model or vendor is swapped, because that is when marking most often disappears quietly.

    Week 2-3, then at every model change
Related guides

The rest of this cluster.

Related services

Where this turns into a service.

Scope

What this page is, and what it is not.

We are an engineering team, not a law firm. This page covers how to perform the obligation in a product and how to verify that it works, not how the article should be read for your case. Scope boundaries, in particular around published text and the exceptions in Article 50, are settled by counsel: yours, or our legal partner. Dates and instrument numbers are published together with their sources.

Sources

Where the dates and numbers come from.

FAQ

Questions teams ask.

No. Regulation (EU) 2026/1744 entered into force on 27 July 2026 and moved the deadlines for Annex III high-risk systems to 2 December 2027 and for AI in regulated products to 2 August 2028. The Article 50 transparency obligations arrived on the original date, 2 August 2026. There is one transition: generative systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the technical content-marking requirements.
If a user interacts with an AI system, they have to be informed of that in a clear and distinguishable manner, unless it is obvious to a reasonably well-informed, observant and circumspect person, taking into account the circumstances and the context of use. In practice that means a message in the first turn and a persistent label in the interface, not a clause in the terms of service, and it applies to every entry point into the conversation, including one launched inside a partner's product.
Marking a machine can read from the asset itself, for example Content Credentials under the C2PA standard or metadata in XMP and IPTC fields. A caption drawn on an image is not that. You also have to account for publishing channels that strip metadata, which is why marking is checked on the published asset rather than on the file in the tool.
The duty concerns text published to inform the public on matters of public interest, and its reach over purely marketing material is read differently by different advisers. That is a question for counsel, not a claim for us to make. Practically, we recommend keeping a generated-asset register regardless of how that assessment lands, because without one every later decision costs several times more.
Material generated and published before 2 August 2026 does not have to be marked retroactively. Generative systems placed on the market before that date are a separate matter: they have until 2 December 2026 to meet the technical marking requirements. Marking older material retroactively is your decision, worth making where the material could be read as a record of a real event, and we record it with a rationale and a date.
Some vendors add marking on their side, but it depends on the model, the version and the call mode, and the responsibility stays with you. We sample your actual integration, per model and per mode, and mark on your side whatever the vendor does not add.
The Commission for the Development and Security of Artificial Intelligence, as the market surveillance authority and single point of contact established by the Act of 3 July 2026 on artificial intelligence systems (Journal of Laws 2026 item 1003). The inspection regime and the penalty provisions enter into force on 28 October 2026.

Talk to an engineer.

Describe where you are with the Article 50 transparency obligations. A reply within one business day.

Talk to an engineer
Szczecin - ul. Wawrzyniaka 6WWarszawaZielona GóraKraków