What to tell clients about EU AI Act Article 50 labels
The Commission’s Article 50 page sets provider and deployer duties for interaction notices, machine-readable marking, and deep-fake disclosure (https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50). A law-firm alert says those duties became applicable on 2 August 2026 and were not deferred with high-risk rules (https://www.goodwinlaw.com/en/insights/publications/2026/08/alerts-technology-dpc-eu-ai-act-transparency-obligations-now-in-force). General information, not legal advice.
The article body is not available in this language; showing English.
2026-10-08. This is general information for consultants, not legal advice. Ask counsel to read the regulation before a client relies on it. Two public pages are used. The European Commission’s Article 50 page is https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50. The law-firm alert is https://www.goodwinlaw.com/en/insights/publications/2026/08/alerts-technology-dpc-eu-ai-act-transparency-obligations-now-in-force. The alert says it does not constitute legal advice. Dates, the regulation number, and the fine figure that appear only in the alert are that firm’s account. The official EUR-Lex text was not retrieved in this check.
The Commission page says the text displayed there is based on the EUR-Lex consolidated version of the AI Act as at 27 July 2026. It says that, where shown, “NEW” and “AMENDED” identify additions or amendments made by the Digital Omnibus on AI. It says the summaries “are not legal binding.” The page does not state the date on which Article 50 became applicable. That date is only in the law-firm section below.
## Providers and deployers are not the same duty
The page gives some duties to providers and some to deployers. The passages used here do not define those words. A client’s job title does not decide the role. Counsel should read the regulation’s own definitions before anyone is told which paragraph applies.
## What the Commission page says providers must do
Paragraph 1. Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed so that the persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use. The page says this obligation shall not apply to AI systems authorised by law to detect, prevent, investigate or prosecute criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties, unless those systems are available for the public to report a criminal offence.
Paragraph 2. Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. The page says the technical solutions are to be effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the specificities and limitations of the types of content, the costs of implementation and the generally acknowledged state of the art, as may be reflected in relevant technical standards. It says this obligation shall not apply to the extent the systems perform an assistive function for standard editing, or do not substantially alter the input data provided by the deployer or the semantics thereof, or where authorised by law to detect, prevent, investigate or prosecute criminal offences.
## What the Commission page says deployers must do
Paragraph 3. Deployers of an emotion recognition system or a biometric categorisation system shall inform the natural persons exposed to it of the operation of the system, and shall process the personal data in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable. The page says this obligation shall not apply to AI systems used for biometric categorisation and emotion recognition which are permitted by law to detect, prevent or investigate criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties, and in accordance with Union law.
Paragraph 4, image, audio or video. Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake shall disclose that the content has been artificially generated or manipulated. The page uses the words “deep fake.” This article does not restate a definition, because the definition was not in the passages used here. The page says this obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute a criminal offence. Where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the page limits that transparency obligation to disclosure of the existence of such generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work.
Paragraph 4, text. Deployers of an AI system that generates or manipulates text which is published with the purpose of informing the public on matters of public interest shall disclose that the text has been artificially generated or manipulated. The page says this obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences, or where the AI-generated content has undergone a process of human review or editorial control and a natural or legal person holds editorial responsibility for the publication of the content.
Paragraphs 5 to 7. The information in paragraphs 1 to 4 shall be provided to the natural persons concerned in a clear and distinguishable manner at the latest at the time of the first interaction or exposure, and it shall conform to the applicable accessibility requirements. Paragraphs 1 to 4 shall not affect the requirements and obligations in Chapter III, and shall be without prejudice to other transparency obligations laid down in Union or national law for deployers of AI systems. Paragraph 7 is marked AMENDED. The Commission shall encourage and facilitate codes of practice at Union level for the detection, marking and labelling of artificially generated or manipulated content. Taking utmost account of the opinion of the Board, the Commission shall assess whether adherence to those codes is adequate to ensure compliance with paragraphs 2 and 4, in accordance with the procedure in Article 56(6). If it deems a code inadequate, it may adopt an implementing act under the examination procedure in Article 98(2). The page lists recitals 132, 133, 134, 136 and 137. This article does not quote those recitals.
## The date, and why high-risk dates moved, are the law firm’s account
The following is the law firm’s account, not a reading of EUR-Lex. The alert says that on 2 August 2026 the transparency and information obligations under Article 50 became generally applicable and enforceable by national competent authorities across the EU. It says the duties apply whether or not a system is classified as high-risk, with one narrow exception relating to the labelling of legacy generative systems. The Commission page used above does not state that date.
The alert says 2 August 2026 was also originally billed as the date for the high-risk provisions, and that this did not happen. It says the AI Omnibus, which it cites as Regulation (EU) 2026/1744 and says came into force on 27 July 2026, pushed those obligations back. The official text of that regulation was not retrieved here, so the regulation number and that in-force date are the firm’s citations. The same calendar day, 27 July 2026, is also the date the Commission page gives for the consolidated version it displays. Those are two different statements. The alert says Annex III standalone high-risk systems, including those used in employment, education, law enforcement and critical infrastructure, will apply from 2 December 2027. It says AI systems embedded in products regulated under EU product-safety legislation (Annex I), such as medical devices, toys and lifts, will apply from 2 August 2028. It says machinery is treated differently: the AI Act’s requirements will instead be transposed into the machinery regulation by a delegated act due by 2 August 2028.
The alert says those extensions do not affect the prohibitions on unacceptable AI practices, the obligations relating to general-purpose AI models, or the transparency obligations, all of which it says continue to apply under the existing timetable. It says providers of generative systems already on the market before 2 August 2026 have until 2 December 2026 to comply with the marking obligation under the AI Omnibus. It says the Commission adopted guidelines on the transparency obligations on 20 July 2026. Those guidelines were not retrieved in this check.
The alert says non-compliance may give rise to administrative fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher, and it cites Article 99(4). Article 99 was not retrieved. Do not quote that figure to a client as a figure checked against the regulation. The Commission page’s contents list includes an entry titled “Article 99: Penalties,” and that list is not the penalty text.
The alert’s shorter summary says providers and deployers of systems generating synthetic audio, image, video or text, including what it calls deepfakes, must mark outputs in a machine-readable, detectable format, and that deployers must also disclose deepfakes depicting real persons, places or events. The Commission page places the machine-readable marking duty on providers, in paragraph 2, and the deep-fake disclosure duty on deployers, in paragraph 4. Paragraph 4 on that page does not use the phrase “real persons, places, or events.” Use the Commission page for who must mark and who must disclose. Treat the alert’s shorter summary as the firm’s compression, not as the article text.
## A file a client says is a deepfake
Keep the file as it arrived. Note the time, the channel, and whether any disclosure or mark was visible at the first moment the person saw it. Do not edit the file to add a label, remove a label, or change a label. This article does not describe how a label is made, how a detector works, or how a label can be avoided.
A missing label is not proof that the content is genuine. A label that is present is not proof of who sent the file, and it is not a way to recover money. This article does not set out a reporting procedure. Counsel names the authority, if any. Nothing here promises that a record will get a loss back.
## A checklist that is not legal advice
- Read the Commission’s Article 50 page with counsel, including the exceptions, before telling a client which duty applies.
- Ask whether the client provides a system that people interact with, provides synthetic audio, image, video or text, deploys a deep fake, deploys public-interest text, or deploys emotion recognition or biometric categorisation. The page gives those situations different duties.
- Do not assume an exception. The page’s exceptions include an interaction that is obvious to the person described in paragraph 1, an assistive function for standard editing, no substantial change to the deployer’s input or its semantics, an evidently artistic, creative, satirical, fictional or analogous work, human review or editorial control with editorial responsibility, and authorisation by law for criminal offences.
- Until counsel checks the official text, treat the 2 August 2026 application date, the high-risk deferral, the legacy marking window to 2 December 2026, the guidelines date of 20 July 2026, Regulation (EU) 2026/1744, and the fine figure as the law firm’s account.
- If a client brings a file they believe is synthetic, preserve it, record when and where it arrived, and record whether a disclosure was visible. Do not alter it.
- Do not promise that a label, a missing label, or a saved note will recover a loss.
Further notes for this audience are on the consultants hub: https://blog.mithril.fund/for/consultants.
## What Mithril will and will not do
The public docs describe Your records (あなたの記録) as the place that opens after sign-in, where a person chooses a category, writes what happened, and adds notes: https://docs.mithril.fund/app-guide. That guide says the screens after login were not recorded, so this article does not describe the layout. This article calls that signed-in recording path Live only in the sense that the public guidance presents it as what opens after sign-in. Hosted DAST and SAST are Planned. The security-services page says they are gated, not available yet as a hosted service, and planned work: https://docs.mithril.fund/reference/security-services. Mithril does not investigate a file, name a sender, recover money, or give legal advice. No other product status is stated here.