This article is engineering guidance, not legal advice. Check your specific situation with counsel.
Since 2 August 2026, the transparency obligations in Article 50 of the EU AI Act apply. If your product has a chatbot, generates content or manipulates media, and you have users in the EU, these rules are probably yours, wherever your company is based.
The good news: for most startups, Article 50 is a product and engineering task measured in days, not a compliance programme.
Who is affected
Article 50 splits duties between providers (who build or put the AI system on the market under their name) and deployers (who use it in their operations). A SaaS that wraps an LLM in its own feature is usually a provider of that feature.
| You ship… | Main duty | Article |
|---|---|---|
| A chatbot or voice agent talking to users | Tell people they are interacting with AI, unless obvious | 50(1) |
| Generative features (text, images, audio, video) | Mark outputs as AI-generated in a machine-readable way | 50(2) |
| Emotion recognition or biometric categorisation | Inform the people exposed to it | 50(3) |
| Deepfakes, or AI text published to inform the public | Disclose that the content is artificially generated or manipulated | 50(4) |
What changed with the Digital Omnibus
The EU's Digital Omnibus package, in force since 27 July 2026, adjusted several AI Act timelines. The European Commission's AI Act policy page tracks the official position. The highlights for product teams:
- Article 50 applies from 2 August 2026 as planned
- Generative systems already on the market before that date have until 2 December 2026 to meet the 50(2) marking duty
- High-risk obligations moved later: Annex III systems to 2 December 2027, and Annex I (product-safety) systems to 2 August 2028
So if you launched a generative feature before August, you have weeks, not months, to add marking.
The engineering checklist
1. Chat and voice disclosure (50(1))
- A visible label in the interface: "You're chatting with an AI assistant"
- For voice agents, a spoken disclosure at the start of the call
- The disclosure persists, rather than appearing once in a dismissed modal
- A clear path to a human, which is good practice and reduces complaints
2. Machine-readable marking (50(2))
- Images and video: embed C2PA content credentials (c2pa.org) and/or provider watermarks where available
- Audio: use your provider's watermarking or metadata where supported
- Text: metadata in your API responses and exports (for example
"generated_by": "ai"), plus a visible label where text is shown to third parties - Do not strip provider metadata in your image pipeline. Resizing and CDN transforms often do this silently, so test it
3. Deepfake and public-interest text disclosure (50(4))
- Label synthetic people and voices clearly in the output itself
- For AI-generated articles published to inform the public, disclose it, unless a human has reviewed the text and takes editorial responsibility. If that exemption applies, document the review
4. Document what you did
Keep a short transparency record per AI feature: the model provider, which outputs are marked, how and where the disclosure appears, and the date shipped. Most startups slot this into the same evidence folder they use for SOC 2.
Fines and enforcement
Breaches of Article 50 can reach €15 million or 3% of worldwide turnover, with proportionate lower caps for SMEs. Early enforcement is expected to focus on guidance and codes of practice, but marking and disclosure are cheap enough that waiting is a poor trade.
Don't forget the rest of the stack
Transparency is one slice of responsible AI. If your feature takes actions, the security work in our prompt injection guide matters more for real-world risk. If it touches personal data, GDPR still applies in full.
Bottom line
For most startups, Article 50 compliance means a disclosure in the UI, marking in the output pipeline and one page of documentation. Ship it before 2 December if your generative feature predates August.
Need it done this sprint? Our AI integration team adds disclosure, C2PA marking and audit logging to existing features. Get in touch or see sprint pricing.
Frequently asked questions
Does the EU AI Act apply to startups outside the EU?
Yes, if you place an AI system on the EU market or its output is used in the EU. A UK, US or South African startup with EU users is in scope for the relevant obligations.
What does Article 50 require for chatbots?
Providers must design AI systems that interact with people so that users are informed they are dealing with an AI, unless that is obvious from the context. A clear, persistent disclosure in the chat interface is the usual approach.
Do we have to watermark AI-generated images and text?
Providers of generative AI systems must mark synthetic audio, image, video and text outputs in a machine-readable, detectable way where technically feasible. Systems already on the market before August 2026 have until 2 December 2026 under the Digital Omnibus changes.
What are the fines for breaching Article 50?
Up to €15 million or 3% of worldwide annual turnover, whichever is higher, with lower caps for SMEs and startups. Regulators are also expected to focus on guidance before penalties in the early period.