Article 50 of the EU AI Act has entered into force, setting transparency obligations for AI providers and deployers operating across the bloc.
Enterprises running generative AI tools now have to comply with Article 50, which requires providers and deployers of certain AI systems to tell people when they’re interacting with a machine, and to mark AI-generated content so it can be flagged as such.
Advancements in generative systems have made it harder to tell AI interaction from human conversation. Distinguishing AI-generated images from authentic ones is getting harder too. People are now also being exposed to emotion recognition and biometric categorisation tools without knowing it.
The Commission links all of this to manipulation at scale and fraud, with impersonation and consumer deception following close behind on its list of concerns. Article 50 is the EU’s attempt to tackle the issue and ensure the responsible and safe rollout of AI across the bloc.
What providers have to build
Article 50 requires providers to design systems so that anyone interacting directly with an AI system knows it. The exception: cases obvious to a reasonably well-informed, observant, and circumspect person given the context.
Law enforcement systems used to detect, prevent, investigate, or prosecute criminal offences sit outside the rule too, provided safeguards protect third-party rights, unless the public can use the system to report a crime.
Providers of systems generating synthetic audio, image, video, or text face a separate duty under Article 50. Marking is the mechanism. The output needs a machine-readable mark, detectable as artificially-generated or manipulated.
The Act asks for the aforementioned marking to be effective and interoperable “as far as this is technically feasible,” weighing implementation cost against the state of the art. Assistive editing that leaves deployer-supplied input essentially untouched falls outside the requirement; a routine photo touch-up doesn’t trigger it, but a wholesale AI-generated replacement does.
What deployers must tell people
Anyone running an emotion recognition or biometric categorisation system must inform the people exposed to it. Personal data gathered through that system still falls under existing data protection law: the GDPR governs the general case, the EU institutions data protection regulation applies where an EU body is running the system, and the Law Enforcement Directive covers policing contexts.
Deepfakes get their own disclosure duty. Image, audio, or video content that’s been artificially-generated or manipulated has to carry a disclosure saying so. Artistic, satirical, or fictional work gets a lighter touch: the disclosure only needs to flag the content’s existence, worded so it doesn’t get in the way of enjoying the work.
Text published to inform the public on matters of public interest carries its own rule. Deployers must disclose AI generation or manipulation of that text unless a human has reviewed it and someone holds editorial responsibility for the publication. Standard newsroom review clears the bar. Unedited AI output published straight to a public interest story does not.
All disclosures need to land no later than the first interaction or exposure, in a manner that’s plain, distinguishable, and accessible under existing accessibility rules. No grace period covers informing someone after the fact.
The compliance path Brussels favours
Three bodies split enforcement. National market surveillance authorities handle most cases. The AI Office takes systems that fall under its own supervision. The European Data Protection Supervisor steps in when an EU institution itself acts as provider or deployer.
The guidelines set out how providers and deployers can show they’ve met the marking obligation in Article 50. Signing on to the Code of Practice on Transparency of AI-generated Content is one path.
Organisations that skip the Code have to demonstrate compliance through alternative means the Commission considers adequate. What those alternatives look like in practice isn’t spelled out in detail; that judgement falls to the market surveillance authorities doing the enforcing.
The other transparency duties don’t have an equivalent code. No code, no shortcut. Telling people they’re talking to an AI is one duty. Disclosing deepfakes and flagging AI-generated public interest text round out the rest, and providers and deployers work out their own adequate measures, with the guidelines serving as a reference point rather than a checklist.
Much of the document is definitional. It sets out what counts as a directly interactive AI system, what qualifies as synthetic content, and where the line sits between a deepfake and ordinary edited media. Standard editing sits outside scope by name, alongside assistive functions that leave deployer-supplied input intact.
The guidance also works through the value chain question of who counts as a provider and who counts as a deployer, and what happens when both roles sit with the same organisation. Which of the four Article 50 obligations apply, and to whom, comes down to that provider-deployer distinction.
Organisations weighing up the Code of Practice on Transparency of AI-generated Content against building their own labelling approach now have somewhere to start. The guidelines give them a Commission-endorsed reference point that goes beyond the bare text of the regulation.
See also: OpenAI aligns safety practices with EU AI Act’s GPAI Code
Want to learn more about AI and big data from industry leaders? Check out AI & Big Data Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events including the Cyber Security & Cloud Expo. Click here for more information.
AI News is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.