EU AI Act Article 50: UK Compliance Guide for August 2026

The 2 August Deadline Was Not Postponed Wholesale

As of 31 July 2026, most EU AI Act Article 50 transparency obligations still apply from 2 August 2026.

That point has become easy to misunderstand because the new Digital Omnibus on AI delayed several high-risk-system deadlines. The Omnibus did not move Article 50 as a whole. It created a narrow transition for one obligation: machine-readable marking by providers of generative AI systems already placed on the market before 2 August.

The authoritative position now comes from three sources:

• Article 50 of the AI Act-content/EN/TXT/?uri=CELEX:32024R1689);
• the Commission’s July 2026 Article 50 guidelines and FAQ;
• Regulation (EU) 2026/1744, the Digital Omnibus on AI, which entered into force on 27 July 2026.

This guide explains the resulting position for UK teams. It is not legal advice.

The Deadline Table UK Teams Need

The Omnibus transition applies only to Article 50(2) marking for systems already on the market. It does not postpone chatbot notices, deepfake disclosures, public-interest text labels or emotion-recognition notices.

The Commission FAQ also says content generated and already made available before 2 August does not require retroactive labelling, although voluntary labelling is encouraged.

Does Article 50 Apply to a UK Company?

The answer depends on the activity and role, not the location of the head office.

Article 2 of the AI Act covers:

• providers placing AI systems or general-purpose AI models on the EU market, regardless of whether the provider is established in the EU;
• deployers established or located in the EU;
• providers and deployers outside the EU where the AI system’s output is used in the EU.

A UK company should therefore map:

• where the system is offered or put into service;
• where its outputs are intended to be used;
• whether the company is acting as provider, deployer or both;
• whether a customer, agency or platform changes that role;
• whether an exception applies to the specific output.

Saying merely that a campaign is “available online” is not a sufficient scope analysis. Record the EU market, audience, distribution route and contractual responsibility.

Provider and Deployer Are Different Jobs

A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its name or trademark. A deployer uses an AI system under its authority for professional purposes.

The same organisation can be both.

The Commission’s July guidelines overview includes role definitions, scope examples and exceptions. Build the responsibility matrix before selecting labels or technical tools.

Obligation 1: Direct Interaction With AI

Article 50(1) requires providers of AI systems intended to interact directly with natural persons to design them so people are informed they are interacting with AI, unless that fact is obvious to a reasonably well-informed, observant and circumspect person in context.

The Commission says four elements must be present:

• an AI system;
• a genuine two-way exchange;
• direct communication between the system and person;
• interaction with a natural person.

Background processing, machine-to-machine communication and systems with no direct contact fall outside this particular duty.

Where it applies, the notice should appear from the start of the first interaction. It must be clear, distinguishable and accessible.

Practical patterns include:

• “You are chatting with an AI assistant” above the first message;
• an equivalent spoken notice before a synthetic voice begins;
• a persistent, accessible status indicator;
• a direct route to information about capabilities and limitations.

Do not bury the notice in terms and conditions. Do not rely on a robot avatar if the surrounding design still creates ambiguity.

Obligation 2: Machine-Readable Marking

Article 50(2) requires providers of systems that generate synthetic audio, images, video or text to ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated.

The technical solution must be effective, interoperable, robust and reliable as far as technically feasible, taking account of content type, cost and the state of the art.

The obligation is not unlimited. Article 50 and the Commission guidance exclude or narrow cases including:

• assistive standard editing;
• changes that do not substantially alter input data or its meaning;
• source code and certain short strings;
• qualifying machine-to-machine output;
• some closed-loop industrial or development uses;
• a narrow qualifying business-to-business or industrial context described in the guidelines.

Do not apply these exceptions by intuition. Record why an output falls outside scope.

Machine-readable marking is a provider obligation. It is not the same as a visible label, and a deployer cannot assume that hidden metadata fulfils its separate disclosure duty.

Obligation 3: Emotion Recognition and Biometric Categorisation

Under Article 50(3), deployers of emotion-recognition or biometric-categorisation systems must inform natural persons exposed to their operation.

The Commission says this applies to real-time and later analysis. The notice concerns the operation of the system; other privacy and data-protection requirements still apply independently.

An inventory should therefore include systems that operate behind the scenes, such as tools assessing recorded calls, video or behaviour. A chatbot-only audit will miss this category.

Obligation 4: Deepfakes and Public-Interest Text

Article 50(4) imposes visible disclosure duties on deployers in two distinct cases.

Deepfakes

A deepfake is AI-generated or manipulated image, audio or video that resembles an existing person, object, place, entity or event and would falsely appear authentic or truthful.

Not every AI-generated image is a deepfake. Context, resemblance, audience expectation and the likelihood of false authenticity matter.

Where the duty applies, disclosure must be perceivable without specialised tools and appear no later than first exposure. Machine-readable provenance alone is insufficient.

For evidently artistic, creative, satirical or fictional works, disclosure may be made in an appropriate way that does not hamper enjoyment. That is a tailored disclosure rule, not a blanket exemption.

Public-interest text

Deployers must clearly label AI-generated or manipulated text published to inform the public on matters of public interest. The Commission includes subjects such as politics, public administration, justice, fundamental rights, public health, consumer safety, environmental protection and significant economic, financial, scientific or cultural developments.

The label is not required where:

• the text has undergone qualifying human review or editorial control; and
• a natural or legal person holds editorial responsibility for publication.

The Commission says substantive human review requires deliberate examination by someone with relevant knowledge and professional judgement. Editorial control means real authority to approve, change or reject the substance, including fact-checking and source assessment. Spell-checking or a procedural approval click is not enough.

Teams publishing AI-assisted articles should apply that standard alongside the provenance controls in our AI media and publishing guide.

For an AI-assisted publication workflow, retain:

• source material reviewed;
• substantive corrections made;
• editor identity and authority;
• approved version;
• later changes;
• legal entity accepting editorial responsibility.

Build a Two-Layer Transparency Pipeline

Treat technical provenance and audience disclosure as separate layers.

Layer 1: Provider marking

• identify in-scope generators;
• implement the chosen machine-readable technique;
• test detection at source;
• test common transformations;
• verify the final exported asset;
• record failures and fallbacks.

Layer 2: Deployer disclosure

• classify deepfake and public-interest use cases;
• choose clear visible or audible wording;
• place it at first exposure;
• meet accessibility requirements;
• verify embeds, reposts and small-screen layouts;
• preserve evidence of the final audience experience.

A source asset may be compliant when exported and lose its marker after compression, cropping, transcoding or a platform upload. Test the published object, not only the internal file.

The Code of Practice: Voluntary, but Operationally Important

The Commission published the final Code of Practice on Transparency of AI-generated Content in June 2026. It covers provider marking and deployer labelling under Articles 50(2), (4) and (5).

Signing is voluntary; Article 50 itself is binding. The Commission and AI Board have assessed the code as an adequate means of demonstrating compliance. Organisations that do not sign must be able to show that their alternative measures are adequate.

The deadline for inclusion in the first published signatory list has passed, but the Commission’s signing FAQ says eligible providers and deployers can sign later.

A business should make a documented choice:

• sign and implement the code;
• use the code as a benchmark without signing; or
• document an alternative approach and why it is equivalently adequate.

Evidence That Should Survive an Audit

For each output route, retain a compact record:

Article 50 does not itself require every prompt to be retained. Collect only evidence that has a defined compliance and governance purpose, with appropriate privacy and security controls.

The AI assurance evidence-pack guide shows how to connect a narrow compliance claim to versioned evidence, a named owner, and a review date.

Enforcement

Article 99 expressly includes Article 50. Depending on the infringement and offender, fines can reach €15 million or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher. Proportionality rules apply, including for smaller businesses.

Compliance with Article 50 also does not prove that the AI use is lawful under data-protection, consumer, copyright or sector-specific rules.

A 48-Hour Triage Before 2 August

With the deadline imminent, prioritise exposure over perfect taxonomy.

Immediately

• identify direct AI interactions with EU users;
• identify all synthetic-content generators placed on the market;
• identify deepfakes, public-interest text and biometric/emotion systems;
• assign provider/deployer roles;
• add missing first-interaction notices;
• stop publication routes that cannot yet classify outputs safely.

Before launch or next publication

• implement visible deepfake and public-interest labels;
• verify accessibility;
• document human editorial review;
• test final-asset machine-readable marking;
• record whether the December transition applies.

After the deadline

• repair transformations that strip provenance;
• decide whether to sign the code;
• audit agencies, freelancers and platforms;
• conduct sampling across all output channels;
• preserve evidence and exceptions.

Frequently Asked Questions

Did the AI Omnibus delay all Article 50 duties?

No. It created a transition until 2 December 2026 for Article 50(2) marking by providers of qualifying generative systems placed on the market before 2 August. Other Article 50 duties still start on 2 August.

Does Article 50 apply to UK companies?

It can. The Act covers non-EU providers placing systems on the EU market and non-EU providers or deployers where system output is used in the EU.

Does every AI-generated image need a visible label?

No. Provider machine-readable marking and deployer visible disclosure are different. Visible disclosure under Article 50(4) applies to qualifying deepfakes, while other laws or voluntary policies may require broader labelling.

Is a human approval click enough for the public-interest-text exception?

Not by itself. The Commission expects substantive review or genuine editorial control by a person with relevant knowledge and authority, plus editorial responsibility for publication.

The practical standard is a traceable chain from system role to technical marking, audience disclosure and editorial accountability.