Article 50 of the AI Act takes effect: what changes today for exporters and technology builders

Article 50 of Regulation (EU) 2024/1689, the EU Artificial Intelligence Act, became enforceable on 2 August 2026. Four transparency duties are now in force: providers of chatbots and other systems intended to interact directly with a natural person must disclose that the person is interacting with an AI system, unless this is obvious from the context; AI-generated or manipulated audio, image, video, or text content must carry a machine-readable marking identifying it as artificially generated or manipulated; deployers of emotion-recognition or biometric-categorisation systems must inform the people exposed to them; and deepfake content, meaning image, audio, or video that resembles a real person, object, place, or event, must be clearly labeled as artificially generated or manipulated.

National market surveillance authorities gained their enforcement mandate over these duties on the same date, and the AI Act's fining power for Article 50 breaches activated with it. None of this was deferred. The one carve-out concerns systems already placed on the market or put into service before 2 August 2026: for the machine-readable marking duty specifically, these pre-existing systems have until 2 December 2026 to meet it (Regulation (EU) 2026/1744, Article 1, point (39)(b), inserting Article 111(4); recital 38).

Article 50 splits its duties by role. Paragraphs 1 and 2 bind providers, meaning the organisation that builds the AI system rather than the business that merely uses it: providers of systems meant to interact directly with a person must design that disclosure into the system (paragraph 1), and providers of systems generating synthetic audio, image, video, or text, including providers of general-purpose AI models, must mark that output as machine-readable and detectable (paragraph 2). Paragraphs 3 and 4 bind deployers instead, meaning whoever puts the system into use: an organisation running an emotion-recognition or biometric-categorisation system must inform the people exposed to it and handle their data under the GDPR, the equivalent regime for EU institutions, and the Law Enforcement Directive (paragraph 3), and an organisation deploying a system that produces deepfakes, or AI-generated text published on a matter of public interest, must disclose that origin (paragraph 4).

Three exceptions run through the article. Disclosure under paragraph 1 is not required where AI involvement is already obvious to a person who is reasonably well informed, observant, and circumspect, given the context. All four paragraphs carve out systems authorised by law to detect, prevent, investigate, or prosecute criminal offences, with safeguards for third parties' rights, though paragraph 1's carve-out does not extend to systems the public can use to report a crime. Paragraph 4 narrows further for two cases: content that is evidently part of an artistic, creative, satirical, or fictional work only needs its artificial origin flagged in a way that does not interfere with enjoying the work, and AI-generated text on public-interest matters is exempt where it went through human review and a natural or legal person holds editorial responsibility for publishing it.

A separate legislative track, known as the Digital Omnibus, has since concluded. The European Commission and Council reached political agreement on the package on 7 May 2026, the European Parliament approved its position on 16 June 2026, and the co-legislators adopted the final text as Regulation (EU) 2026/1744 on 8 July 2026. It was published in the Official Journal of the European Union on 24 July 2026 and entered into force on 27 July 2026. Among its changes: the Act's standalone high-risk regime under Annex III, covering AI systems used for purposes such as employment decisions or access to essential services, moves to 2 December 2027, and the high-risk regime for AI embedded in regulated products under Annex I moves to 2 August 2028.

Both dates are now legally fixed, not proposals: Regulation (EU) 2026/1744 is in force, and the Annex III and Annex I obligations will apply on 2 December 2027 and 2 August 2028 respectively unless amended again before then. Article 50 is not left untouched, though none of its transparency duties were deferred. Regulation (EU) 2026/1744 does two things to it. It inserts a new Article 111(4) into the AI Act, giving providers of generative AI systems placed on the market before 2 August 2026 a four-month transition, running to 2 December 2026, to meet the paragraph 2 marking duty (Article 1, point (39)(b); the reasoning is in recital 38). And it replaces Article 50(7), removing the Commission's standing empowerment to fix the implementation of the marking and detection obligations by implementing act, leaving that act available only if a code of practice is judged inadequate (Article 1, point (20)).

Annex III of the AI Act lists the categories of AI use that the Act treats as high-risk once its standalone regime takes effect: employment and worker management (recruitment screening, performance evaluation, task allocation), creditworthiness assessment, certain insurance underwriting, education (access, admission, or assessment), and access to essential public and private services. A system in one of these categories carries obligations that Article 50's transparency duties do not: risk management, data governance, technical documentation, human oversight, and registration in an EU database, among others.

The Digital Omnibus's deferral is not a judgment that these uses are less risky. The stated reason is readiness: the authorities responsible for supervising high-risk systems, and the harmonized technical standards those systems are meant to be tested against, were not in place in time for the regime's original deadline. A deferral of this kind is runway for that infrastructure to catch up, not a cancellation of the obligation itself, and it is now binding law under Regulation (EU) 2026/1744, not merely a proposal.

Two points matter for anyone building or exporting technology between Mercosur and the EU. First, Article 50 reaches beyond EU borders by its own terms: its transparency duties apply to providers and deployers whose AI system's output is used within the EU, regardless of where the provider or deployer is established. A Brazilian, Argentine, or other Mercosur-based software vendor with an EU-facing chatbot or content-generation feature is in scope today, and so is a German company deploying that vendor's tool to interact with customers in the EU. Where the system sits is not the test; where its output lands is.

Second, Article 50 is one instance of a broader pattern. Across the AI Act, the EU Deforestation Regulation, and the Digital Product Passport framework, the EU is converting transparency and traceability from a voluntary good practice into a legal obligation, and it is doing so by requiring that the underlying data be structured, machine-readable, and available as evidence, not just as narrative disclosure. A chatbot's AI-generated content marking, a coffee shipment's deforestation-free geolocation data, and a battery's material passport are different regulatory instruments, but they share the same direction of travel: what used to be a claim now has to be evidence.