Article 50 compliance checklist

Tick every statement that describes your organisation. The applicable obligations appear below, with the checklist groups to work through.

• A system we offer or operate interacts directly with people — chat, voice assistant, avatar, kiosk.
• We develop or offer a system that generates or manipulates audio, images, video or text.
• We publish AI-generated or AI-manipulated images, audio or video that appear real (deepfakes) — including in ads, training or brand content.
• We publish AI-generated text that informs the public on matters of public interest — politics, health, law, justice, security, environment, consumer safety.
• We use emotion recognition or biometric categorisation — workplace analytics, kiosks, CCTV analytics, access control, fraud tools.
• We are established outside the EU, but outputs of our AI systems are used in the Union.
• Some of our in-scope systems were placed on the market before 2 August 2026.
• Different business units both build AI systems and use third-party AI tools.

• Legal & compliance· ScopeHigh

  Complete Article 50 scoping and role allocation

  Timeline: Immediate

  Details

  Why

  Determine where the company is a provider, a deployer, or both. The fastest triage question is not “Do we use AI?” but which business units are providers, which are deployers, and which outputs reach people directly.

  Actions

  • Build a use-case register covering every AI system that reaches people.
  • Assign a provider or deployer role per workflow.
  • Identify EU-facing outputs, including non-EU products whose outputs are used in the Union.
  • Set a RACI by business unit.

  Owners

  Legal · Compliance · AI governance · Procurement

  Evidence to retain

  Use-case inventory · RACI matrix · Territorial-scope memo · Board or steering-pack excerpt

• Legal & compliance· Art. 50(2), (4), (5)High

  Decide on the Code of Practice strategy

  Timeline: Within days

  Details

  Why

  Choose the simplest evidence model. The Code of Practice on Transparency of AI-Generated Content is voluntary, but the Commission and the AI Board have assessed it as an adequate method for demonstrating compliance with the marking and labelling duties.

  Actions

  • Determine whether to sign the Code for the relevant provider and/or deployer functions.
  • If not signing, define the “alternative adequate means” evidence package — non-signatories remain free to comply otherwise but should expect to prove adequacy more directly.

  Owners

  Legal · Compliance · Executive sponsor

  Evidence to retain

  Signatory decision memo · Code adherence plan · Evidence index for the non-signatory alternative

• Legal & compliance· EvidenceHigh

  Create an Article 50 evidence file

  Timeline: Immediate and ongoing

  Details

  Why

  Prepare for regulator requests and internal audit. Enforcement is decentralised: national market surveillance authorities will mainly enforce Article 50.

  Actions

  • Centralise screenshots, scripts, metadata specs, exception decisions, accessibility reviews, vendor attestations, and publication review records.
  • Retain dated copies of control changes made before 2 August, and before 2 December for eligible legacy systems.

  Owners

  Compliance · Internal audit · Records management

  Evidence to retain

  Evidence register · Retention policy · Control-owner certifications

• Providers· Art. 50(1)High

  Enable direct-interaction disclosure by design

  Timeline: Immediate — complete before 2 Aug 2026

  Details

  Why

  Systems intended to interact directly with natural persons must be designed so people are informed they are interacting with AI, before market placement or service launch.

  Actions

  • Identify all systems that directly converse with natural persons.
  • Decide whether any “obvious interaction” position is defensible — the Commission says this exception should be interpreted restrictively.
  • Implement a default greeting, banner, or voice disclosure in every channel and locale.
  • Confirm accessibility support.

  Owners

  Product owner · Legal · UX · Engineering

  Evidence to retain

  Scope memo · Screenshots · Voice prompt scripts · Accessibility review · Decision log on any “obvious” exception

• Providers· Art. 50(2)High

  Implement machine-readable provenance or marking

  Timeline: Immediate for live systems; eligible legacy systems by 2 Dec 2026

  Details

  Why

  Synthetic audio, image, video, or text outputs must be machine-readable and detectable as artificially generated or manipulated. Solutions should be effective, interoperable, robust, and reliable so far as technically feasible.

  Actions

  • Turn on automated marking for synthetic text, image, audio, and video where in scope.
  • Document technical feasibility limits by modality.
  • Test detectability after export, compression, API delivery, and platform upload.

  Owners

  Engineering · ML platform · Security · Legal

  Evidence to retain

  Technical spec · Test logs · Sample marked files · Detectability results · Limitation register

• Providers· Art. 50(2)High

  Separate in-scope from out-of-scope outputs

  Timeline: Immediate; refresh monthly

  Details

  Why

  Avoid over-labelling some content while missing others. Source code, short symbol strings, machine-to-machine outputs and some closed-loop industrial outputs fall outside the marking duty.

  Actions

  • Classify source code, short strings, machine-to-machine outputs, draft industrial outputs, standard-editing functions, and final consumer-facing outputs.
  • Document why any output is treated as outside Article 50(2).

  Owners

  Legal · ML governance · Platform engineering

  Evidence to retain

  Output classification matrix · Exception rationale · Owner sign-off

• Deployers· Art. 50(4)High

  Turn on deepfake labelling

  Timeline: Immediate — complete before 2 Aug 2026

  Details

  Why

  Image, audio, or video content constituting a deepfake must be disclosed as artificially generated or manipulated. Visible or audible disclosure is required — machine-readable marks alone are not enough.

  Actions

  • Identify deepfake use cases across ads, training, customer support, social media, entertainment, investor and brand content.
  • Place visible or audible notices at first exposure.
  • Do not rely solely on provider metadata.

  Owners

  Content operations · Marketing · Legal · Web/app ops

  Evidence to retain

  Label screenshots · Player overlays · Audio scripts · Publishing SOP · Sample outputs

• Deployers· Art. 50(4)High

  Label public-interest text, or control the review exemption

  Timeline: Immediate

  Details

  Why

  AI-generated or manipulated text published to inform the public on matters of public interest must be disclosed, unless it underwent substantive human review and a person holds editorial responsibility. Spell-checking or grammar checks are not enough.

  Actions

  • Flag content involving politics, public health, law, justice, security, environment, consumer safety, or major economic, scientific and cultural debate. The Regulation says only “matters of public interest” — this list comes from the Commission guidelines and is illustrative, not exhaustive. A topic outside it is not automatically outside scope.
  • Either label it, or route it through a substantive human review and editorial responsibility workflow.

  Owners

  Editorial · Public affairs · Legal · Communications

  Evidence to retain

  Review checklist · Editor approval record · Publication attestation · Labelled examples

• Deployers· Art. 50(3)High

  Implement emotion-recognition and biometric exposure notices

  Timeline: Immediate

  Details

  Why

  People exposed to an emotion recognition or biometric categorisation system must be informed it is operating. Article 50(3) also expressly requires personal data to be processed in accordance with the GDPR — a notice is necessary but not sufficient.

  Actions

  • Map kiosks, surveillance systems, workplace analytics, access control, fraud tools, and customer analytics using such functions.
  • Post notices at first exposure.
  • Align with the privacy notice and the lawful-basis analysis; assess whether a DPIA or DPO involvement is required.

  Owners

  Operations · Privacy · Facilities · Security · HR · Product

  Evidence to retain

  Notice text · Placement photos · Privacy assessment · Data-flow map

• Product & engineering· Art. 50(5)High

  Ensure notices appear at first interaction or first exposure

  Timeline: Immediate

  Details

  Why

  The required information must be provided no later than the first interaction or exposure.

  Actions

  • Add notices to the first screen, first chat turn, first audio prompt, first playback segment, article header, or equivalent.
  • Verify across web, mobile, API wrappers, embedded widgets, and third-party distribution channels.

  Owners

  Engineering · UX · QA

  Evidence to retain

  Regression tests · Screenshots · Video captures · Release notes

• Product & engineering· Art. 50(5)High

  Make notices and labels accessible and perceivable

  Timeline: Immediate

  Details

  Why

  Information must be clear, distinguishable, and accessible — which also aligns with the GDPR transparency standard.

  Actions

  • Use readable contrast, screen-reader labels, captions, alt text, and audible disclosure where needed.
  • Test with assistive technologies.
  • Localise the wording.

  Owners

  UX · Accessibility · Engineering · Localization

  Evidence to retain

  Accessibility issue log · WCAG-aligned review notes · Translated strings

• Product & engineering· Art. 50(2)High

  Preserve and verify metadata through the pipeline

  Timeline: Critical fixes before 2 Aug 2026; eligible legacy fixes before 2 Dec 2026

  Details

  Why

  Provider-side marking is only meaningful if it survives delivery. Many pipelines silently strip provenance information.

  Actions

  • Test whether the CDN, CMS, DAM, social tools, image processors, and transcoders strip marks.
  • Log failures.
  • Implement preservation rules, or fallback visible labelling.

  Owners

  Platform engineering · CMS team · Security

  Evidence to retain

  Preservation test matrix · Defect tickets · Remediation plan

• Communications & editorial· Art. 50(4)High

  Build a meaningful human-review workflow for public-interest text

  Timeline: Immediate

  Details

  Why

  Use the exemption only where it is genuinely available. Review must be substantive, and someone must hold editorial responsibility.

  Actions

  • Require subject-matter review by someone with relevant knowledge.
  • Give the reviewer authority to approve, alter, or reject on substantive grounds.
  • Never leave “editorial responsibility” undefined.

  Owners

  Editorial · Legal · Public policy · Communications

  Evidence to retain

  Human-review checklist · Named reviewer log · Editorial-responsibility designation

• Communications & editorial· Art. 50(5)Medium

  Standardise label placement and icon usage

  Timeline: Immediate

  Details

  Why

  Make disclosures understandable and consistent across channels.

  Actions

  • Adopt a style rule for where labels appear on articles, videos, audio players, social posts, and campaign assets.
  • The Commission provides three optional EU icons for labelling AI-generated content. Use them where helpful, but pair an icon with plain-language text as the safer default unless usability testing shows icon-only disclosure is clearly understood.

  Owners

  Brand · Communications · UX · Legal

  Evidence to retain

  Style guide · Creative templates · Approval examples · Usability notes

• Communications & editorial· Art. 50(4)Medium

  Handle artistic, satirical and fictional content separately

  Timeline: Before publication of each asset

  Details

  Why

  For evidently artistic, creative, satirical or fictional works, disclosure may be given in a way that does not hamper enjoyment of the work — but the allowance should not be over-claimed.

  Actions

  • For films, satire, fiction and analogous works, decide how disclosure can appear without harming enjoyment.
  • Document why the chosen presentation is appropriate.

  Owners

  Editorial · Production · Legal

  Evidence to retain

  Exception memo · Example assets · Content classification log

• Vendors & procurement· RolesHigh

  Allocate Article 50 duties contractually

  Timeline: Immediate for top-risk vendors

  Details

  Why

  Prevent responsibility gaps between provider and deployer functions.

  Actions

  • Amend contracts to state who supplies machine-readable marking, who displays user-facing labels, who preserves marks, and who responds to regulator inquiries.

  Owners

  Procurement · Legal · Vendor management

  Evidence to retain

  Contract addenda · Clause library · Vendor responsibility matrix

• Vendors & procurement· Art. 50(2)High

  Obtain vendor evidence on marking capabilities and limits

  Timeline: Immediate

  Details

  Why

  Prove technical feasibility efforts and preserve escalation rights.

  Actions

  • Request documentation on the marking method, supported formats, detectability limits, known metadata-stripping risks, and rollout timing for legacy systems.

  Owners

  Procurement · Engineering · Legal

  Evidence to retain

  Vendor questionnaire · Attestations · Technical whitepaper or support tickets

• Vendors & procurement· Art. 50(3)High

  Align privacy terms for biometric or emotion systems

  Timeline: Immediate

  Details

  Why

  Reduce GDPR exposure where Article 50(3) applies.

  Actions

  • Confirm controller and processor roles, lawful-basis support, subprocessor use, retention, data-minimisation controls, security, audit rights, and DPO or DPIA support commitments.

  Owners

  Privacy · Legal · Procurement · Security

  Evidence to retain

  DPA · Transfer assessment if relevant · DPIA input from vendor · Security annex

• Provider situations

  Customer-facing chatbot or voice assistant

  You build or offer a system intended to interact directly with natural persons.

  What applies

  • Art. 50(1): design the disclosure into the system before market placement — default greeting, banner or voice prompt, in every channel and locale.
  • Disclosure at the latest at the first interaction.

  Common traps

  • The “obvious AI interaction” exception is interpreted restrictively — document any reliance on it.
  • A disclosure that exists in one channel but not in an embedded widget or API wrapper is a gap.

• Provider situations

  Generative AI product — image, audio, video or text

  Your system produces synthetic content within Article 50(2).

  What applies

  • Machine-readable marking, detectable as artificially generated or manipulated.
  • Solutions effective, interoperable, robust and reliable so far as technically feasible — document feasibility limits by modality.

  Common traps

  • Marks that do not survive export, compression, API delivery or platform upload.
  • Relying on marking alone where a deployer also needs a visible disclosure.

• Provider situations

  Assistive or standard-editing features only

  Your AI feature retouches, corrects or adjusts content without substantially altering the input.

  What applies

  • No marking duty where the input is not substantially altered (standard-editing exception).

  Common traps

  • The line between “standard editing” and generation is factual — document the analysis per feature, and revisit when features gain generative capability.

• Provider situations

  System placed on the market before 2 August 2026

  An in-scope system predates the application date.

  What applies

  • Transition until 2 December 2026 — but only for the Art. 50(2) machine-readable marking duty.
  • All other Article 50 duties apply from 2 August 2026.

  Common traps

  • Treating the grace period as a general postponement — it is not.
  • Systems placed on the market on or after 2 August 2026 get no transition at all.

• Provider situations

  B2B, machine-to-machine or closed-loop industrial outputs

  Outputs are source code, short symbol strings, machine-to-machine data, or non-final industrial outputs.

  What applies

  • These can fall outside the Art. 50(2) marking duty; the guidelines also describe a narrow B2B or industrial exemption under stated conditions.

  Common traps

  • The exemption is narrow and conditional — keep a documented rationale per output type, signed off by an owner.
  • An “industrial” output that later reaches consumers re-enters scope.

• Provider situations

  Non-EU provider with users in the Union

  You have no EU establishment, but your system's outputs are used in the EU.

  What applies

  • Article 2 scope: non-EU providers and deployers can still be in scope where outputs are used in the Union.

  Common traps

  • Assuming geography alone puts you out of scope — map where outputs actually land, not where servers sit.

• Deployer situations

  Vendor chatbot embedded on your site or app

  You deploy a third-party conversational system under your authority.

  What applies

  • The provider builds the disclosure; you need operational controls so it actually appears in use — in your theme, your locales, your channels.

  Common traps

  • A custom skin or integration that hides the provider's disclosure.
  • No contractual clarity on who answers a regulator's question.

• Deployer situations

  Deepfake in marketing, training or entertainment content

  You publish AI-generated or manipulated image, audio or video that appears real.

  What applies

  • Art. 50(4): visible or audible disclosure at first exposure — player overlay, opening frame, caption or audible introduction.

  Common traps

  • Relying on the provider's hidden metadata alone — it does not satisfy the visible-disclosure duty.
  • Labels that disappear when content is downloaded, shared, embedded or reposted.

• Deployer situations

  Evidently artistic, satirical or fictional work

  The deepfake is part of a film, satire, fiction or analogous work.

  What applies

  • Disclosure may be given in a way that does not hamper enjoyment of the work.

  Common traps

  • Over-claiming the allowance for content that is not evidently artistic — classify and document each asset.

• Deployer situations

  AI-drafted articles on public-interest topics

  You publish AI-generated text informing the public on politics, health, law, justice, security, environment, consumer safety or major public debate.

  What applies

  • Label the text — or run it through substantive human review with a person holding editorial responsibility.

  Common traps

  • Spell-checking or grammar passes do not qualify as substantive review.
  • “Editorial responsibility” left undefined — name the person.

• Deployer situations

  Internal-only AI text, never published

  AI drafts internal reports, memos or emails that are not published to inform the public.

  What applies

  • The Art. 50(4) text duty targets text published to inform the public on matters of public interest — purely internal documents are generally outside it.

  Common traps

  • Internal content that later gets published — build the labelling check into the publication step, not the drafting step.

• Deployer situations

  Emotion recognition in HR, sales or support

  Workplace analytics, interview tools or call-centre systems infer emotions.

  What applies

  • Art. 50(3): inform exposed persons the system is operating, at first exposure.
  • GDPR in parallel: lawful basis, transparency, and likely a DPIA — a notice alone is not compliance.

  Common traps

  • Forgetting that other AI Act chapters (including high-risk duties) may apply on top of Article 50.

• Deployer situations

  Biometric categorisation in physical spaces

  Kiosks, retail analytics or CCTV-linked systems categorise people on biometric data.

  What applies

  • Art. 50(3) notice at first exposure — posted where people actually see it.
  • Large-scale monitoring of publicly accessible areas is a typical DPIA trigger under the GDPR.

  Common traps

  • A notice hidden in a privacy policy no one sees before exposure.

• Deployer situations

  Content created before 2 August 2026

  Your archives contain AI-generated content from before the application date.

  What applies

  • No retroactive labelling is required; the Commission encourages voluntary labelling where feasible.

  Common traps

  • Re-publishing or re-cutting old content after 2 August 2026 — treat that as a new publication decision.

• Special cases

  You are both provider and deployer

  One business unit ships an AI product; another uses third-party AI tools.

  What applies

  • Allocate the role per use case in a single register, and assign each Article 50 duty accordingly.

  Common traps

  • Duties falling into the gap between two teams that each assume the other owns them.

• Special cases

  Employees using AI tools at work

  Staff use AI systems in the course of their job.

  What applies

  • Employees acting under the authority and control of a legal entity are generally not separate deployers — the company holds the duties.

  Common traps

  • Shadow AI: tools adopted by teams without appearing in the company's use-case register.

• Special cases

  EU institutions, bodies and agencies

  The provider or deployer is an EU institution.

  What applies

  • The European Data Protection Supervisor is the competent authority; the Commission fact page notes fines up to €750,000.

• Special cases

  SMEs and start-ups

  You are a small company with limited compliance resources.

  What applies

  • The duties are identical — size does not change what Article 50 requires.
  • Only the arithmetic of the ceiling changes. For undertakings generally, the ceiling is the higher of €15 million or 3% of worldwide annual turnover; Article 99(6) inverts this for SMEs and start-ups, making it the lower of the two.

  Common traps

  • Reading the SME rule as a lighter obligation rather than a lower ceiling — the duties themselves are unchanged.
  • Deferring scoping because of size — the register and front-end notices are the minimum viable controls.

• Special cases

  Content distributed on a very large online platform

  Your AI-generated content is published on a designated very large online platform or search engine.

  What applies

  • Article 50 duties continue to apply to you as provider or deployer.
  • The platform carries its own DSA systemic-risk obligations for generative content, including marking where feasible — those duties sit on the platform, not on you, and do not discharge your Article 50 disclosure.
  • Where the same entity provides both the system and the underlying general-purpose model, or the system is integrated into a designated platform, the AI Office has a specific enforcement role alongside national authorities.

  Common traps

  • Assuming a platform's automatic AI label satisfies your own deployer disclosure — it does not.

• Special cases

  System built on your own GPAI model, or integrated into a designated platform

  The same entity provides both the system and the general-purpose model, or the system is integrated into a designated very large online platform or search engine.

  What applies

  • The AI Office has a specific enforcement role in these configurations, alongside national market surveillance authorities.

• Special cases

  Law-enforcement uses

  The system is used for the detection, prevention, investigation or prosecution of criminal offences.

  What applies

  • Specific exceptions exist across Art. 50(1)–(4), under the conditions stated in each paragraph.

  Common traps

  • The exceptions are conditional, not a blanket carve-out — document the reliance conditions for each use.