Checklist de conformité — article 50

Cochez chaque affirmation qui décrit votre organisation. Les obligations applicables s'affichent en dessous, avec les groupes de la checklist à traiter.

• A system we offer or operate interacts directly with people — chat, voice assistant, avatar, kiosk.
• We develop or offer a system that generates or manipulates audio, images, video or text.
• We publish AI-generated or AI-manipulated images, audio or video that appear real (deepfakes) — including in ads, training or brand content.
• We publish AI-generated text that informs the public on matters of public interest — politics, health, law, justice, security, environment, consumer safety.
• We use emotion recognition or biometric categorisation — workplace analytics, kiosks, CCTV analytics, access control, fraud tools.
• We are established outside the EU, but outputs of our AI systems are used in the Union.
• Some of our in-scope systems were placed on the market before 2 August 2026.
• Different business units both build AI systems and use third-party AI tools.

• Legal & compliance· ScopeHaute

  Complete Article 50 scoping and role allocation

  Échéance: Immediate

  Détails

  Pourquoi

  Determine where the company is a provider, a deployer, or both. The fastest triage question is not “Do we use AI?” but which business units are providers, which are deployers, and which outputs reach people directly.

  Actions

  • Build a use-case register covering every AI system that reaches people.
  • Assign a provider or deployer role per workflow.
  • Identify EU-facing outputs, including non-EU products whose outputs are used in the Union.
  • Set a RACI by business unit.

  Responsables

  Legal · Compliance · AI governance · Procurement

  Preuves à conserver

  Use-case inventory · RACI matrix · Territorial-scope memo · Board or steering-pack excerpt

• Legal & compliance· Art. 50(2), (4), (5)Haute

  Decide on the Code of Practice strategy

  Échéance: Within days

  Détails

  Pourquoi

  Choose the simplest evidence model. The Code of Practice on Transparency of AI-Generated Content is voluntary, but the Commission and the AI Board have assessed it as an adequate method for demonstrating compliance with the marking and labelling duties.

  Actions

  • Determine whether to sign the Code for the relevant provider and/or deployer functions.
  • If not signing, define the “alternative adequate means” evidence package — non-signatories remain free to comply otherwise but should expect to prove adequacy more directly.

  Responsables

  Legal · Compliance · Executive sponsor

  Preuves à conserver

  Signatory decision memo · Code adherence plan · Evidence index for the non-signatory alternative

• Legal & compliance· EvidenceHaute

  Create an Article 50 evidence file

  Échéance: Immediate and ongoing

  Détails

  Pourquoi

  Prepare for regulator requests and internal audit. Enforcement is decentralised: national market surveillance authorities will mainly enforce Article 50.

  Actions

  • Centralise screenshots, scripts, metadata specs, exception decisions, accessibility reviews, vendor attestations, and publication review records.
  • Retain dated copies of control changes made before 2 August, and before 2 December for eligible legacy systems.

  Responsables

  Compliance · Internal audit · Records management

  Preuves à conserver

  Evidence register · Retention policy · Control-owner certifications

• Providers· Art. 50(1)Haute

  Enable direct-interaction disclosure by design

  Échéance: Immediate — complete before 2 Aug 2026

  Détails

  Pourquoi

  Systems intended to interact directly with natural persons must be designed so people are informed they are interacting with AI, before market placement or service launch.

  Actions

  • Identify all systems that directly converse with natural persons.
  • Decide whether any “obvious interaction” position is defensible — the Commission says this exception should be interpreted restrictively.
  • Implement a default greeting, banner, or voice disclosure in every channel and locale.
  • Confirm accessibility support.

  Responsables

  Product owner · Legal · UX · Engineering

  Preuves à conserver

  Scope memo · Screenshots · Voice prompt scripts · Accessibility review · Decision log on any “obvious” exception

• Providers· Art. 50(2)Haute

  Implement machine-readable provenance or marking

  Échéance: Immediate for live systems; eligible legacy systems by 2 Dec 2026

  Détails

  Pourquoi

  Synthetic audio, image, video, or text outputs must be machine-readable and detectable as artificially generated or manipulated. Solutions should be effective, interoperable, robust, and reliable so far as technically feasible.

  Actions

  • Turn on automated marking for synthetic text, image, audio, and video where in scope.
  • Document technical feasibility limits by modality.
  • Test detectability after export, compression, API delivery, and platform upload.

  Responsables

  Engineering · ML platform · Security · Legal

  Preuves à conserver

  Technical spec · Test logs · Sample marked files · Detectability results · Limitation register

• Providers· Art. 50(2)Haute

  Separate in-scope from out-of-scope outputs

  Échéance: Immediate; refresh monthly

  Détails

  Pourquoi

  Avoid over-labelling some content while missing others. Source code, short symbol strings, machine-to-machine outputs and some closed-loop industrial outputs fall outside the marking duty.

  Actions

  • Classify source code, short strings, machine-to-machine outputs, draft industrial outputs, standard-editing functions, and final consumer-facing outputs.
  • Document why any output is treated as outside Article 50(2).

  Responsables

  Legal · ML governance · Platform engineering

  Preuves à conserver

  Output classification matrix · Exception rationale · Owner sign-off

• Deployers· Art. 50(4)Haute

  Turn on deepfake labelling

  Échéance: Immediate — complete before 2 Aug 2026

  Détails

  Pourquoi

  Image, audio, or video content constituting a deepfake must be disclosed as artificially generated or manipulated. Visible or audible disclosure is required — machine-readable marks alone are not enough.

  Actions

  • Identify deepfake use cases across ads, training, customer support, social media, entertainment, investor and brand content.
  • Place visible or audible notices at first exposure.
  • Do not rely solely on provider metadata.

  Responsables

  Content operations · Marketing · Legal · Web/app ops

  Preuves à conserver

  Label screenshots · Player overlays · Audio scripts · Publishing SOP · Sample outputs

• Deployers· Art. 50(4)Haute

  Label public-interest text, or control the review exemption

  Échéance: Immediate

  Détails

  Pourquoi

  AI-generated or manipulated text published to inform the public on matters of public interest must be disclosed, unless it underwent substantive human review and a person holds editorial responsibility. Spell-checking or grammar checks are not enough.

  Actions

  • Flag content involving politics, public health, law, justice, security, environment, consumer safety, or major economic, scientific and cultural debate. The Regulation says only “matters of public interest” — this list comes from the Commission guidelines and is illustrative, not exhaustive. A topic outside it is not automatically outside scope.
  • Either label it, or route it through a substantive human review and editorial responsibility workflow.

  Responsables

  Editorial · Public affairs · Legal · Communications

  Preuves à conserver

  Review checklist · Editor approval record · Publication attestation · Labelled examples

• Deployers· Art. 50(3)Haute

  Implement emotion-recognition and biometric exposure notices

  Échéance: Immediate

  Détails

  Pourquoi

  People exposed to an emotion recognition or biometric categorisation system must be informed it is operating. Article 50(3) also expressly requires personal data to be processed in accordance with the GDPR — a notice is necessary but not sufficient.

  Actions

  • Map kiosks, surveillance systems, workplace analytics, access control, fraud tools, and customer analytics using such functions.
  • Post notices at first exposure.
  • Align with the privacy notice and the lawful-basis analysis; assess whether a DPIA or DPO involvement is required.

  Responsables

  Operations · Privacy · Facilities · Security · HR · Product

  Preuves à conserver

  Notice text · Placement photos · Privacy assessment · Data-flow map

• Product & engineering· Art. 50(5)Haute

  Ensure notices appear at first interaction or first exposure

  Échéance: Immediate

  Détails

  Pourquoi

  The required information must be provided no later than the first interaction or exposure.

  Actions

  • Add notices to the first screen, first chat turn, first audio prompt, first playback segment, article header, or equivalent.
  • Verify across web, mobile, API wrappers, embedded widgets, and third-party distribution channels.

  Responsables

  Engineering · UX · QA

  Preuves à conserver

  Regression tests · Screenshots · Video captures · Release notes

• Product & engineering· Art. 50(5)Haute

  Make notices and labels accessible and perceivable

  Échéance: Immediate

  Détails

  Pourquoi

  Information must be clear, distinguishable, and accessible — which also aligns with the GDPR transparency standard.

  Actions

  • Use readable contrast, screen-reader labels, captions, alt text, and audible disclosure where needed.
  • Test with assistive technologies.
  • Localise the wording.

  Responsables

  UX · Accessibility · Engineering · Localization

  Preuves à conserver

  Accessibility issue log · WCAG-aligned review notes · Translated strings

• Product & engineering· Art. 50(2)Haute

  Preserve and verify metadata through the pipeline

  Échéance: Critical fixes before 2 Aug 2026; eligible legacy fixes before 2 Dec 2026

  Détails

  Pourquoi

  Provider-side marking is only meaningful if it survives delivery. Many pipelines silently strip provenance information.

  Actions

  • Test whether the CDN, CMS, DAM, social tools, image processors, and transcoders strip marks.
  • Log failures.
  • Implement preservation rules, or fallback visible labelling.

  Responsables

  Platform engineering · CMS team · Security

  Preuves à conserver

  Preservation test matrix · Defect tickets · Remediation plan

• Communications & editorial· Art. 50(4)Haute

  Build a meaningful human-review workflow for public-interest text

  Échéance: Immediate

  Détails

  Pourquoi

  Use the exemption only where it is genuinely available. Review must be substantive, and someone must hold editorial responsibility.

  Actions

  • Require subject-matter review by someone with relevant knowledge.
  • Give the reviewer authority to approve, alter, or reject on substantive grounds.
  • Never leave “editorial responsibility” undefined.

  Responsables

  Editorial · Legal · Public policy · Communications

  Preuves à conserver

  Human-review checklist · Named reviewer log · Editorial-responsibility designation

• Communications & editorial· Art. 50(5)Moyenne

  Standardise label placement and icon usage

  Échéance: Immediate

  Détails

  Pourquoi

  Make disclosures understandable and consistent across channels.

  Actions

  • Adopt a style rule for where labels appear on articles, videos, audio players, social posts, and campaign assets.
  • The Commission provides three optional EU icons for labelling AI-generated content. Use them where helpful, but pair an icon with plain-language text as the safer default unless usability testing shows icon-only disclosure is clearly understood.

  Responsables

  Brand · Communications · UX · Legal

  Preuves à conserver

  Style guide · Creative templates · Approval examples · Usability notes

• Communications & editorial· Art. 50(4)Moyenne

  Handle artistic, satirical and fictional content separately

  Échéance: Before publication of each asset

  Détails

  Pourquoi

  For evidently artistic, creative, satirical or fictional works, disclosure may be given in a way that does not hamper enjoyment of the work — but the allowance should not be over-claimed.

  Actions

  • For films, satire, fiction and analogous works, decide how disclosure can appear without harming enjoyment.
  • Document why the chosen presentation is appropriate.

  Responsables

  Editorial · Production · Legal

  Preuves à conserver

  Exception memo · Example assets · Content classification log

• Vendors & procurement· RolesHaute

  Allocate Article 50 duties contractually

  Échéance: Immediate for top-risk vendors

  Détails

  Pourquoi

  Prevent responsibility gaps between provider and deployer functions.

  Actions

  • Amend contracts to state who supplies machine-readable marking, who displays user-facing labels, who preserves marks, and who responds to regulator inquiries.

  Responsables

  Procurement · Legal · Vendor management

  Preuves à conserver

  Contract addenda · Clause library · Vendor responsibility matrix

• Vendors & procurement· Art. 50(2)Haute

  Obtain vendor evidence on marking capabilities and limits

  Échéance: Immediate

  Détails

  Pourquoi

  Prove technical feasibility efforts and preserve escalation rights.

  Actions

  • Request documentation on the marking method, supported formats, detectability limits, known metadata-stripping risks, and rollout timing for legacy systems.

  Responsables

  Procurement · Engineering · Legal

  Preuves à conserver

  Vendor questionnaire · Attestations · Technical whitepaper or support tickets

• Vendors & procurement· Art. 50(3)Haute

  Align privacy terms for biometric or emotion systems

  Échéance: Immediate

  Détails

  Pourquoi

  Reduce GDPR exposure where Article 50(3) applies.

  Actions

  • Confirm controller and processor roles, lawful-basis support, subprocessor use, retention, data-minimisation controls, security, audit rights, and DPO or DPIA support commitments.

  Responsables

  Privacy · Legal · Procurement · Security

  Preuves à conserver

  DPA · Transfer assessment if relevant · DPIA input from vendor · Security annex

• Provider situations

  Customer-facing chatbot or voice assistant

  You build or offer a system intended to interact directly with natural persons.

  Ce qui s'applique

  • Art. 50(1): design the disclosure into the system before market placement — default greeting, banner or voice prompt, in every channel and locale.
  • Disclosure at the latest at the first interaction.

  Pièges fréquents

  • The “obvious AI interaction” exception is interpreted restrictively — document any reliance on it.
  • A disclosure that exists in one channel but not in an embedded widget or API wrapper is a gap.

• Provider situations

  Generative AI product — image, audio, video or text

  Your system produces synthetic content within Article 50(2).

  Ce qui s'applique

  • Machine-readable marking, detectable as artificially generated or manipulated.
  • Solutions effective, interoperable, robust and reliable so far as technically feasible — document feasibility limits by modality.

  Pièges fréquents

  • Marks that do not survive export, compression, API delivery or platform upload.
  • Relying on marking alone where a deployer also needs a visible disclosure.

• Provider situations

  Assistive or standard-editing features only

  Your AI feature retouches, corrects or adjusts content without substantially altering the input.

  Ce qui s'applique

  • No marking duty where the input is not substantially altered (standard-editing exception).

  Pièges fréquents

  • The line between “standard editing” and generation is factual — document the analysis per feature, and revisit when features gain generative capability.

• Provider situations

  System placed on the market before 2 August 2026

  An in-scope system predates the application date.

  Ce qui s'applique

  • Transition until 2 December 2026 — but only for the Art. 50(2) machine-readable marking duty.
  • All other Article 50 duties apply from 2 August 2026.

  Pièges fréquents

  • Treating the grace period as a general postponement — it is not.
  • Systems placed on the market on or after 2 August 2026 get no transition at all.

• Provider situations

  B2B, machine-to-machine or closed-loop industrial outputs

  Outputs are source code, short symbol strings, machine-to-machine data, or non-final industrial outputs.

  Ce qui s'applique

  • These can fall outside the Art. 50(2) marking duty; the guidelines also describe a narrow B2B or industrial exemption under stated conditions.

  Pièges fréquents

  • The exemption is narrow and conditional — keep a documented rationale per output type, signed off by an owner.
  • An “industrial” output that later reaches consumers re-enters scope.

• Provider situations

  Non-EU provider with users in the Union

  You have no EU establishment, but your system's outputs are used in the EU.

  Ce qui s'applique

  • Article 2 scope: non-EU providers and deployers can still be in scope where outputs are used in the Union.

  Pièges fréquents

  • Assuming geography alone puts you out of scope — map where outputs actually land, not where servers sit.

• Deployer situations

  Vendor chatbot embedded on your site or app

  You deploy a third-party conversational system under your authority.

  Ce qui s'applique

  • The provider builds the disclosure; you need operational controls so it actually appears in use — in your theme, your locales, your channels.

  Pièges fréquents

  • A custom skin or integration that hides the provider's disclosure.
  • No contractual clarity on who answers a regulator's question.

• Deployer situations

  Deepfake in marketing, training or entertainment content

  You publish AI-generated or manipulated image, audio or video that appears real.

  Ce qui s'applique

  • Art. 50(4): visible or audible disclosure at first exposure — player overlay, opening frame, caption or audible introduction.

  Pièges fréquents

  • Relying on the provider's hidden metadata alone — it does not satisfy the visible-disclosure duty.
  • Labels that disappear when content is downloaded, shared, embedded or reposted.

• Deployer situations

  Evidently artistic, satirical or fictional work

  The deepfake is part of a film, satire, fiction or analogous work.

  Ce qui s'applique

  • Disclosure may be given in a way that does not hamper enjoyment of the work.

  Pièges fréquents

  • Over-claiming the allowance for content that is not evidently artistic — classify and document each asset.

• Deployer situations

  AI-drafted articles on public-interest topics

  You publish AI-generated text informing the public on politics, health, law, justice, security, environment, consumer safety or major public debate.

  Ce qui s'applique

  • Label the text — or run it through substantive human review with a person holding editorial responsibility.

  Pièges fréquents

  • Spell-checking or grammar passes do not qualify as substantive review.
  • “Editorial responsibility” left undefined — name the person.

• Deployer situations

  Internal-only AI text, never published

  AI drafts internal reports, memos or emails that are not published to inform the public.

  Ce qui s'applique

  • The Art. 50(4) text duty targets text published to inform the public on matters of public interest — purely internal documents are generally outside it.

  Pièges fréquents

  • Internal content that later gets published — build the labelling check into the publication step, not the drafting step.

• Deployer situations

  Emotion recognition in HR, sales or support

  Workplace analytics, interview tools or call-centre systems infer emotions.

  Ce qui s'applique

  • Art. 50(3): inform exposed persons the system is operating, at first exposure.
  • GDPR in parallel: lawful basis, transparency, and likely a DPIA — a notice alone is not compliance.

  Pièges fréquents

  • Forgetting that other AI Act chapters (including high-risk duties) may apply on top of Article 50.

• Deployer situations

  Biometric categorisation in physical spaces

  Kiosks, retail analytics or CCTV-linked systems categorise people on biometric data.

  Ce qui s'applique

  • Art. 50(3) notice at first exposure — posted where people actually see it.
  • Large-scale monitoring of publicly accessible areas is a typical DPIA trigger under the GDPR.

  Pièges fréquents

  • A notice hidden in a privacy policy no one sees before exposure.

• Deployer situations

  Content created before 2 August 2026

  Your archives contain AI-generated content from before the application date.

  Ce qui s'applique

  • No retroactive labelling is required; the Commission encourages voluntary labelling where feasible.

  Pièges fréquents

  • Re-publishing or re-cutting old content after 2 August 2026 — treat that as a new publication decision.

• Special cases

  You are both provider and deployer

  One business unit ships an AI product; another uses third-party AI tools.

  Ce qui s'applique

  • Allocate the role per use case in a single register, and assign each Article 50 duty accordingly.

  Pièges fréquents

  • Duties falling into the gap between two teams that each assume the other owns them.

• Special cases

  Employees using AI tools at work

  Staff use AI systems in the course of their job.

  Ce qui s'applique

  • Employees acting under the authority and control of a legal entity are generally not separate deployers — the company holds the duties.

  Pièges fréquents

  • Shadow AI: tools adopted by teams without appearing in the company's use-case register.

• Special cases

  EU institutions, bodies and agencies

  The provider or deployer is an EU institution.

  Ce qui s'applique

  • The European Data Protection Supervisor is the competent authority; the Commission fact page notes fines up to €750,000.

• Special cases

  SMEs and start-ups

  You are a small company with limited compliance resources.

  Ce qui s'applique

  • The duties are identical — size does not change what Article 50 requires.
  • Only the arithmetic of the ceiling changes. For undertakings generally, the ceiling is the higher of €15 million or 3% of worldwide annual turnover; Article 99(6) inverts this for SMEs and start-ups, making it the lower of the two.

  Pièges fréquents

  • Reading the SME rule as a lighter obligation rather than a lower ceiling — the duties themselves are unchanged.
  • Deferring scoping because of size — the register and front-end notices are the minimum viable controls.

• Special cases

  Content distributed on a very large online platform

  Your AI-generated content is published on a designated very large online platform or search engine.

  Ce qui s'applique

  • Article 50 duties continue to apply to you as provider or deployer.
  • The platform carries its own DSA systemic-risk obligations for generative content, including marking where feasible — those duties sit on the platform, not on you, and do not discharge your Article 50 disclosure.
  • Where the same entity provides both the system and the underlying general-purpose model, or the system is integrated into a designated platform, the AI Office has a specific enforcement role alongside national authorities.

  Pièges fréquents

  • Assuming a platform's automatic AI label satisfies your own deployer disclosure — it does not.

• Special cases

  System built on your own GPAI model, or integrated into a designated platform

  The same entity provides both the system and the general-purpose model, or the system is integrated into a designated very large online platform or search engine.

  Ce qui s'applique

  • The AI Office has a specific enforcement role in these configurations, alongside national market surveillance authorities.

• Special cases

  Law-enforcement uses

  The system is used for the detection, prevention, investigation or prosecution of criminal offences.

  Ce qui s'applique

  • Specific exceptions exist across Art. 50(1)–(4), under the conditions stated in each paragraph.

  Pièges fréquents

  • The exceptions are conditional, not a blanket carve-out — document the reliance conditions for each use.