Seyfarth Synopsis: On Thursday 30 July, the European Commission issued a press release advising that EU AI Act enforcement begins this SUNDAY, 2 August 2026, when the Act’s transparency rules start to apply. Chatbots and other interactive AI systems need to be ready to identify themselves. Deepfakes and AI generated content needs to be labelled. There are limited exceptions.
The EU AI Act’s Article 50 transparency obligations apply broadly, with the stated goal of reducing the risks of impersonation, deception, misinformation and manipulation at scale and fraud and mitigating the potential detrimental effects of AI generated or manipulated content and interactions. Organizations (and in some cases, individuals) using chatbots, generative AI, deepfake functionality, emotion recognition, biometric categorization, or AI-generated public-interest content should assess whether disclosures, labeling, or content-marking requirements apply without delay. The principal exception is a short implementation period for the Article 50(2) machine-readable marking requirement. Under the EU’s Digital Omnibus reforms, providers of certain generative AI systems already placed on the EU market before August 2, 2026 have until December 2, 2026 to implement those marking measures, while the remaining Article 50 transparency obligations continue to take effect on August 2, 2026. Noncompliance carries fines of up to €15 million or 3% of total worldwide turnover.
Last week, just days before the rules take effect, the European Commission published its long-awaited Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of the EU AI Act (“Guidelines”) for organizations developing or deploying AI systems in the EU. We cover some of the highlights of this 50 page document.
Although not legally binding, the Guidelines complement the Commission’s recently published Code of Practice on Transparency of AI-Generated Content, and are likely to play a significant role in how the European AI Office and national market surveillance authorities interpret and enforce the transparency obligations. The Commission also just published yesterday a list of more than 180 major and minor players who have signed the Code. Although this can feel a bit like a scramble, organizations would do well to not be left behind.
Article 50 applies broadly to chatbots, generative AI tools, deepfake technologies, emotion recognition systems, and certain AI-generated content (most notably deepfakes and AI-generated text on matters of public interest). It also reaches beyond Europe, capturing providers and deployers established outside the EU wherever the output of their AI system is used in the Union. It does not, however, cover everything: ordinary spelling and grammar correction, certain machine-to-machine outputs that are never presented to a person, and some “purely personal” activities like (somewhat bizarrely) deepfakes of members of your household and deepfakes distributed in a personal capacity on social media are excluded.
Providers and Deployers Have Different Responsibilities Under Article 50
The Guidelines provide detailed clarification regarding the scope and application of the four separate transparency obligations, which apply depending on whether an organization is a provider (develops the system and places it on the EU market) or a deployer (uses the system in a professional capacity).
- Providers of AI systems that interact with individuals directly must design them to disclose that users are interacting with AI.
- Providers of AI systems generating synthetic content (text, images, audio, or video) must ensure that AI-generated content can be identified through machine-readable marking and detection mechanisms (the AI Omnibus which entered into force this week gives a short extension until 2 December for providers who have already placed their systems on the market).
- Deployers of emotion recognition and biometric categorization systems must inform affected individuals of the system’s operation, whether the system runs in real time or is applied after the fact.
- Deployers of realistic synthetic content (the rule explicitly refers to deep fakes) and certain AI-generated public-interest content must disclose that the content has been artificially generated or manipulated.
The second and fourth obligations are easily conflated but are not the same. The second requires providers to build technical marking and detection capabilities into AI-generated content. The fourth requires deployers to disclose certain AI-generated or AI-manipulated content to the audience viewing it. The obligations serve independent purposes. For example, the provider of an app to generate deep fakes on social media must mark those deep fakes in a machine readable manner, but a user generating deep fakes of their household members (oddly) does not need to disclose these as deep fakes.
Chatbots and AI Assistants: Disclosure Must Be Clear and Timely
One of the most significant takeaways is that providers of AI systems directly interacting with natural persons including chatbots, virtual assistants, companions or pets, and increasingly autonomous agentic AI systems, must ensure that users are informed they are interacting with AI no later than the first interaction in a manner that is clear, accessible, and understandable to the intended audience (unless it would be obvious to a reasonably well-informed, observant and circumspect person). This we can expect to be a very limited exception given it is getting increasingly harder to distinguish the robots from humans. The authors consider themselves reasonably well informed and yet have often wondered whether the customer service “agent” on the other end was human or not (and in fact the Guidelines explicitly specify that helpdesk agents are generally not going to be obvious enough for the exception).
Disclosures may be delivered through text, audio, visual cues, or other appropriate modalities depending on the context, and provided in a manner that users can readily perceive at the point of interaction, not buried in terms of service or privacy notices.
Systems that operate only in the background, or that communicate only machine-to-machine, fall outside the obligation entirely.
The takeaway is that disclosures should be built into the user experience. That may mean an “introduction” at the start of a chat session or a visible labeling, plus an accessible alternative for users relying on assistive technologies and it must take into account whether the user may belong to a vulnerable group (e.g., children or the elderly, who may have a harder time understanding). Periodic reminders may also be necessary in some cases (e.g., where there may be heightened risk of emotional attachments, like with AI companions). This could be explicitly stated as “You are interacting with an AI system” though this is not required and there could be room for creativity – for instance we think “Clippy the paperclip” did this well and any number of customer support agents, companions, avatars, etc. could take a page from its playbook. “KITT” the car, did this less well. At least no one we know ever made plans to marry the paperclip.
AI-Generated Content Marking Obligations
Providers of AI systems that generate or manipulate synthetic images, audio, video, or text must implement technical measures enabling AI-generated content to be detected as artificially generated or manipulated through machine-readable methods. These measures are intended to support downstream detection, authenticity verification, and trust in digital content ecosystems.
Outside the marking obligation are short sequences of numbers, symbols, or letters; source code; outputs communicated exclusively machine-to-machine and processed automatically without human exposure; and outputs used only in closed-loop industrial or product development environments, unless they are the final output. A narrow exemption also applies to outputs used in business-to-business or industrial contexts (e.g., engineering designs intended only for the eyes of identified engineers and with safeguards against external sharing).
The carve-out that matters most for everyday corporate use is assistive standard editing. Where the system performs standard editing that does not alter the informational substance of the content, such as spelling and grammar correction, no marking is required. That answers the question many companies are asking: an employee who runs an email through an AI assistant to clean up the grammar has not triggered Article 50(2).
Employees acting under their employer’s instructions and control are not separate deployers, so the obligation sits with the company. And a company remains the deployer where contractors or freelancers operate the system on its behalf. The analysis becomes more complicated where AI is generating substantive content rather than simply correcting grammar, formatting, spelling, or similar editorial issues.
The Guidelines reiterate that these obligations apply broadly, including to systems built on general-purpose AI models. The Commission’s transparency Code of Practice provides more detailed recommendations regarding watermarking, metadata, labeling, and detection mechanisms. As these technologies become more common, organizations may also see increased reliance on metadata, watermarking, and content provenance records when assessing whether content was generated or manipulated using AI.
For developers, compliance requires close coordination among legal, product, engineering, and trust-and-safety teams from inception.
Deepfakes Remain a Major Enforcement Priority
The Guidelines devote substantial attention to the AI Act’s deepfake transparency provisions.
The Commission makes clear that intent to deceive is not required. Disclosure obligations may apply where AI-generated or AI-manipulated content would falsely appear authentic or truthful to viewers in the relevant context, even if the creator never intended to mislead.
Deployers using AI-generated or AI-manipulated audiovisual content need to assess whether disclosures are required and ensure any labeling is sufficiently visible and understandable throughout the lifecycle of the content.
The Commission’s position reflects broader concerns regarding misinformation, impersonation, electoral manipulation, fraud, and erosion of trust in digital content.
Human Review Is Not Always Enough
Another noteworthy aspect of the Guidelines concerns the exception for AI-generated text published to inform the public on matters of public interest.
The exemption for content subject to human editorial review should be interpreted narrowly. Merely conducting a cursory review of AI-generated text may not suffice. Instead, organizations should be prepared to demonstrate meaningful editorial oversight and assume responsibility for the final published content.
Media organizations, publishers, communications teams, and public-facing enterprises that use generative AI in content creation workflows should carefully evaluate whether their governance processes satisfy this standard.
Open-Source and Personal Use Exceptions Are Limited
The Guidelines also clarify that open-source status does not automatically exempt organizations from transparency requirements.
Similarly, the Guidelines interpret the personal-use exception narrowly – use connected to a business, profession, freelance work, or other commercial endeavor will disqualify. As a result, influencers, content creators, agencies, and businesses distributing AI-generated content should assess where and when they may trigger these obligations.
Practical Compliance Steps
Organizations should prioritize:
- Conducting an inventory of AI systems that may fall within Article 50 and provider/deployer status.
- Evaluating chatbot, virtual assistant, and agentic AI deployments for appropriate user-facing disclosures at point of first interaction.
- Assessing synthetic content generation and AI-marking capabilities, including whether marking survives export, compression, and format conversion.
- Reviewing deepfake creation and content-modification workflows, including marketing, training, and product-demo content.
- Updating governance frameworks for AI-generated public communications, including related policies.
- Establishing documentation demonstrating implementation of transparency measures.
- Monitoring additional guidance from the European AI Office and national regulators.
Looking Ahead
Yesterday’s press release is a strong signal that despite some stalls and hesitations, the Commission’s AI Office and the national authorities will be focused on enforcement in this arena, in line with the European institutions’ historical emphasis on ensuring transparency and informing consumer/user choices. The Guidelines provide just-in-time clarity as the first major transparency obligations under the AI Act come into force. Although many organizations have focused on the AI Act’s high-risk AI requirements, the transparency provisions apply much more broadly because they cover everyday uses of chatbots, generative AI tools, synthetic media, and AI-generated content.
Article 50 compliance is a design problem as much as a governance one. Nearly every obligation resolves into an interface decision: the first line of a chat, a badge that persists through a long session, a label on a video that survives a re-upload, a byline on a page. Those decisions get made in product review and wireframe sessions, not in a compliance memo. Organizations that address disclosure design early in product development are likely to be in a stronger position than those that approach Article 50 as a compliance checklist after deployment.
Seyfarth’s Global Privacy & Security Team continues to monitor developments regarding the EU AI Act and related AI governance requirements.
Recent Comments