When does EU AI Act Article 50 enter into force?

Article 50 transparency obligations of Regulation (EU) 2024/1689 (the EU AI Act) apply from 2 August 2026. The Omnibus political agreement reached on 7 May 2026 extended several high-risk AI system deadlines but did not change Article 50 — the transparency obligations remain on the original 2 August 2026 schedule. A grandfathering rule introduced by the same agreement gives generative AI systems placed on the EU market before 2 August 2026 until 2 December 2026 to comply with the machine-readable watermarking requirement of Article 50(2). Article 50(1) direct-interaction disclosure, Article 50(3) emotion-recognition disclosure, and Article 50(4) deepfake disclosure all apply on 2 August 2026 without a grandfathering buffer.

What does Article 50 actually require?

Article 50 has six paragraphs. Paragraph 1 requires providers of AI systems intended to interact with natural persons to ensure those persons are informed they are interacting with an AI system, unless obvious. Paragraph 2 requires providers of generative AI systems to mark synthetic audio, image, video, and text outputs in a machine-readable format detectable as artificially generated or manipulated, with solutions that are effective, interoperable, robust, and reliable. Paragraph 3 requires deployers of emotion-recognition or biometric-categorisation systems to inform exposed persons. Paragraph 4 requires deployers to disclose AI-generated or manipulated image, audio, or video content constituting a deepfake, and to disclose AI-generated text published to inform the public on matters of public interest. Paragraph 5 requires disclosure to be clear, distinguishable, and provided at the latest at first interaction. Paragraph 6 confirms the AI Office facilitates codes of practice.

What is the fine for non-compliance with Article 50?

Under Article 99(4)(g) of the EU AI Act, non-compliance with the transparency obligations of Article 50 is subject to administrative fines of up to EUR 15 million or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher. Member-state competent authorities determine fines on a case-by-case basis. The European Commission and the AI Office published guidance and an evolving Code of Practice through the AI Office stakeholder process; companies that sign the final Code of Practice and implement its measures are presumed compliant with Article 50 obligations covered by the Code.

Does ProofSnap make my organisation compliant with Article 50?

No. ProofSnap is not a compliance management platform and does not enforce Article 50 on your behalf. ProofSnap is a forensic web capture tool that records the C2PA Content Credentials, Google SynthID pointers, and EXIF software signatures present on the AI-generated images on any web page you capture, into a court-ready forensic ZIP. That ZIP is audit evidence — it demonstrates which provenance signals were attached to a given piece of generative AI content at the moment your compliance officer reviewed it, with chain of custody, SHA-256 hash, RSA-4096 signature, Bitcoin OpenTimestamps anchor, and (on Enterprise and Company plans) eIDAS qualified RFC 3161 timestamp. Your organisation remains the compliant party — ProofSnap is the recorder of the audit.

Was Article 50 postponed by the AI Act Omnibus deal?

No. The Omnibus political agreement reached on 7 May 2026 explicitly preserved Article 50 transparency obligations on the original 2 August 2026 schedule. The Omnibus did extend several deadlines: high-risk AI systems (stand-alone) were extended to 2 December 2027, high-risk AI safety components in regulated products were extended to 2 August 2028, and the new prohibition on intimate-content deepfakes applies from 2 December 2026. The only Article 50-adjacent change is a grandfathering rule giving generative AI systems already on the market before 2 August 2026 until 2 December 2026 to retrofit machine-readable watermarking under Article 50(2). The Omnibus agreement remains provisional pending Council and European Parliament endorsement, legal-linguistic revision, and publication in the Official Journal.

What is the Code of Practice for marking and labelling AI-generated content?

The Code of Practice for marking and labelling AI-generated content is a voluntary instrument facilitated by the European AI Office under Article 50(6) of the EU AI Act. It translates the Article 50(2) provider marking obligations and the Article 50(4) deployer deepfake disclosure obligations into concrete technical and procedural measures. Two working groups (Working Group 1 — providers; Working Group 2 — deployers) drafted the Code between November 2025 and June 2026 with eligible stakeholders and international observers. A second draft was published on 5 March 2026. The final version is expected in May–June 2026, ahead of the 2 August 2026 enforcement date. Companies that sign the final Code and implement its measures are presumed compliant with the Article 50 obligations covered by the Code.

Is ProofSnap GDPR-clean?

Yes — the AI content detection layers (C2PA parser, EXIF reader, URL context matcher) run locally inside the Chrome or Edge tab. No image binary, thumbnail, or hash is transmitted to ProofSnap servers, to Hive, to Sightengine, to Copyleaks, or to any other third-party AI detector. The SynthID Detector pointer is a textual portal URL (synthid.google.com) recorded as a manual verification option — no automatic upload. This design choice eliminates the need for a third-party processor agreement for the AI content detection function and aligns with EU GDPR data minimisation principles. Standard ProofSnap capture data is processed on AWS infrastructure per the Privacy Policy.

Which Article 50 obligations does ProofSnap support evidence for?

ProofSnap is positioned on the audit-evidence side of Article 50(2) and Article 50(4). For Article 50(2) — provider marking of synthetic content — ProofSnap captures the machine-readable signals (C2PA Content Credentials, EXIF software signature, IPTC DigitalSourceType code) that the provider attached to the AI output, into a chain-of-custody-preserved evidence ZIP. For Article 50(4) — deployer disclosure of deepfakes — ProofSnap evidences both the detection step (which signals were present at capture) and the disclosure step (when the deployer's disclosure was published, captured against a forensic timestamp). ProofSnap does not perform Article 50(1) AI interaction disclosures, does not generate Article 50(3) emotion-recognition notices, and does not replace the AI Office stakeholder processes.

What about the relationship to DSA, GDPR, and the e-Evidence Regulation?

Article 50 of the AI Act operates alongside, not instead of, other EU frameworks. The Digital Services Act (DSA) imposes separate transparency and risk-mitigation obligations on Very Large Online Platforms and Very Large Online Search Engines regarding AI-generated content moderation. The General Data Protection Regulation (GDPR) governs personal-data processing for any AI system processing personal data — the AI Act preserves GDPR fully. The e-Evidence Regulation (EU) 2023/1543, applicable from 18 August 2026, governs cross-border production and preservation orders for electronic evidence held by service providers; ProofSnap evidence ZIPs are typically self-generated by the controller and not subject to e-Evidence production orders. None of these frameworks is replaced by Article 50 — compliance officers should map all applicable regimes.

How many days until the EU AI Act Article 50 deadline?

EU AI Act Article 50 transparency obligations apply from 2 August 2026. A second deadline follows on 2 December 2026: generative AI systems on the EU market before 2 August 2026 must by then comply with Article 50(2) machine-readable marking under the Omnibus grandfathering rule agreed on 7 May 2026. As of 23 May 2026, the 2 August 2026 deadline is approximately 71 days away and the 2 December 2026 grandfathering closure is approximately 193 days away.

What is the difference between a provider and a deployer under the AI Act?

Provider (Article 3(3) of Regulation (EU) 2024/1689) is a natural or legal person, public authority, agency, or other body that develops an AI system or general-purpose AI model and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. Providers carry the Article 50(1) AI interaction disclosure and Article 50(2) machine-readable marking of synthetic content. Deployer (Article 3(4)) is a natural or legal person, public authority, agency, or other body using an AI system under its authority, except where the AI system is used in the course of a personal non-professional activity. Deployers carry the Article 50(3) emotion or biometric categorisation notice and the Article 50(4) deepfake and public-interest text disclosure. An undertaking can be both provider and deployer simultaneously.

Are online platforms like YouTube, X, or Facebook deployers under Article 50(4)?

Generally no. Per the European Commission's Draft Article 50 Guidelines published on 8 May 2026, actors whose role is limited to disseminating or transmitting AI-generated content created by third parties — including most online platforms — are not deployers within the meaning of the AI Act, so Article 50(4) deepfake disclosure does not apply to them as platforms. Platforms remain subject to separate Digital Services Act obligations regarding AI-generated content moderation, recommender systems, and risk mitigation, especially Very Large Online Platforms and Very Large Online Search Engines. When a platform itself generates AI content (its own deepfake-style summarisation tool, AI avatar feature, AI auto-reply) and publishes it, that platform is a deployer in respect of that specific output.

What are the Commission Draft Article 50 Guidelines published 8 May 2026?

The European Commission's AI Office published Draft Guidelines on the implementation of the transparency obligations under Article 50 of the AI Act on 8 May 2026 — a 40-page document open for stakeholder consultation until 3 June 2026. The Guidelines are not directly binding on providers or deployers, but they bind competent authorities to apply Article 50 in a consistent, effective, and uniform manner and will be a primary reference for enforcement priorities, audit scope, and fine calibration under Article 99(7). The Guidelines clarify load-bearing concepts: the average consumer standard for the obvious-AI exemption (Article 50(1)), multi-layered marking expectations (Article 50(2)), narrow B2B and closed-industrial-system exemptions, the artistic-works carve-out, and the narrow human-review exception. Reading the Guidelines is the highest-leverage preparation step for the 2 August 2026 deadline.

Does Article 50 apply to AI chatbots and virtual assistants?

Yes. Article 50(1) requires providers of AI systems intended to interact with natural persons to ensure those persons are informed they are interacting with an AI — chatbots, voice assistants, customer-service AI agents, and AI tutoring agents are all in scope. The disclosure must be provided at the latest at the time of first interaction (Article 50(5)), must be clear and distinguishable, and must meet accessibility requirements. The Commission's 8 May 2026 Draft Guidelines clarify the obvious exemption using an average consumer standard: typically exempt are professional developer tools such as coding assistants and in-game video-game NPCs; typically not exempt are companion AI bots, embedded helpdesk assistants, and AI features integrated into otherwise human channels. If the system also generates content (synthesised voice, AI image responses), Article 50(2) machine-readable marking applies on top of Article 50(1) disclosure.

What happens if a competent authority requests Article 50 audit evidence from us?

National competent authorities (member-state Data Protection Authorities and AI-Act-designated authorities) can exercise oversight powers under Article 99 of Regulation (EU) 2024/1689 and request documented evidence of your Article 50 audit programme — typically with a fixed production deadline of 14 to 30 calendar days, by analogy to GDPR Article 58(1)(a) and (e) production windows. What you need to produce: capture-time evidence of which Article 50(2) machine-readable signals were present on the AI outputs you published or processed, with chain of custody, timestamps, and an independently verifiable hash manifest. Reactive reconstruction is hard because provenance signals such as C2PA and EXIF can degrade after re-upload, so the audit moment matters. Article 99(7) consequence: your response time and the quality of the evidence directly enter fine calibration. Factors (d) degree of cooperation and (e) actions taken to mitigate damage are explicit considerations. GDPR Article 83(2) enforcement patterns show 30 to 70 percent fine reductions for documented good-faith cooperation in published precedents including Meta, Amazon, and Clearview AI.

Does the EU AI Act apply to non-EU companies (US, UK, Switzerland, Israel)?

Yes, when there is EU exposure. Per Article 2(1) of Regulation (EU) 2024/1689, the AI Act has extraterritorial reach. Non-EU providers and deployers fall in scope when: a non-EU provider places the AI system on the EU market or puts it into service in the EU; or the output produced by the AI system is used in the EU, regardless of where the provider or deployer is established (Article 2(1)(c) — the 'output in the Union' trigger). A US SaaS with a single EU customer importing AI output into its EU operations can trigger Article 50. The test is the destination of the output, not the registered office. Map your EU exposure (customers, subsidiaries, end-users, EU-targeted publication) against Article 2 before assuming you are out of scope.

How do I know if my company is a deployer under Article 50?

You are a deployer per Article 3(4) of Regulation (EU) 2024/1689 if you use a generative AI system under your organisation's authority and publish AI-generated content to an audience — AI imagery in marketing, AI-translated articles in a newsroom, AI voiceovers in communications, AI summaries published by a public body, AI avatars in content production. Personal non-professional use is excluded. You are not a deployer if you are only disseminating third-party AI content (most online platforms per the Commission Draft Guidelines published 8 May 2026); those obligations sit with the upstream deployer or provider. Deployers carry Article 50(3) emotion / biometric categorisation notice and Article 50(4) deepfake and public-interest text disclosure.

Do I need to label every AI-edited image, or only deepfakes?

There are two separate obligations. Article 50(2) provider marking applies to every synthetic output of generative AI — machine-readable marking in the output itself. The Commission Draft Guidelines clarify standard editing exemptions: grammar or spelling correction, noise reduction, and colour adjustments typically do not trigger marking. AI translation, AI summarisation, AI object removal, and AI face alterations do trigger marking. Article 50(4) deployer deepfake disclosure applies only to image, audio, or video content constituting a deepfake when published by a deployer — visible disclosure, at first exposure, clear and distinguishable. Two tests, two obligations: the provider always marks (the file); the deployer separately discloses (the publication).

Art. 50 enforcement — 2 Aug 2026

For AI compliance officers · AI governance leads · DPOs · legal counsel

EU AI Act Article 50 compliance checklist. Audit-evidence capture before 2 August 2026.

Transparency obligations · deepfake disclosure · machine-readable marking · €15M / 3% fine tier · Commission Draft Guidelines 8 May 2026

When the DPA email lands, you have ~14 days to produce audit-ready evidence. On 2 August 2026, Article 50 of Regulation (EU) 2024/1689 enters into force. Providers must mark synthetic outputs in machine-readable form; deployers must disclose deepfakes. The Omnibus political agreement of 7 May 2026 did not postpone Article 50. ProofSnap captures C2PA Content Credentials, Google SynthID pointers, and EXIF software signatures into a court-ready forensic ZIP — the audit-evidence layer for compliance officers, pre-built in 41 seconds per capture, producible from archive within hours instead of weeks. From $4.99 SnapPack to $28.99/month Enterprise. See the Day 1 scenario →

Article 50 enforcement

—

days to 2 Aug 2026

Providers + deployers transparency obligations apply

Grandfathering closes

—

days to 2 Dec 2026

GenAI on market pre-Aug must retrofit watermarking

Start 7-day trial — install Chrome extension

First audit capture in 41 seconds. Cancel any time during the trial at zero cost.

Sample audit ZIP

See the AI Detection PDF section

eIDAS SnapPack — $49.99

10 captures · qualified RFC 3161

Chrome Web Store verified Microsoft Edge Runs locally · no image upload GDPR / DSA clean

ProofSnap Chrome extension capturing a web page with C2PA, SynthID, and EXIF AI-generation signals embedded into a forensic ZIP for EU AI Act Article 50 compliance audit

What's at stake

Day 1 after 2 August 2026: when the DPA email arrives.

A composite scenario, not a real case — the first Article 50 enforcement actions are still ahead. The procedural mechanics are real; the question is whether your audit trail is ready before, or assembled after, the request lands.

Composite scenario · illustrative, not a real enforcement case

5 August 2026, 09:14 CET. A national Data Protection Authority email arrives in your compliance inbox:

"Pursuant to Article 50 of Regulation (EU) 2024/1689 and our supervisory powers, please produce within 14 calendar days documented evidence of the AI content audit performed on outputs generated by [your AI system] and published on [your platform] between 2 August 2026 and the date of this notice. Evidence must include chain of custody, capture timestamps, and a record of the machine-readable provenance signals present at audit time."

The deadline is firm. The competent authority is exercising Article 99 oversight powers. Your response time and evidence quality directly enter the Article 99(7) fine calibration. The question is no longer whether to build the audit layer — it is whether yours is verifiable, timestamped, and producible within the 14-day window.

Without a pre-built audit layer

Reactive assembly — days 1–14

Manual page captures (PDF print, screenshot tool, browser save) — 2–4 hours per sample
Chain-of-custody memo drafted by counsel — 3–6 hours per sample
Re-fetch of provenance signals (C2PA / SynthID / EXIF) on potentially altered live pages — signal degradation risk (re-uploads strip metadata)
External counsel review and timestamping coordination — 1–2 weeks lead time at peak demand
Risk: late or incomplete production triggers Article 99(7)(d) "degree of cooperation" factor against the undertaking

Typical reactive cost band: EUR 8,000–40,000 in external legal + investigator hours for a 10–20 sample production, ignoring the cooperation-factor fine impact.

With ProofSnap pre-built audit layer

Producible from archive — same day

Each capture already a court-ready ZIP with SHA-256 + RSA-4096 + Bitcoin OpenTimestamps + optional eIDAS qualified RFC 3161 timestamp
~41 seconds per capture at audit time (not 2–4 hours)
ISO/IEC 27037 chain of custody baked into every ZIP — no separate memo
Provenance signals captured at audit moment (frozen, not re-fetched)
Offline-verifiable by DPA / counsel / court without ProofSnap dependency
Demonstrable cooperation under Article 99(7)(d) — documented good-faith audit programme

Pre-build cost: $49.99 eIDAS SnapPack 10 (one-off) or $18.99 / seat / month Company Plan. Time saved vs reactive: ~50× per sample.

Article 99(7) calibration — why pre-built audit evidence matters

Article 99(7) requires competent authorities to consider, when setting an actual fine, inter alia: (d) the degree of cooperation with the competent authority to remedy the infringement and mitigate possible adverse effects; (e) actions taken to mitigate damage; (f) any relevant previous infringements; (k) adherence to approved codes of conduct or approved certification mechanisms.

Producing a chain-of-custody-preserved audit ZIP within the production window evidences (d), (e), and (k) simultaneously. Reconstructing evidence under time pressure, with provenance signals that may have degraded since the original publication, signals the opposite. The Article 50 ceiling is EUR 15 million or 3 % of global annual turnover; the actual fine is calibrated downward by demonstrable cooperation — GDPR Article 83(2) enforcement patterns show fine reductions of 30–70 % for documented good-faith cooperation in published precedents (Meta, Amazon, Clearview AI). Article 99(7) factors are deliberately worded in parallel to Article 83(2).

The cheapest moment to build the audit layer is before the email arrives.

Build the Day-1 Readiness Pack → Read the compliance checklist first

Quick reference

EU AI Act Article 50 — the 90-second briefing

What is Article 50?: The transparency provision of Regulation (EU) 2024/1689 (the EU AI Act). Four obligations: AI interaction disclosure, machine-readable marking of synthetic AI content, emotion / biometric notice, deepfake disclosure.
When does it apply?: 2 August 2026 for all four obligations. Generative AI on the EU market before that date has until 2 December 2026 for the Article 50(2) machine-readable marking only (Omnibus grandfathering, 7 May 2026 agreement).
Who must comply?: Providers of generative AI carry Article 50(1)–(2); deployers carry Article 50(3)–(4). Platforms only disseminating third-party AI content are not deployers per the 8 May 2026 Commission Draft Guidelines.
What is the fine?: Up to EUR 15 million or 3 % of global annual turnover, whichever is higher (Article 99(4)(g)). EUR 750,000 ceiling for EU institutions, bodies, offices, agencies (Article 100). SMEs: lower of percentage and amount (Article 99(6)).
Where is the official guidance?: Commission Draft Article 50 Guidelines published 8 May 2026 (40 pages, AI Office consultation until 3 June 2026). Code of Practice on marking and labelling AI-generated content second draft 5 March 2026; final May–June 2026.
How does ProofSnap fit?: Reader-side audit-evidence tool. Captures the C2PA, Google SynthID, and EXIF signals attached to AI content into a court-ready forensic ZIP under ISO/IEC 27037 chain of custody, with optional eIDAS qualified RFC 3161 timestamp. Does not enforce compliance; records the audit.

Days to 2 Aug 2026: — Days to 2 Dec 2026: — Status: Article 50 unchanged by Omnibus (7 May 2026 agreement)

First-time visitor? Start here

Does Article 50 apply to my organisation?

Three scenarios in plain English. Pick the one that fits you, then jump to the relevant checklist. If none fits, you are probably out of scope — but read the non-EU callout below before concluding.

Provider

You're a provider if…

You develop or train a generative AI system (image / video / audio / text).
You place it on the EU market or put it into service under your own name or trademark.
Examples: AI image generator SaaS, voice-cloning startup, text-generation API, multimodal foundation model, fine-tuned model offered to EU customers.

Your obligations: Article 50(1) AI interaction disclosure + Article 50(2) machine-readable marking of synthetic outputs.

Provider checklist

Deployer

You're a deployer if…

You use a generative AI tool under your organisation's authority (not personal use).
You publish AI-generated images, audio, video, or public-interest text to an audience.
Examples: marketing team using AI imagery in ads, newsroom publishing AI-translated articles, communications team commissioning AI voiceovers, public body using AI to summarise consultations, content team using AI avatars.

Your obligations: Article 50(3) emotion / biometric notice + Article 50(4) deepfake and public-interest text disclosure.

Deployer checklist

Likely out of scope

Probably no Article 50 obligation if…

AI is used purely for personal non-professional activity.
AI is used solely for scientific R&D before any market placement.
AI is operated by law enforcement under specific authorisations with appropriate safeguards.
You are an online platform only disseminating third-party AI content (per Commission Draft Guidelines, 8 May 2026).
You apply only standard editing (grammar, spelling, noise reduction, colour adjustments) — no Article 50(2) marking required.

Caveat: other AI Act obligations may still apply (Article 5 prohibitions, high-risk AI system rules, DSA, GDPR). Consult counsel for borderline cases.

Established outside the EU? Article 50 may still apply.

The AI Act has extraterritorial reach per Article 2(1). US, UK, Swiss, Israeli, Indian, Australian, and other non-EU providers and deployers are in scope when:

A non-EU provider places the AI system on the EU market or puts it into service in the EU.
The output produced by the AI system is used in the EU, regardless of where the provider or deployer is established (Article 2(1)(c) — the "output in the Union" trigger).
EU end-users, EU subsidiaries, EU customers, or EU-targeted content all create exposure.

A US SaaS with a single EU customer importing AI output into its EU operations can trigger Article 50. Map your EU exposure against Article 2 before assuming you are out of scope — the test is the destination of the output, not your registered office.

Continue to the compliance checklist

Or read the full Article 50 obligations matrix.

By: ProofSnap Editorial · reviewed by digital-evidence practitioners · Last updated: 23 May 2026 · Reading time: ~8 min

What is EU AI Act Article 50, and what is ProofSnap's role in it?

EU AI Act Article 50 is the transparency provision of Regulation (EU) 2024/1689. It places parallel obligations on the generative AI value chain: providers must mark synthetic outputs in machine-readable form (Article 50(2)) and disclose AI interactions (Article 50(1)); deployers must disclose deepfakes and AI-generated public-interest text (Article 50(4)) and emotion / biometric categorisation (Article 50(3)). All four apply from 2 August 2026. Penalty tier under Article 99(4)(g): the higher of EUR 15 million or 3 % of global annual turnover (EUR 750,000 for EU bodies under Article 100).

ProofSnap sits on the reader side of Article 50 — a Chrome and Edge extension that captures any web page containing AI-generated content and records the C2PA Content Credentials, Google SynthID Detector pointers, and EXIF / XMP software signatures attached to every image, locally in the browser tab (no image upload to third parties), into a forensic ZIP with SHA-256 manifest, RSA-4096 signature, Bitcoin OpenTimestamps anchor, and optional eIDAS qualified RFC 3161 timestamp. It does not enforce compliance — your organisation remains the compliant party. It records the audit. See the AI Content Detection LP for the full three-layer detection architecture.

EU AI Act timeline — 2026 enforcement window

Four dates compliance officers actually need.

2 Aug 2026 — Article 50 applies

Article 50(1) AI interaction disclosure, Article 50(2) provider machine-readable marking of synthetic content, Article 50(3) deployer emotion / biometric notice, Article 50(4) deployer deepfake and public-interest text disclosure — all apply from 2 August 2026. Penalty tier under Article 99(4)(g): the higher of EUR 15 million or 3 % of global turnover.

2 Dec 2026 — watermarking grandfathering closes

Per the Omnibus political agreement of 7 May 2026, generative AI systems placed on the EU market before 2 August 2026 must comply with the Article 50(2) machine-readable watermarking requirement by 2 December 2026. The new prohibition on intimate-content deepfakes also applies from this date. Article 50(1), 50(3), 50(4) had no grandfathering buffer.

8 May 2026 — Commission Draft Guidelines

The European Commission's Draft Guidelines on the implementation of Article 50 (40 pages, AI Office) opened for stakeholder consultation on 8 May 2026 — consultation closes 3 June 2026. The Guidelines clarify the "average consumer" standard for the obvious-AI exemption, multi-layered marking expectations, standard editing carve-outs, and the narrow human-review exception.

May–June 2026 — Code of Practice final

The voluntary Code of Practice on marking and labelling of AI-generated content reaches its final version in May–June 2026 (second draft published 5 March 2026). Signatories implementing the measures are presumed compliant with the Article 50 obligations covered by the Code; non-signatories must demonstrate equivalent gap analyses to competent authorities.

2 Dec 2027 + 2 Aug 2028 — high-risk AI

Omnibus extended high-risk AI system deadlines: stand-alone HRAIS to 2 December 2027, safety components in regulated products to 2 August 2028. Compliance officers operating both Article 50 transparency programmes and HRAIS conformity assessments should map these on parallel tracks — Article 50 does not wait for the HRAIS deadlines.

Start 7-day trial

Article 50 obligations matrix

Six paragraphs. Two actors. Four substantive obligations.

A working summary of Article 50 of Regulation (EU) 2024/1689 — not legal advice. Always read the regulation, the Code of Practice, and any AI Office implementing guidance against the specific facts of your AI system or deployment.

Paragraph	Actor	Substantive obligation	Limited exemptions
50(1)	Provider	Inform natural persons that they are interacting with an AI system (e.g. chatbots), unless obvious to a reasonably informed observer.	Law enforcement use cases.
50(2)	Provider	Mark synthetic audio / image / video / text outputs in a machine-readable format, detectable as AI-generated or manipulated. Effective, interoperable, robust, reliable.	Assistive editing without substantial alteration; law enforcement.
50(3)	Deployer	Inform individuals exposed to emotion recognition or biometric categorisation systems, in compliance with GDPR.	Law enforcement with appropriate safeguards.
50(4)	Deployer	Disclose deepfakes (image / audio / video AI-generated or manipulated). Disclose AI-generated text published to inform the public on matters of public interest.	Artistic / creative / satirical / fictional works (minimal non-intrusive disclosure); editorial human review for text.
50(5)	Both	Information must be clear, distinguishable, accessible, and provided at the latest at first interaction or exposure.	—
50(6) / 50(7)	AI Office / Commission	Facilitate codes of practice (Article 50(6)); Commission may adopt implementing acts (Article 50(7)).	—

ProofSnap coverage

ProofSnap evidence is most directly relevant to Article 50(2) (capturing the machine-readable signals the provider attached) and Article 50(4) (evidencing the disclosure step and the underlying detection step in a deepfake or public-interest text deployer audit). ProofSnap is not a chatbot disclosure mechanism (50(1)) and does not produce emotion-recognition notices (50(3)). Article 50(5) accessibility is the deployer's design responsibility; ProofSnap captures the snapshot proving the disclosure was published.

EU AI Act Article 50 compliance checklist

A working step-by-step checklist for the 2 August 2026 deadline.

Split by actor — providers (upstream) and deployers (downstream). This is a working summary, not legal advice. Cross-check against the Commission's Draft Article 50 Guidelines (8 May 2026) and the final Code of Practice.

Provider

If you place generative AI on the EU market

1 Inventory every generative AI system against Article 50(1) (interaction) and 50(2) (synthetic content marking). Classify each system by modality (audio, image, video, text) and obligation.
2 Implement machine-readable marking for every synthetic output: C2PA Content Credentials, SynthID watermark, IPTC DigitalSourceType, or equivalent. Per the Commission Draft Guidelines, a multi-layered approach is the expected baseline — not a single watermark.
3 Verify robustness — markings must survive re-encoding, re-upload, and standard editing where technically feasible. ProofSnap-style audit captures of your own output can evidence which signals actually persist on the production endpoint.
4 Add AI interaction disclosure for any system intended to interact directly with natural persons (chatbots, virtual assistants, voice agents). The "obvious" exemption uses an average consumer standard — professional developer tools and video-game NPCs typically qualify; companion bots and embedded helpdesk assistants typically do not.
5 Decide on Code of Practice signing by the final release window (May–June 2026). Signing creates a presumption of compliance; not signing requires a documented gap analysis vs. the Code's technical and procedural measures.
6 Apply the grandfathering window — systems on the EU market before 2 August 2026 have until 2 December 2026 to retrofit Article 50(2) marking only (Omnibus, 7 May 2026). 50(1) interaction disclosure has no transition.
7 Document the audit trail — capture representative outputs with ISO/IEC 27037 chain of custody, archive into the internal AI use-case register, and retain for competent-authority review.

Deployer

If you use AI to generate content under your authority

1 Confirm "deployer" status. Per the Commission Draft Guidelines, actors limited to disseminating or transmitting third-party AI content (most online platforms) are not deployers under Article 50(4).
2 Map every deepfake publication channel. Article 50(4) deepfake disclosure applies regardless of intent to deceive — the test is potential audience composition. Track image, audio, video.
3 Map AI-generated text on matters of public interest. Disclosure required unless there is substantive editorial review by a qualified person (per the Draft Guidelines, spell-checking or cursory approval is insufficient).
4 Design first-exposure disclosure. Article 50(5) requires clear and distinguishable disclosure at the moment of first interaction or exposure for each exposed person — not a one-time notice buried in terms.
5 Apply the artistic exemption carefully. Artistic, creative, satirical, or fictional works get an attenuated disclosure obligation — visible but display-friendly. Excluded: content with primarily informative or commercial purpose.
6 Build the audit log. For each disclosed deepfake or public-interest text, capture the published page with ProofSnap (or equivalent forensic recorder), preserve C2PA / SynthID / EXIF signals plus the disclosure copy, archive under chain of custody — this is the evidence layer for a future competent-authority query.
7 Coordinate with adjacent regimes. Map overlaps with DSA, GDPR, eIDAS, and (from August 2026) the e-Evidence Regulation (EU) 2023/1543. Article 50 does not substitute any of these.

ProofSnap covers checklist items 7 (provider) and 6 (deployer) — the audit-evidence capture and chain-of-custody preservation steps. The 7-day trial gives compliance officers a working capture against their own AI content before the Code of Practice final and the 8 May Draft Guidelines consultation closes.

Start 7-day trial →

Article 99 — penalties

The fine tier behind Article 50.

Member-state competent authorities determine actual fines case-by-case, per Article 99(7) (nature, gravity, duration, prior conduct, cooperation, financial situation). The ceiling alone is not the calibration — documented internal audit programmes are.

Article 99(4)(g) — Article 50 breach

€15M

or 3 % global turnover

Higher of EUR 15 million or 3 % of total worldwide annual turnover for the preceding financial year. Applies to Article 50 transparency-obligation breaches by undertakings.

Article 100 — EU bodies

€750k

EU institutions / agencies

Separate Article 100 ceiling for EU institutions, bodies, offices, and agencies for Article 50 breaches. The European Data Protection Supervisor (EDPS) is the enforcing authority for EU-body breaches.

Article 99(3) — Article 5 prohibitions

€35M

or 7 % global turnover

Higher tier — reserved for breach of Article 5 prohibitions (social scoring, real-time biometric identification, untargeted facial-image scraping). Article 50 sits one tier below.

Article 99(5) — incorrect information

€7.5M

or 1 % global turnover

Supplying incorrect, incomplete, or misleading information to notified bodies or competent authorities. Lower tier — relevant when responding to an Article 50 enforcement query.

SME / start-up calibration — Article 99(6)

For SMEs including start-ups, the fine is the lower of the percentage and the absolute amount. The percentage-of-turnover ceiling is therefore particularly material for large undertakings; for SMEs the EUR ceiling is the binding constraint. An auditable internal AI content review programme remains the load-bearing mitigation factor at any size — documented evidence of good-faith Article 50 application is one of the factors competent authorities weigh under Article 99(7) when calibrating the actual fine (nature, gravity, duration, prior conduct, cooperation, financial situation).

The audit ZIP

11–15 forensic files per capture, AI signals embedded.

Essential 11 / Professional 12 / Enterprise / Company 15. AI Content Detection results live as a top-level ai_content_analysis section in metadata.json and a dedicated section of evidence.pdf — per-image SHA-256, C2PA generator field, EXIF software match, IPTC DigitalSourceType code, SynthID portal pointer when applicable. Negative result (no signal fired) is itself recorded as an evidential finding. ZIP is offline-verifiable with python3 + openssl + ots, or via the Trust Verifier.

Full file list and per-image schema on the AI Content Detection LP. Download a sample ZIP to inspect the structure.

Pricing for EU compliance teams

AI Content Detection on every tier.

No upsell, no add-on. The three deterministic AI detection layers run on Essential, Professional, Enterprise, and Company Plan alike — including the 7-day trial.

One-off · no subscription

SnapPack

$4.99

one-time · 10 captures

✓10 forensic captures
✓AI Content Detection included
✓Bitcoin OpenTimestamps anchor
✓Credit card at purchase, no recurring charge

Day-1 Readiness Pack · recommended

Upgrade to eIDAS SnapPack 10 — $49.99. Qualified RFC 3161 timestamp on every capture, statutory weight in 27 EU member states. Pre-build the audit layer before 2 Aug 2026 — reactive assembly under a 14-day production window costs 10–50× more in legal hours.

Buy SnapPack

Recommended — compliance teams

Compliance / governance / legal team

Company Plan

$18.99/seat/mo

min 2 seats · 7-day trial

✓Team capture & shared audit-evidence access
✓5 eIDAS qualified timestamps / user / month
✓Bitcoin OpenTimestamps unlimited
✓AI Content Detection included
✓Cancel any time during the trial at zero cost

Start 7-day trial

Solo · 10 eIDAS qualified timestamps / month

Enterprise

$28.99/mo

single seat · 7-day trial

✓10 eIDAS qualified timestamps / month
✓15-file forensic package on every capture
✓Capture video recording included
✓AI Content Detection included
✓Cancel any time during the trial at zero cost

Start 7-day trial

Credit card required for the 7-day trial · cancel any time during the trial at zero cost · no refunds on completed subscription periods · written support via support@getproofsnap.com

EU regulatory map — Article 50 in context

AI Act vs DSA vs GDPR vs eIDAS vs e-Evidence.

Article 50 operates alongside, not instead of, the EU's adjacent digital regimes. Compliance officers should map all applicable frameworks — ProofSnap evidence ZIPs touch several at once.

Framework	Scope	Article 50 overlap	Enforcing authority
EU AI Act — Regulation (EU) 2024/1689	AI systems placed on the EU market or whose output is used in the EU.	Article 50 itself. Transparency for synthetic content, deepfakes, AI interactions, emotion / biometric systems.	National competent authorities + AI Office (Commission). EDPS for EU bodies.
DSA — Regulation (EU) 2022/2065	Online intermediaries, hosting services, online platforms; VLOPs / VLOSEs since 25 Aug 2023.	Separate platform transparency + risk mitigation for AI-generated content moderation, recommender systems, dark patterns. Does not replace Article 50.	European Commission (VLOPs / VLOSEs) + Digital Services Coordinators (national).
GDPR — Regulation (EU) 2016/679	Processing of personal data of EU data subjects.	Preserved in full by the AI Act. Article 50(3) emotion / biometric categorisation must comply with GDPR. Automated decision-making rights (Art. 22) overlap.	National data protection authorities (national DPAs).
eIDAS — Regulation (EU) 910/2014 (rev. 2024)	Electronic identification, qualified trust services (signatures, seals, timestamps, e-delivery).	Indirectly relevant: qualified RFC 3161 timestamps give Article 50 audit evidence presumption of accuracy and integrity across 27 EU member states.	National supervisory bodies; EU Trust List.
e-Evidence — Regulation (EU) 2023/1543	Cross-border production / preservation orders for electronic evidence held by service providers. Applicable from 18 August 2026.	Adjacent: ProofSnap evidence ZIPs are self-generated by the controller, so generally outside e-Evidence production orders — but the framework matters when the underlying AI content is held by a service provider.	Competent member-state judicial authorities; designated establishments.
DMA — Regulation (EU) 2022/1925	Gatekeeper obligations on the largest core platform services.	Minimal direct overlap with Article 50; relevant when a gatekeeper-operated generative AI service is in scope of both regimes.	European Commission.

ProofSnap touchpoints

A single ProofSnap evidence ZIP can simultaneously: (i) record the Article 50(2) machine-readable signals on a captured AI output (AI Act), (ii) anchor the capture with a qualified RFC 3161 timestamp (eIDAS), (iii) preserve under ISO/IEC 27037 chain of custody such that the data minimisation principle (GDPR Article 5(1)(c)) is observable, and (iv) generate a deterministic offline-verifiable artefact independent of any platform (DSA / DMA neutral). One capture, multi-regime audit posture.

EU AI Act Article 50 — frequently asked questions

First audit capture in 41 seconds

Install the Chrome extension. Start your Article 50 audit trail before 2 Aug 2026.

7-day trial — cancel any time during the trial at zero cost. The moment your compliance team needs to evidence which AI-generation signals were present on a given piece of content — for an internal AI register, a deployer disclosure log, a vendor onboarding review, or a regulator response — the ZIP is ready, offline-verifiable, and independent of ProofSnap's future state.

Start 7-day trial — install Chrome extension Edge Add-ons version

Cancel any time during the trial at zero cost · download sample audit ZIP first · written support via support@getproofsnap.com

Disclaimer: This page provides general technical and product information about ProofSnap and a working summary of Article 50 of Regulation (EU) 2024/1689 (the EU AI Act). It is not legal advice. ProofSnap is not a law firm, not a compliance management platform, and not a substitute for member-state competent authority guidance, AI Office stakeholder process output, or counsel from a qualified EU AI Act practitioner. Article 50, the Code of Practice, and the AI Act Omnibus remain subject to ongoing legal-linguistic revision and AI Office implementing guidance — the references above reflect publicly available information as of May 2026. Verify against the Official Journal text and your member-state competent authority's published guidance before relying on any specific obligation in production compliance workflows. The Omnibus political agreement of 7 May 2026 is provisional pending Council and European Parliament endorsement. ProofSnap does not warrant compliance under Article 50, Article 99, eIDAS, GDPR, DSA, or any other framework; admissibility and weight of any ProofSnap evidence ZIP in a competent authority enforcement proceeding or court is determined on a case-by-case basis.

Related ProofSnap pages

External references