EU AI Act transparency rules: what companies must disclose about AI

The big picture

Think of the label on a food packet: it tells you what is inside before you decide to trust it. Article 50 of the AI Act does the same for AI. People must be told when they are talking to an AI, or seeing a picture, video, voice or text that an AI made.

The rule splits the work between two roles. The provider builds the AI tool, or sells it under its own name, and builds the notices and marks into it. The deployer is the business that uses the tool and labels what it publishes. One company can be both.

Which duty applies: technical view

The four duties, explained

Duty 1: chatbots and AI agents say they are AI

• Who is covered: systems built for a real two-way exchange directly with people. The guidelines name chatbots, voice assistants, AI avatars, AI companions, social media bots, coding agents and AI agents that book, buy or negotiate.
• Not covered: spam filters, recommender systems, translation and transcription tools, search that does not generate content, code auto-completion, and systems that only talk to other machines.
• AI agents: must disclose both that they are AI and on whose behalf they act. If the provider cannot tell in advance whether an agent will meet a person, it should disclose itself wherever that is reasonably likely.
• How: a first-message line such as "You are interacting with an AI system", a spoken statement at the start of a call, or a persistent AI badge near the input field.
• Not enough on its own: a line in the terms and conditions, a hidden watermark, a vague name like "assistant", or a site-wide note such as "Services on this website use AI".
• When once is not enough: for children, the elderly, financial, legal, health or insurance advice, and AI companions, periodic reminders are likely needed. The system must also answer honestly whenever someone asks if it is an AI.
• The "obvious" exception is narrow: for example, a code assistant only for professional developers, or an internal helpdesk for trained staff. A public chatbot that people may take for a human does not qualify.

Duty 2: AI content carries a hidden mark

• What a mark is: information hidden in the content, such as a watermark, metadata, a cryptographic signature or a fingerprint, that software can read without a person's help.
• Detection too: the provider must make a way to check the mark available, with a result a person can read: AI-made or not. Marking without detection does not comply.
• The quality bar: the solution must be effective, interoperable (it works across different tools), robust (it survives common edits and attacks) and reliable, as far as technically feasible. Cost and the state of the art are taken into account.
• Covered: AI summaries, rewrites that change the meaning, face swaps, voice clones, and adding or removing people or objects in pictures and videos.
• Not covered: source code, short outputs such as single words, captions and labels, machine-to-machine output, drafts inside a production workflow, and standard editing such as spell-checking, cropping or translation.
• Narrow business exemption: strictly technical output, such as engineering designs, seen only by a few named staff at the provider and deployer and never shared outside.
• Deadline: tools placed on the market before 2 August 2026 have until 2 December 2026; tools placed on the market from 2 August 2026 must comply at once.

Duty 3: tell people when AI reads faces or emotions

• What it covers: AI that infers emotions or intentions from biometric data such as a face or voice, or sorts people into groups, such as age or gender, from that data.
• How: the guidelines give two examples: a pop-up before a game starts saying the player's face is recorded to capture emotions, and a visible notice at each entrance to a room where faces are captured to assign age groups.
• Not a permission slip: telling people does not make the use lawful. Emotion recognition at work or in schools is banned under the AI Act, and data protection law still applies.

Duty 4: visible labels on deepfakes and public-interest text

• What a deepfake is: AI image, audio or video that resembles real people, objects, places or events and would falsely appear authentic. No intent to deceive is needed.
• Creative works: an evidently artistic, satirical or fictional work still needs a label, in a form that does not spoil the work. Adverts and documentaries often do not qualify.
• Public-interest text: AI text published to inform the public on politics, public services, justice, health, safety, the environment, finance and similar matters, such as an AI-drafted investor report on a listed company's website.
• The review exception: no label is needed if a qualified person checked the substance, including the facts, and a named person or company holds editorial responsibility. A spell-check does not count, and AI edits after sign-off cancel the exception.
• The label must be visible or audible: the provider's hidden mark does not meet this duty.

Deepfake or not: eight examples from the guidelines

What the label looks like: the EU's samples

The EU has published free label icons for this. Each shows the letters "AI", with a word saying how AI was used. Companies may use their own label instead, as long as it is just as clear.

Before you start: is this your duty?

Timelines to finish

Before you begin

Part 1: Find what is in scope

1. List every AI system you build, sell or use, and whether people in the EU use it or see its output (the compliance lead) Include chatbots, AI agents, voice assistants, image, video, audio and text generators, and any face or emotion AI. Note whether you built it or sell it under your own name (provider) or only use it (deployer). Expect: one line per system with its role. One company can be both.
2. Mark which duty each system triggers (the compliance lead, with the product owner) Use the technical view in section 2: direct interaction with people (Duty 1), generated content (Duty 2), face or emotion AI (Duty 3), a deepfake or public-interest text (Duty 4). Expect: each system mapped to the duties that apply, or to none.
3. Check any exception before relying on it, and write down why it applies (legal) The narrow ones: AI that is obvious to its audience, standard editing, strictly technical internal output, and human-reviewed text with a named responsible editor. Expect: a written reason for every exception used.

Part 2: Put the notices and labels in place

1. Add an AI notice at the start of every chat, call or agent interaction (the product team) A first-message line or banner such as "You are interacting with an AI system", a spoken statement at the start of a call, and an honest answer whenever someone asks if it is an AI. Add reminders where children, the elderly or financial, legal or health advice are involved. Expect: a person sees or hears the notice at or before the first reply.
2. Mark AI-generated content and provide a way to check it (the engineering lead) Embed machine-readable marks, such as a watermark or metadata, in every image, video, audio and text output, and make a detection tool available. A model maker's or third party's solution may be used, but the provider stays responsible. Expect: a detection check on sample outputs reports them as AI-generated.
3. Label every deepfake and unreviewed public-interest text (marketing and communications) Use a visible or audible label at first exposure, such as the EU's `AI GENERATED` or `AI MODIFIED` icon. Section 2 shows where each kind of label goes. Expect: every deepfake and unreviewed public-interest text carries a label a viewer notices.
4. Set up human review for any public-interest text you do not want to label (the head of communications) A qualified person checks the substance and facts, and a named person or the company holds editorial responsibility, with contact details easy to find. Review again if AI changes the text after sign-off.
5. Tell people before emotion recognition or biometric categorisation runs on them (the operations lead) For example, an onboarding message before the system starts, or a visible notice at each entrance.
6. Decide whether to sign the code of practice (the compliance lead) Signing gives a recognised way to show compliance with the marking and labelling duties; about 190 organisations had signed by the end of July 2026. Without it, document your own measures and a gap analysis against the code. Expect: a decision on record, with the reasoning.

What it costs

Business impact of not completing

What completing it gets the business

What these sources can't tell you

What this paper does not do

• It is not the guidelines: read them in full before changing a product.
• It does not cover the AI Act's rules for high-risk AI, banned practices or general-purpose AI models.
• It does not say how any EU country will enforce in practice.