EU Unleashes AI Transparency Rules: Article 50 Now Active!

Article 50 of the EU AI Act has officially come into force, introducing critical transparency obligations for providers and deployers of Artificial Intelligence systems operating across the European bloc. This mandate specifically targets enterprises utilizing generative AI tools, requiring them to comply with regulations that ensure individuals are informed when interacting with an AI system and that AI-generated content is clearly marked as such. The urgency for such regulations stems from the increasing difficulty in distinguishing AI interactions from human conversations, and AI-generated images from authentic ones. Furthermore, individuals are often unknowingly exposed to emotion recognition and biometric categorisation tools, raising significant concerns for the European Commission regarding manipulation at scale, fraud, impersonation, and consumer deception. Article 50 serves as the EU's primary mechanism to address these challenges, aiming to ensure the responsible and safe deployment of AI.

For providers, Article 50 necessitates the design of AI systems such that users are explicitly aware they are interacting with a machine. Exceptions apply only in cases where the AI interaction is inherently obvious to a reasonably well-informed, observant, and circumspect individual, or for law enforcement systems used for detecting, preventing, investigating, or prosecuting criminal offences, provided third-party rights are safeguarded and the public cannot use the system to report a crime. A distinct duty under Article 50 applies to providers of systems generating synthetic audio, image, video, or text. These outputs must incorporate a machine-readable mark, enabling their detection as artificially-generated or manipulated. The Act emphasizes that this marking should be effective and interoperable, considering technical feasibility and implementation costs against the current state of AI technology. Simple assistive editing that does not substantially alter user input, like a routine photo touch-up, does not trigger this requirement, unlike a wholesale AI-generated replacement.

Deployers also bear significant responsibilities under Article 50. Anyone operating an emotion recognition or biometric categorisation system must inform individuals exposed to it. The personal data collected through such systems remains subject to existing data protection laws, including GDPR for general cases, EU institutions data protection regulations for EU bodies, and the Law Enforcement Directive for policing contexts. Deepfakes, defined as artificially-generated or manipulated image, audio, or video content, carry their own disclosure duty, requiring a clear statement indicating their nature. However, artistic, satirical, or fictional works have a lighter touch, only needing a disclosure that flags the content's existence without impeding the enjoyment of the work. Text published for public interest purposes, if AI-generated or manipulated, must also be disclosed unless it has been reviewed by a human and someone holds editorial responsibility, such as through a standard newsroom review process. Unedited AI output published directly into a public interest story does not meet this standard. All disclosures must be delivered no later than the first interaction or exposure, presented in a plain, distinguishable, and accessible manner, adhering to existing accessibility rules, with no grace period for delayed notification.

The enforcement of Article 50 is divided among three key bodies: national market surveillance authorities handling most cases, the AI Office overseeing systems under its direct supervision, and the European Data Protection Supervisor stepping in when an EU institution acts as a provider or deployer. Guidelines have been established to assist providers and deployers in demonstrating compliance with the marking obligation of Article 50. A favored compliance path involves signing on to the Code of Practice on Transparency of AI-generated Content. Organizations opting not to join the Code must demonstrate compliance through alternative means deemed adequate by the Commission, although the practical specifics of these alternatives are left to the discretion of market surveillance authorities. Other transparency duties, such as informing users of AI interaction and disclosing deepfakes or AI-generated public interest text, do not have an equivalent code of practice. For these, providers and deployers are expected to devise their own adequate measures, using the guidelines as a reference point rather than a rigid checklist. Much of the guidance document is dedicated to defining key terms, including what constitutes a directly interactive AI system, synthetic content, and the distinction between a deepfake and ordinary edited media. Standard editing and assistive functions that leave user input intact are explicitly excluded from the scope. The guidance also clarifies the roles of providers and deployers within the value chain, and how the four Article 50 obligations apply depending on these distinctions, especially when both roles are held by a single organization. These guidelines offer a Commission-endorsed reference point, empowering organizations to make informed decisions regarding the Code of Practice versus developing their own labelling approaches, going beyond the bare text of the regulation itself.