Regulation (EU) 2024/1689 · Article 50

The Article 50 transparency obligations apply on 2 August 2026.

The Digital Omnibus deferred the “high-risk” obligations. It did not defer Article 50.

What has been deferred — and what has not

What has been deferred — and what has not
DeferredNot deferred
  • “High-risk” obligations — Annex III

2 December 2027

  • Art. 50(1) — informing the user
  • Art. 50(2) — machine-readable marking
  • Art. 50(4) — labelling of deepfakes

2 August 2026

Regulation (EU) 2026/1744, Art. 1, point 39(b), inserting Article 111(4) into Regulation (EU) 2024/1689: providers of AI systems generating synthetic content (audio, image, video or text) placed on the market before 2 August 2026 must take the necessary measures to comply with Article 50(2) by 2 December 2026. Systems placed on the market from 2 August 2026 are subject to it from the moment they are placed on the market. Source read in the Official Journal on 2026-07-27 — EUR-Lex → (opens in new tab)

2 December 2026 — Art. 50(2): marking for systems already placed on the market before 2 August 2026 (transitional period).

What Article 111(4) defers — and what it does not

Article 111(4) touches one actor and one obligation only: it gives providers, and only for the Article 50(2) marking duty, until 2 December 2026 — and only for systems already placed on the market before 2 August 2026.

Articles 50(1), 50(3) and 50(4) are untouched. They apply from 2 August 2026.

Structural consequence: an organisation relying on a third-party generator may owe its own Article 50 duties in full from 2 August, while the tool it depends on is not required to mark its output until 2 December. Four months in which the downstream duty may exist while the upstream signal may not.

Which timeline applies — provider or deployer — turns on the characterisation retained. That characterisation is a legal assessment for your counsel.

The four obligations

The four obligations
ParagraphActorScope
50(1)providerinform the natural person that they are interacting with an AI system, unless this is obvious
50(2)providermark synthetic outputs in a machine-readable format, detectable as artificially generated
50(3)deployerinform persons exposed to emotion recognition or biometric categorisation
50(4)deployerdisclose deepfakes; disclose AI-generated text published on matters of public interest

Article 50 Guidelines — status and dividing lines

Guidelines approved on 20 July 2026 (Communication C(2026) 5054). Formal adoption under Article 96(1)(d) once all language versions are available. They are non-binding: the Court of Justice of the European Union gives the authoritative interpretation.

They assess the Code of Practice on Transparency as adequate for applying Article 50(2).

Article 50(4) fixes two distinct reference dates by content type. Image, audio or video deepfakes: the date of generation governs — no retroactive labelling of already-generated content. AI-generated text published on matters of public interest: the date of publication governs — text published from 2 August 2026 falls under the obligation even if it was generated before that date, unless the editorial-control exemption applies.

Which date and which exemption apply turns on the content type and the timeline. Determining them for your case is a legal assessment for your counsel.

Penalties

Regulation (EU) 2024/1689, Art. 99(4)(g) — up to €15M or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher. Art. 99(6): for SMEs and start-ups, the lower of the two amounts applies.

Your image pipeline strips your evidence

A diffusion tool embeds a C2PA manifest in the source asset. next/image (Sharp) re-encodes the image on optimisation and discards XMP/EXIF metadata by default. Most CDN auto-format pipelines — Cloudinary, imgix, Cloudflare Images — do the same.

The manifest present in the CMS is gone by the time the browser receives the file.

The detection — test the served URL, not the source asset:

exiftool "$(curl -sIL -o /dev/null -w '%{url_effective}' \
  'https://example.com/_next/image?url=/ai/hero.png&w=1200&q=75')"
c2patool 'https://example.com/_next/image?url=/ai/hero.png&w=1200&q=75'

Test the served URL, not the source asset. The delta between the two is the report.

What I ship — fixed 5-day sprint

  • A map of the site's AI surfaces (the register)
  • A disclosure component, delivered as a merged pull request
  • C2PA / metadata marking wired into the asset pipeline
  • A CI guard that fails if an asset marked ai_generated ships without an intact manifest
  • A dated evidence file (scope / referential / sample / date and environment / method)

Optional extension: full AI inventory, +2–3 days.

The price is quoted on the call, not on this page.

What I do — and what I do not do

I do

Implement the disclosure, the marking and the inventory; document the behaviour observed on a given date.

I do not

Determine whether you are a provider or a deployer; decide whether a system falls within the scope of Article 50. These are legal characterisations. I work from your counsel's written position, and I state it on page 1 of every deliverable.

I document observed behaviour, on a named date, against a named referential (RGAA 4.1.2, Regulation (EU) 2024/1689 Art. 50, CNIL délibération 2020-091). I do not characterise conformity and I sign no declaration — the déclaration d'accessibilité is signed by the publisher, on the DINUM template.

Engagement under obligation de moyens, not obligation de résultat. This is not legal advice; legal characterisation is for your counsel.

Send me your chatbot's URL.

Within 48h I send back a dated screenshot of the disclosure state on first contact, free of charge.

Send my chatbot's URL

Prefer to talk it through? Book a 30-min call (opens in new tab)