AI Act Article 50 for SMEs: chatbot notices, AI-generated content and deepfake labels

If your business uses a customer-facing AI chatbot or publishes AI-assisted content, check which Article 50 duties apply. Your obligations depend on whether you provide the system or deploy it, and on the type of content involved. Using AI to draft a newsletter or create an illustration does not automatically require a public AI label.

What Article 50 requires, and from whom

Article 50 of Regulation (EU) 2024/1689 sets four transparency duties. Each one falls on a specific actor.

Article 50(5) adds the format rule: the information must be clear and distinguishable, reach people at the latest at the first interaction or exposure, and meet applicable accessibility requirements.

The European Commission published non-binding guidelines on Article 50 on 20 July 2026. They explain how the Commission reads the law. The text of the Regulation is what binds you.

Provider or deployer: start here

Under Article 3(3), a provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. Under Article 3(4), a deployer uses an AI system under its authority, outside purely personal use.

Most SMEs are deployers of tools built by others. You become a provider when you develop or commission a system and put it into service under your name. Displaying your logo on a vendor's widget does not settle the question on its own: look at who developed the system and under whose name it is offered.

The examples illustrate common cases. Test your own facts against Articles 3 and 50 before you settle on a role.

Chatbots: the AI interaction notice

Article 50(1) requires providers to design systems that interact directly with people so that those people are informed they are dealing with AI. No notice is needed when this is obvious to a reasonably well-informed, observant and circumspect person, considering the circumstances and context of use.

The notice must arrive at the latest at the first interaction (Article 50(5)). The Commission's guidelines add that a mention only in your terms and conditions, a hidden metadata tag or a vague label such as “assistant” is not enough on its own. A single prominent notice before the first exchange will usually do. The guidelines recommend repeating it in higher-risk contexts, for example where users are vulnerable.

Machine-readable marking: a provider duty

Article 50(2) requires providers of AI systems that generate synthetic audio, images, video or text to mark the outputs in a machine-readable format and make them detectable as artificially generated or manipulated. The technical solutions must be effective, interoperable, robust and reliable as far as technically feasible.

The Article 50(2) obligation does not apply to the extent that the system performs an assistive function for standard editing or does not substantially alter the input data provided by the deployer or its semantics. A separate exception concerns specified criminal-law-enforcement uses authorised by law. Read “to the extent” closely. In our reading, a product that both corrects grammar and writes new text escapes the duty for its grammar function only.

If you only use a vendor's generator, the marking is the vendor's job. It does not replace your own visible label where Article 50(4) requires one.

Under Article 111(4), providers of generative AI systems placed on the market before 2 August 2026 must comply with Article 50(2) by 2 December 2026. It gives deployers no extra time and covers no other Article 50 duty.

Deepfakes: when an AI image, video or audio needs a label

Article 3(60) defines a deepfake as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful. All three elements must be present.

If you deploy AI to create a deepfake, disclose that the content is artificially generated or manipulated (Article 50(4)). The Commission's guidelines say people must be able to perceive the label without special tools; machine-readable marking alone does not meet this duty. They also assess the content against its context and foreseeable audience, so photorealism alone does not decide the question.

AI-written text on matters of public interest

Deployers must disclose AI-generated or manipulated text published to inform the public on matters of public interest. The Commission's guidelines describe these matters broadly: politics, public administration, justice, fundamental rights, public health, consumer safety, the environment, and economic, financial or scientific developments open to public debate. Internal documents, private correspondence and advertising copy without health, safety or sustainability claims generally fall outside.

Disclosure is not required where the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility for its publication. The reviewer and the holder of editorial responsibility need not be the same person: your company can hold the responsibility while an employee reviews.

According to the Commission's guidelines, review means examining the substance, and fact-checking is a minimum. Spell-checks, automated checks or a quick sign-off do not count. If AI changes the text substantively after approval, the exception no longer applies until the text is reviewed again. The guidelines also recommend making the identity and contact details of the responsible person or company easy to find, for example in your website's legal notice.

Emotion recognition and biometrics: check the bans first

Article 3(39) defines an emotion recognition system as one that identifies or infers emotions or intentions from biometric data. A tool that scores the tone of written reviews generally falls outside this definition, because written text is not biometric data.

Before any notice, check Article 5. Article 5(1)(f) prohibits AI that infers emotions in the workplace and in education institutions, except for medical or safety reasons. Article 5(1)(g) prohibits biometric categorisation that infers sensitive traits such as political opinions or sexual orientation. A notice or consent cannot make a prohibited use lawful.

For a lawful covered use, Article 50(3) requires you to inform the people exposed of the system's operation and to process their data under the GDPR. The AI notice is not a legal basis for processing. For the wider data-protection questions raised by everyday AI tools, see our guide to ChatGPT, Copilot and the GDPR.

Does Article 50 apply to businesses outside the EU?

It can. Article 2(1)(a) covers providers placing AI systems on the EU market or putting them into service in the EU, wherever they are established. Article 2(1)(c) covers providers and deployers established outside the EU where the system's output is used in the EU. The Commission's guidelines add that incidental or unforeseeable use in the EU should not trigger the duties on its own, while foreseen or authorised dissemination in the EU does.

Status as an EU candidate country, such as Türkiye or a Western Balkan state, neither brings a business within scope nor exempts it: the same tests apply. Businesses in Norway, Iceland and Liechtenstein should check the AI Act's current status under the EEA Agreement and the same territorial rules.

Key dates

The high-risk dates concern other systems and other obligations. They do not postpone Article 50. To check whether your system is high-risk, use our 7-step high-risk test.

Fines and enforcement

Under the Member State penalty framework in Article 99, breaching Article 50 can lead to fines of up to €15 million or 3% of total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(4)(g)). For SMEs, including start-ups, the cap is whichever is lower (Article 99(6)). Article 99(6a) gives the same lower cap to small mid-cap enterprises as defined in Commission Recommendation (EU) 2025/1099 (Article 3(14b)).

These are maximums. Authorities weigh the circumstances, including the size of the business, its cooperation and any steps taken to limit harm (Article 99(7)). Enforcement sits with national market surveillance authorities for most businesses.

The Commission concluded on 8 July 2026 that the voluntary Code of Practice on AI-generated content adequately covers Article 50(2), (4) and (5). Signing it is optional, and the Commission states that adherence is not conclusive evidence of compliance.

Six practical steps

1. List your AI uses. Note every chatbot, content generator and any emotion or biometric function, with vendor, purpose and audience. Our AI system inventory template gives you the fields.
2. Decide your role and screen for bans. Record whether you are provider, deployer or both for each use, and check Article 5 before anything else.
3. Implement and test interaction notices. If you provide a chatbot, build the notice in. If you embed one, check that the vendor's notice displays on desktop, mobile and screen readers.
4. Handle marking. Providers implement and test machine-readable marking and detection. Deployers ask their vendors how marking works and keep the answer.
5. Set rules for content and editorial review. Decide when deepfakes and public-interest texts get a label, who reviews in substance, and which person or company holds editorial responsibility.
6. Keep evidence and review changes. Keep screenshots, policies and review records, and re-check after any substantive AI change. These records support your compliance; they are not a statutory checklist or a certificate.

Interested in Themio? Join the waitlist.

For news about Themio's launch, join the waitlist.

Themio Team

Published by Themio SAS · Substantive review and editorial approval: Majda Skrijelj Fetiveau

Written by Themio Team and published by Themio SAS. Substantive review and editorial approval by Majda Skrijelj Fetiveau, Advisor and Regulatory Untangler, with over 20 years of experience in compliance and governance within international financial institutions.