EU AI Act Transparency Obligations: What You Must Disclose

The EU AI Act (Regulation 2024/1689) introduces the most comprehensive transparency framework for artificial intelligence ever enacted. Unlike previous regulations that focused primarily on data protection, the AI Act establishes clear rules about what must be disclosed when AI systems interact with people, generate content, or make decisions that affect them.

Transparency is not limited to high-risk AI systems. Even AI systems classified as limited risk — including chatbots, deepfake generators, and emotion recognition tools — carry specific disclosure obligations. Failing to meet these requirements can result in fines of up to 15 million EUR or 3% of global annual turnover.

This guide breaks down the transparency obligations under Articles 50 through 52 of the EU AI Act, explains who must comply, and outlines practical steps for implementation.

What Changed in July 2026

Regulation (EU) 2026/1744 ("Digital Omnibus on AI"), in force since 27 July 2026, is the first amendment to the AI Act. It postponed three deadlines:

• High-risk obligations for Annex III stand-alone use cases moved from 2 August 2026 to 2 December 2027.
• High-risk obligations for Annex I products and safety components moved from 2 August 2027 to 2 August 2028.
• National regulatory sandboxes under Article 57 moved from 2 August 2026 to 2 August 2027.

The deferral is unconditional. The Commission's original proposal would have tied the new dates to a decision confirming that harmonised standards were available — a "stop-the-clock" trigger — but the co-legislators dropped it. There is no standards-readiness condition in the adopted text and no further automatic delay.

The AI Act itself was not delayed. The 2 August 2026 general application date held, and the Commission's AI Office and national authorities began enforcing the regulation from that day. Article 50 transparency — chatbot disclosure, deepfake labelling and machine-readable marking of synthetic content — is enforceable now.

Two further changes take effect on 2 December 2026, and both bear directly on this article. Two new prohibitions enter Article 5, covering AI systems that generate or manipulate non-consensual intimate imagery and AI systems that generate or manipulate child sexual abuse material. Separately, a new grace period in Article 111(4) gives generative AI systems placed on the market before 2 August 2026 until that same date to meet the Article 50(2) machine-readable marking duty.

Why Transparency Matters Under the EU AI Act

The EU AI Act is built on the principle that people have a right to know when they are interacting with AI. This is not just a philosophical stance — it is a legally enforceable requirement. The regulation recognises that without transparency, individuals cannot exercise informed consent, contest automated decisions, or understand the basis for outcomes that affect them.

Transparency obligations apply across the entire risk pyramid. While high-risk systems face the most demanding requirements (including technical documentation, conformity assessments, and CE marking), even systems classified as limited risk must meet specific disclosure rules.

Limited Risk

Most transparency obligations fall under the limited risk category. This means they apply broadly to a wide range of AI systems that many organisations already deploy, including customer service chatbots, content generation tools, and AI-assisted communication platforms.

Article 50: Core Transparency Requirements

Article 50 is the central provision governing transparency for AI systems that interact directly with natural persons. It establishes four main categories of disclosure obligations.

1. AI System Interaction Disclosure

When an AI system is designed to interact directly with natural persons, the provider must ensure that the system is designed and developed in such a way that the natural person is informed they are interacting with an AI system. This obligation applies unless the AI nature of the system is obvious from the circumstances and context of use.

In practice, this means:

• Chatbots must clearly identify themselves as AI-powered before or at the beginning of any conversation
• Virtual assistants that handle customer inquiries must disclose their non-human nature
• AI-driven phone systems (including voice clones) must inform callers that they are speaking with an AI

2. Emotion Recognition and Biometric Categorisation

Deployers of emotion recognition systems or biometric categorisation systems must inform natural persons exposed to such systems about the operation of the system. This includes informing them about the categories of personal data being processed and, where applicable, the purpose of the processing.

Key requirements include:

• Informing individuals before the system processes their data
• Explaining what categories of data are collected (facial expressions, voice patterns, physiological signals)
• Stating the purpose of the categorisation or recognition
• Providing this information in a clear, distinguishable manner

3. AI-Generated Content Labelling

Providers of AI systems that generate synthetic audio, image, video, or text content must ensure that the outputs are marked in a machine-readable format and are detectable as artificially generated or manipulated. This is one of the most technically demanding transparency obligations.

The requirement has two components:

• Machine-readable marking: Outputs must contain metadata or watermarks that allow automated detection of their AI-generated nature
• Human-facing disclosure: When AI-generated content is published, deployers must disclose that the content was generated or manipulated by AI

Regulation (EU) 2026/1744 added a transitional rule here. Under the new Article 111(4), generative AI systems that were already placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking duty in Article 50(2). Systems placed on the market on or after 2 August 2026 have no such grace period and must comply immediately. See AI-generated content labelling for the implementation detail.

4. Deepfake Disclosure

The regulation pays special attention to deepfakes. Any person who deploys an AI system that generates or manipulates image, audio, or video content that constitutes a deepfake must disclose that the content has been artificially generated or manipulated. This disclosure must be made in a clear and distinguishable manner at the latest when the content is first published.

There are limited exceptions for:

• Content used for legitimate artistic, satirical, or fictional purposes, provided there are safeguards for third-party rights
• Law enforcement activities where disclosure would compromise public safety

Disclosure is not always enough. From 2 December 2026, two new prohibitions inserted into Article 5 by Regulation (EU) 2026/1744 place certain synthetic content outside the transparency regime altogether: Article 5(1)(ba) bans AI systems that generate or manipulate realistic intimate imagery of an identifiable person without their consent, and Article 5(1)(bb) bans AI systems that generate or manipulate child sexual abuse material. No label makes such a system lawful, and breaches of Article 5 attract the highest tier of fines. The Commission's guidelines on prohibited practices of 4 February 2025 remain the operative guidance on Article 5 and do not yet address these two additions. See prohibited AI practices for the full list.

Article 50 in Practice: Who Must Do What

Understanding transparency obligations requires distinguishing between providers and deployers:

Role	Obligation	Example
Provider	Design systems to enable transparency	Build disclosure mechanisms into the chatbot interface
Provider	Implement machine-readable content marking	Add C2PA metadata or watermarks to generated images
Deployer	Inform users about AI interaction	Display "You are chatting with an AI assistant"
Deployer	Disclose AI-generated content	Label AI-written articles or images as AI-generated
Deployer	Notify subjects of emotion recognition	Post signage about facial analysis in retail spaces

Article 52: Transparency for High-Risk AI Systems

High-risk AI systems face additional transparency requirements beyond those in Article 50. These are detailed primarily in Articles 13 and 14, but Article 52 extends transparency obligations to specific high-risk use cases.

Instructions for Use

Providers of high-risk AI systems must supply deployers with clear, comprehensive instructions for use. These must include:

• The identity and contact details of the provider
• The characteristics, capabilities, and limitations of the AI system
• The level of accuracy, robustness, and cybersecurity performance
• Any known or foreseeable circumstances that may lead to risks to health, safety, or fundamental rights
• Human oversight measures and how to implement them
• The expected lifetime of the system and maintenance requirements

Logging and Traceability

High-risk AI systems must automatically generate logs. These logs must be detailed enough to enable monitoring of the system's operation and to facilitate post-market surveillance. Deployers must retain these logs for a period appropriate to the intended purpose of the high-risk AI system, and for at least six months unless otherwise provided by applicable law.

Practical Steps to Achieve Transparency Compliance

Step 1: Inventory Your AI Systems

Before you can meet transparency obligations, you need to know what AI systems your organisation uses. Conduct a thorough audit covering:

• Customer-facing chatbots and virtual assistants
• Content generation tools (text, image, video, audio)
• Emotion recognition or biometric categorisation systems
• Any AI system that interacts directly with natural persons

Step 2: Classify Disclosure Requirements

For each system identified, determine which transparency obligations apply. Map each system to the relevant provisions of Article 50 and, where applicable, Article 52.

Step 3: Implement Technical Measures

For AI-generated content, implement machine-readable marking. The C2PA (Coalition for Content Provenance and Authenticity) standard is emerging as a leading approach. For chatbots and interactive systems, build disclosure mechanisms directly into the user interface.

Step 4: Draft User-Facing Disclosures

Create clear, plain-language notices for each transparency obligation. Avoid burying disclosures in lengthy terms of service. The regulation requires disclosures to be "clear and distinguishable" — meaning they must be prominent and easy to understand.

Step 5: Document Everything

Maintain records of your transparency measures. This documentation will be essential if regulators ask you to demonstrate compliance. Keep records of:

• What disclosures are made, where, and when
• How machine-readable marking is implemented
• Training materials for staff on transparency obligations
• Any decisions not to disclose (with justification under an exemption)

Timeline for Transparency Compliance

Common Mistakes to Avoid

Assuming chatbot transparency is optional. If your system interacts with people and the AI nature is not obvious, you must disclose. The bar for "obvious" is high.

Ignoring the machine-readable requirement. Simply adding a text label to AI-generated content is not enough. Providers must implement technical marking that enables automated detection.

Conflating GDPR transparency with AI Act transparency. While both regulations require transparency, the AI Act's requirements are distinct. GDPR transparency focuses on data processing; AI Act transparency focuses on the AI nature of the system and its outputs. You need to comply with both.

Treating transparency as a one-time task. Transparency obligations are ongoing. As AI systems are updated, disclosures must be reviewed and revised to remain accurate.

Penalties for Non-Compliance

Failure to meet transparency obligations can result in administrative fines of up to 15 million EUR or 3% of total worldwide annual turnover of the preceding financial year, whichever is higher. For particularly serious violations — such as deploying AI systems that manipulate people without disclosure — penalties can reach 35 million EUR or 7% of turnover.

Conclusion

Transparency is the most immediately actionable area of the EU AI Act, and it is now the most urgent. Unlike the high-risk conformity assessment regime, which Regulation (EU) 2026/1744 pushed out to 2 December 2027 and 2 August 2028, Article 50 has applied since 2 August 2026 and is being enforced today. Many of its obligations can be met through clear communication design, technical content marking, and thorough documentation.

The deferral of the high-risk regime is not a reason to slow down on transparency, and organisations that read the Digital Omnibus as a general reprieve have misread it. If your systems interact with people or generate synthetic content, the obligations are live. The one exception is narrow: generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking duty. Start by inventorying your AI systems, mapping the applicable obligations, and implementing disclosure mechanisms now.