If you paid someone to build an AI assistant for your business, do not assume they carry every duty under the EU AI Act.
The name on the system matters. If it was built for you and runs under your name, Article 50 may treat you as the provider, even though somebody else wrote the code.
That one point changes who has to label AI-generated content and what the label needs to do.
The five duties at a glance
Article 50 has applied since 2 August 2026. It does not say that every piece of AI content needs the same label. It sets five duties, split between the business providing the system and the business using it.
| Duty | Who holds it |
|---|---|
| Tell people when they are speaking directly with AI, unless that is obvious | Provider |
| Add a machine-readable mark to synthetic audio, images, video and text, subject to the Article 50 exceptions | Provider |
| Tell people when emotion recognition or biometric categorisation is being used on them | Deployer |
| Disclose deepfakes | Deployer |
| Label AI-generated text published to inform the public on matters of public interest, unless the exemption applies | Deployer |
The split is easier to remember like this:
The provider puts transparency into the system.
The deployer tells people about certain uses of that system.
The provider test
Under the Act, a provider is a person or business that develops an AI system, or has one developed, and puts it on the EU market or into service under its own name or trademark.
Both parts matter. The question is not simply who built it. You also need to check whose name it runs under.
If you use a supplier's chatbot under the supplier's product name, the supplier will usually remain the provider. Your business is the deployer because it is using the system.
If you pay a developer to build an assistant that goes live under your brand, you may meet the provider test. The developer may have written the code, but that alone does not decide the role.
A business can also be the provider of one system and the deployer of another. Check each system on its own.
The European Commission's Article 50 guidance also says that a provider outside the EU can still be covered when the system's output is used in the EU.
What providers must do
Providers have two main duties here.
First, if an AI system talks directly with people, they must be told that they are dealing with AI from the start of the first interaction. There is an exception when this is obvious, but the Commission says that exception should be read narrowly.
Second, providers of systems that create synthetic audio, images, video or text must make the output detectable through a machine-readable mark. Article 50 includes exceptions for some standard editing that does not make a major change to the input or its meaning.
This technical mark is made for detection tools. It is not the same as a label a person can see or hear.
What deployers must disclose
A deployer is the person or business using an AI system under its own authority for professional work. Staff and contractors working under its control do not automatically become separate deployers.
Deployers need to check three uses.
Emotion recognition and biometric categorisation
People must be told when these systems are being used on them, whether live or later.
Deepfakes
Not every AI image of a real person is a deepfake under the Act. The content must meet three tests:
- It closely resembles the person, object, place, organisation or event being shown.
- The subject exists, could exist or could have existed.
- A person could wrongly take the content as real or truthful.
If all three are met, the disclosure must be clear when the person first sees or hears the content. It must work without a special tool.
That means the provider's hidden machine-readable mark does not complete the deployer's duty. The provider marks the file for software. The deployer labels it for the person.
Text on matters of public interest
Deployers must label AI-generated or changed text published to inform the public about a matter of public interest. Examples include politics, public services, justice, public health and consumer safety.
AI use alone does not trigger this duty. The text must be published, it must inform the public, and its subject must be a matter of public interest.
Human review is more than a proofread
The public-interest text duty has an exemption, but a quick read is not enough.
The text must have had human review or editorial control. The person checking it needs enough knowledge and judgement to examine the meaning, facts and sources. Spell-checking and grammar fixes do not count.
There is a second requirement. A person or business must also hold editorial responsibility for publication. Both sides are needed: proper review or editorial control, plus responsibility for what is published.
The review step needs to catch problems in the work, and the reviewer needs authority to change or reject it. A proper edit can also stop AI-drafted writing sounding like everybody else's, but style alone does not meet the legal test.
The grace period is narrow
There is one limited extension. Providers of systems that generate synthetic content, where those systems were already on the market before 2 August 2026, have until 2 December 2026 to meet the machine-readable marking duty in Article 50(2).
This is not a general delay. The other Article 50 duties still applied from 2 August 2026.
Content made before 2 August 2026 does not have to be labelled later, although the Commission encourages disclosure where possible.
A four-step check for your business
Do not begin by adding an AI label to everything. Begin with four checks:
- List the AI systems that speak to customers or create material you publish.
- Record who developed each one, whether you had it developed, and whose name it runs under.
- Separate the provider's machine-readable mark from any label your business must show to a person.
- For public-interest text, record who checks the meaning, facts and sources, and who carries final responsibility for publication.
These decisions should be visible in your AI Workflow Architecture, alongside the data, decisions and human approvals that control the work.
Where this leaves you
Do not start with the label. Start with the name on the system and the person responsible for what goes out.
If you want to map those roles against the way AI is being used in your business, book a Clarity Session.
Source: Article 50 of Regulation (EU) 2024/1689 and the European Commission's Article 50 guidance, read 25 August 2026.
