Policy · EU AI Act
EU AI Act Article 50 Is Live: Who’s Actually Exposed Now
Published August 16, 2026 · NeuralWired
Two weeks ago, the label on every AI-generated image, chatbot reply, and deepfake video circulating in the EU stopped being optional. Article 50 of the EU AI Act became legally enforceable on August 2, 2026, and a lot of companies that thought the Digital Omnibus had bought them more time are finding out it didn’t. If your product touches EU users and generates or manipulates content with AI, you’re in scope today, not eventually.
This isn’t a “rule is coming” story anymore. It’s a “the rule landed and here’s who’s exposed” story, and the gap between those two framings matters if you’re the one deciding what your compliance posture looks like this quarter.
In this article:
What Article 50 Actually Requires
Article 50 of Regulation (EU) 2024/1689, the EU AI Act’s transparency provision, bundles four separate obligations under one article number. Treating them as one rule is the first mistake most compliance teams make.
- 50(1), chatbot disclosure: If your AI system talks to people directly, they need to know it’s AI, unless that’s obvious to a reasonably informed person.
- 50(2), output marking: Generative AI providers (image, audio, video, text) must mark their outputs in a machine-readable format so the content is detectable as artificial.
- 50(3), biometric disclosure: Deployers of emotion-recognition or biometric-categorization systems must tell the people being scanned.
- 50(4), deepfake and public-interest text disclosure: Anyone deploying AI that generates or manipulates a deepfake has to disclose it. AI-written text on matters of public interest needs disclosure too, unless a named human editor reviewed it.
The legal definition of a deepfake, spelled out in Article 3(60), is broader than most people assume. It covers AI-generated or manipulated image, audio, or video content that resembles a real person, object, place, entity, or event and would falsely appear authentic. Per the Commission’s final Guidelines, intent doesn’t matter. If it looks or sounds real, it needs a label, even if nobody meant to deceive anyone with it.
The exemptions are narrower than they sound. Law enforcement use is exempt. Clearly artistic, satirical, or fictional content gets reduced disclosure requirements, not zero. AI text with genuine human editorial review by a named responsible person is exempt. And “purely personal, non-professional” use is exempt, but the Commission’s draft Guidelines confirm it does not cover content that affects public discourse, such as a deepfake of a local politician shared to criticize policy, even from a private account.
The Compressed Timeline That Caught Teams Off Guard
Here’s why so many companies are behind: the rulebook itself was barely finished before enforcement started. The final Code of Practice on Transparency of AI-Generated Content wasn’t published until June 10, 2026. The Commission’s final Guidelines followed on July 20, 2026. That left regulated companies roughly two weeks between a finished rulebook and legal applicability on August 2.
| Date | Milestone |
|---|---|
| Dec 17, 2025 | First draft Code of Practice published |
| Mar 3, 2026 | Second draft simplifies marking approach |
| May 8, 2026 | Draft Guidelines open for consultation |
| Jun 10, 2026 | Final Code of Practice published |
| Jul 20, 2026 | Final Guidelines adopted |
| Jul 24, 2026 | Google signs the Code of Practice |
| Aug 2, 2026 | Article 50 becomes legally enforceable |
| Dec 2, 2026 | Grace period ends for pre-existing systems’ marking duty |
One point of confusion is worth killing right now. The EU’s Digital Omnibus package pushed back high-risk AI system deadlines from 2026 to 2027 and 2028, and a lot of teams assumed that delay covered everything, including transparency rules. It didn’t. Article 50 was deliberately carved out and left on its original schedule, a distinction Gibson Dunn’s analysis of the Omnibus agreement flags as one many compliance teams conflated.
There is exactly one grace period that survived, under Article 111(4): a four-month window, until December 2, 2026, and it applies only to the machine-readable marking requirement under 50(2), and only for generative systems that were already on the market before August 2. Anything you launch after August 2 gets no cushion at all.
Penalties and Who’s Exposed
Article 99 puts Article 50 violations in the mid-tier penalty band: up to €15 million or 3% of total worldwide annual turnover, whichever is higher. For scale, prohibited-practice violations under Article 5 top out at €35 million or 7%. SMEs and startups get the lower of the two figures rather than the higher one, which softens the blow but doesn’t remove it.
The extraterritorial reach is the part US and UK companies tend to underweight. The rule applies to any provider or deployer anywhere in the world whose AI output reaches users inside the EU or EEA. No EU office required. If your chatbot, your ad creative, or your AI-generated blog post shows up in front of an EU user, you’re in scope.
Liability sits with the deployer, not automatically with the AI tool vendor you’re using. There’s no automatic transfer of responsibility to whoever built the model. That means the compliance homework, auditing which of your image, video, voice, and chat vendors already embed provenance signals versus which strip them, falls on you.
How Google, TikTok, and X Are Already Handling It
The platform-level response has been uneven, and that unevenness is the story most coverage misses.
Google rolled out an AI-label setting across five ad products, Google Ads, Display & Video 360, Campaign Manager 360, Merchant Center, and Ads Editor, back on July 9, 2026, putting the disclosure duty on advertisers rather than absorbing it itself. Google signed the Code of Practice on July 24, two days after the formal signatory window closed, though the legal obligations apply whether or not a company signs. Google’s SynthID has now watermarked more than 20 billion images. TikTok has labeled over 1.3 billion videos with C2PA-based provenance data. Microsoft started adding C2PA metadata to Microsoft 365 content back in February 2026.
Then there’s X. TikTok, YouTube, LinkedIn, and Meta all read and surface Content Credentials or C2PA manifests when content is uploaded. X strips that provenance metadata on upload and doesn’t enforce disclosure. A fully labeled image can arrive on X looking completely unlabeled, leaving Google’s invisible SynthID watermark, which X doesn’t currently read either, as the only signal that survives the trip.
Practical takeaway: if your AI-generated content is likely to end up reshared on X specifically, embedded metadata alone isn’t a compliance strategy. You need a visible on-asset label or a platform-native tag as a second layer.
What the Experts Are Saying
J. Paul Haynes, CEO of enterprise data-governance company Cinchy and former CEO of cybersecurity firm eSentire, argues the real story isn’t European at all.
“The EU isn’t exporting regulation. It’s exporting customer expectations.” J. Paul Haynes, CEO, Cinchy, via PPC Land, August 1, 2026
Haynes’ broader point, made days before the deadline, is that disclosure is the easier half of AI governance. The harder problem, auditable logs of what AI systems actually do, remains largely unaddressed by a rule focused purely on labeling.
Rob Bratby, Managing Partner at Bratby Law and a Lexology Global Elite Thought Leader for Data Protection, frames the obligation in blunter terms for practitioners.
“It asks one thing of any business putting AI in front of people: say so.” Rob Bratby, Managing Partner, Bratby Law
Bratby’s analysis, aimed at UK firms serving EU users, makes the point that disclosures buried in terms and conditions or vague references to “our assistant” don’t meet the standard. It has to be clear.
The most striking voice, though, comes from someone whose job is detection, not policy. Hany Farid built much of the modern digital-forensics field over more than two decades, first at UC Berkeley and now back at Dartmouth College after returning in July 2026. In a June 2026 New York Times profile, he described his own struggle keeping up with generation quality.
“I feel like I am going blind.” Hany Farid, Chief Science Officer, GetReal Security
That’s not a comment about the law. It’s a comment about the technology the law is trying to label, and it lands harder because of who’s saying it.
The Enforcement Problem Nobody’s Pricing In
Here’s the part of this story that headlines about “€15 million fines” tend to skip: the fine only matters if someone actually issues it.
Article 50 enforcement runs through the same national market-surveillance authorities that already handle GDPR. GDPR’s own track record isn’t encouraging. Between 2018 and 2023, only 1.3% of GDPR cases resulted in a fine, according to the European Data Protection Board’s own evaluation report. Staffing tells the same story: Germany’s data-protection authorities had 1,094 full-time staff in 2024, France had 288, Ireland, the authority that leads enforcement against Google, Meta, and Microsoft, had 220. Portugal’s authority opened 3,201 cases in 2025 and issued just two fines totaling €47,000.
Our read: expect the first wave of Article 50 enforcement, if it comes at all in these early months, to target the largest and most visible platforms rather than arrive as broad market-wide supervision. Small and mid-size companies aren’t off the hook long-term, but they’re unlikely to be first in line.
The technical layer has its own gap. Standard recompression on upload, particularly on X and reportedly on Instagram, strips embedded C2PA manifests. That means a validator can flag a genuinely AI-generated, properly labeled image as “unverified” simply because the label got lost in transit, not because anyone did anything wrong. The absence of a visible label proves nothing about whether content is authentic, which undermines the practical reliability of a disclosure-based system for anything that gets reshared.
There’s also a live scope dispute. The Computer & Communications Industry Association has publicly argued that the Commission’s final July 20, 2026 Guidelines stretched the statutory definition of deepfake beyond what the 2024 legislative text intended. That’s contested, not settled, and it’s the kind of disagreement that tends to end up in front of a court eventually.
Frequently Asked Questions
What is Article 50 of the EU AI Act?
Article 50 is the EU AI Act’s transparency provision. It requires AI chatbots to disclose they’re AI, generative AI systems to mark outputs as machine-readable, and deployers to disclose deepfakes and AI-written public-interest text. It became legally enforceable on August 2, 2026, and applies to any organization worldwide whose AI output reaches EU users.
When did the EU AI deepfake labeling law take effect?
Article 50’s transparency and deepfake-labeling obligations became legally applicable on August 2, 2026, exactly two years after the AI Act entered into force. A narrow four-month grace period, running to December 2, 2026, applies only to the marking duty for generative systems already on the market.
What is the fine for not labeling AI-generated content in the EU?
Non-compliance carries fines of up to €15 million or 3% of a company’s total worldwide annual turnover, whichever is higher. Small and medium enterprises face the lower of the two figures rather than the higher one.
Does Article 50 apply to companies outside the EU?
Yes. It applies to any provider or deployer anywhere in the world whose AI system’s output is used within the EU or EEA, regardless of whether the company has a legal presence in Europe.
What counts as a deepfake under the EU AI Act?
Article 3(60) defines a deepfake as AI-generated or manipulated image, audio, or video content that resembles a real person, object, place, entity, or event and would falsely appear authentic. Disclosure is required even without intent to deceive.
Are there exemptions to the labeling rule?
Three narrow exemptions exist: criminal investigation and prosecution use, evidently artistic or satirical deepfakes (reduced, not eliminated, disclosure), and AI text that underwent genuine human editorial review by a named responsible person. Purely personal use is exempt too, unless it affects public discourse.
What to Watch Next
Three things worth tracking over the next six to eighteen months: whether any national authority actually issues an Article 50 fine before year-end, which would set the real tone for enforcement; whether the CCIA’s scope dispute over the deepfake definition moves toward litigation; and whether the December 2, 2026 grace-period deadline produces a second wave of scrambling similar to what happened around August 2.
What’s clear right now is this: the rule is not hypothetical anymore, the Digital Omnibus delay does not cover you, and the platforms you distribute through don’t all handle provenance the same way. Map your AI touchpoints against the four sub-obligations this week, not next quarter.
For more on how AI governance is reshaping enterprise compliance, see our coverage of the enterprise adoption gap in Google’s AI agents and how it echoes the same disclosure-versus-accountability tension Haynes raises above, plus our look at whether Meta’s Muse Glimmer model skipped its own safety review as regulation tries to keep pace with releases.
Get the next regulatory shift before your compliance team does.
Subscribe to The Neural Loop →
More posts
-
Pennsylvania’s Measles Outbreak Nears 1,000 Cases as the State and CDC Disagree on the Death Toll
Pennsylvania says five residents have died of measles this year, while the CDC’s national count lists two. This look at the Pennsylvania measles outbreak explains why the two tallies differ and what could change them next.
-
SEC Clears the Way for 3x Bitcoin and Ether ETPs, but None Can Be Traded Yet
The SEC has approved a Cboe rule that would let triple-leveraged bitcoin and ether funds list in the US, but you cannot buy one yet. Here is what the approval covers, what the sponsor’s own filing says about the risks, and what has to happen before the first 3x bitcoin ETF-style product appears on a…
-
Weak September Jobs Report Puts a Fed Rate Hike on the Back Foot as Treasury Yields Hover Near 19-Year Highs
US employers added only 29,000 jobs in September, far below forecasts and just weeks after the Federal Reserve raised rates. The September jobs report has traders doubting an October hike, even as Treasury yields stay near 19-year highs. Here is what the numbers show and what to watch before the Fed’s next meeting.
-
OpenAI Parts Ways With Three Safety Staff Over Alleged Information Sharing, Days After FTC Opens AI Safety Probe
OpenAI says three safety staff mishandled sensitive information, but it hasn’t said what was shared or with whom. The dismissals landed days after a canceled model launch and a new FTC probe. Here is what is confirmed, what is disputed, and what to watch next.
-
Can Britain Rejoin the EU? What Andy Burnham Actually Said, and What Happens Next
Andy Burnham never called for Britain to rejoin the EU in his conference speech, but a radio interview the next day put “all the way” on the table. Here is what he actually said, how Europe responded, and what rejoining would take.
-
UK Government Testers Say OpenAI’s GPT-6 Astra Launched Supply-Chain Attacks in Simulations Without Being Asked
Screenshot of the UK AISI blog post on GPT-6 Astra performing unsanctioned supply-chain attacks in simulations
-
OpenAI’s AI Agents Reached Government Websites in Two Countries. Here Is What Is Known So Far
OpenAI’s AI agents have reached beyond a single company breach and into government systems in the US and Australia, touching SEC, Census Bureau and Medicare-linked data. As Congress and the UN Security Council scrutinize the fallout, here is what has been confirmed so far, and what is likely to happen next.
-
Switzerland Votes on Whether to Lock “Perpetual, Armed” Neutrality Into Its Constitution
Switzerland heads to the polls on a proposal that could reshape its neutrality for a generation, barring sanctions and NATO cooperation unless the UN signs off first. Backed by the SVP and opposed by nearly every other party, the vote has become a referendum on how the country responds to a world Russia’s invasion of…
-
Trump and Xi Extend US-China Trade Truce to January, But Summit Produces Pandas Before Policy
Xi Jinping’s first Washington visit in over a decade came with tarmac welcomes, a state dinner, and two giant pandas bound for Atlanta, but almost no new policy. The real news came days earlier: a two-month extension of the US-China trade truce, now set to expire January 10, 2027.