--- title: "The EU AI Act: what you must label from August 2, 2026" description: "Article 50 of the EU AI Act has applied since August 2, 2026. This guide shows what you must disclose, who is responsible for what and what to do first." url: https://torn.studio/en/insights/eu-ai-act-what-you-must-label locale: en published: 2026-09-28 updated: 2026-09-30 --- # The EU AI Act: what you must label from August 2, 2026 > **Short answer:** Since August 2, 2026, Article 50 of the EU AI Act has required a chatbot or voice assistant to say it’s AI from the first interaction. Deepfakes have to be clearly labeled, and generative AI systems have to mark their output in a machine-readable form. The duties differ for whoever builds the system and whoever runs it. Picture a customer opening the chat window on your website on a Tuesday evening. The reply comes quickly and warmly from an avatar with a first name and a profile photo. The customer says thanks and asks whether they can call the same person tomorrow. They can’t, because the avatar is a language model. That customer should have known it the moment the chat window opened. Article 50 of the EU AI Act has required it since August 2, 2026, for companies of every size. Everything below draws on the regulation itself and the Commission’s own pages, and every source is listed at the bottom with its date and link. ## What Article 50 requires Article 50 sets out four duties, and they fall on different parties. The text is in Regulation (EU) 2024/1689. The Commission has also published an FAQ page explaining how to read the article in practice. - Chatbots and voice assistants. An AI system that talks directly with people has to be designed so they understand they’re dealing with a machine. The exception is when that’s already obvious to a reasonably well-informed and observant person. A chat window headed “AI assistant” meets the bar. An avatar with a first name and a profile photo needs a clear disclosure. - Machine-readable marking. The provider of a generative AI system has to mark its audio, image, video and text output so a machine can detect that AI generated or manipulated it. The marking has to meet four requirements: effective, interoperable, robust and reliable. - Deepfakes. Whoever publishes images, audio or video resembling real people, places or events has to disclose that the material was generated or manipulated with AI. For artistic and satirical work, a disclosure that lets the audience experience the work as intended is enough. - AI-generated text on public matters. Text published to inform the public on matters of public interest has to be labeled as AI-generated. The editorial-control exception, described further down, decides how much work this means for a marketing team. The disclosure has to be clear, easy to spot and given no later than a person’s first interaction with the system or first sight of the content. So a line in the terms of service falls short for the chat widget in the bottom-right corner. The disclosure belongs in the widget the moment it opens, and it also has to meet accessibility requirements. ## Are you the provider or the deployer? It depends on the system. The duties split across two roles, and the same company can hold one role in one system and the other in the next. A provider develops an AI system, or has someone else develop it, and places it on the market under its own name. A deployer runs an AI system under its own authority in its operations. The Commission points out that individual employees don’t count as deployers in their own right, so the responsibility sits with the company. A common case: a company buys a chat service and adds it to its website. The chatbot is the provider’s system and the company is a deployer. Even so, the company controls the interface where the visitor has to be told it’s AI. Things get more complicated when a company builds its own chatbot on top of somebody else’s language model. Then the question is who provides the system that finally reaches the market, and so who has to mark the content it generates. ## Three things to have in place before you start We budget a morning for all three, and they save weeks later. The order matters, because if you do the inventory after the copy is written, you’ll end up rewriting the copy. - A list of every place an AI system meets a person. Start with the chatbot on your website, the voice response on your phone line and the automatic replies to support emails. Then add forms that answer with AI-generated text, and the AI features already switched on in your ERP and customer-service tools. - A column in the list that says, for each row, whether the company is the provider or the deployer of that particular system. The rows where the answer is unclear are the ones that need a lawyer, and in a company that buys all its AI tools there will be few of them. - A decision on who owns the question internally. The duty is met in the interface itself, so the owner has to be someone with the mandate to change the text in the chat window. ## Six steps, in the order they pay off The steps are written for a company using AI in a handful of places. A company with fifty such places does the same thing per system and names an owner for each row. - Take inventory. Work through the list above and add what’s missing. Expect to find at least one system nobody had thought of, such as a feature switched on in a tool the company already pays for. - Write the disclosure. One sentence, in the same language your customers meet everywhere else, saying that the answers come from AI and how to reach a human. Article 50 requires only the first half, but the second half is what makes the disclosure read as good service. - Put it where it’s seen first. The rule points at the first interaction: the chat window as it opens, the voice response’s first sentence, the automatic email’s first paragraph. The accessibility requirements apply at the same time, so the disclosure also has to work with a screen reader. - Mark the AI-generated content. If the company is the provider of a generative AI system, the machine-readable marking in Article 50(2) applies. The Commission published its Code of Practice on Transparency of AI-generated Content on June 10, 2026, and around 190 companies and organizations had signed it by the end of July. The Code describes the techniques and states that no single technique today meets all four requirements in the article. - Review what you publish. Texts on public matters fall under the labeling duty, and the exception described below decides which of them need a label. - Document it. Write down which systems you inventoried, which role you hold in each, and which disclosure went where and when. The regulator asks its questions after the fact, and then you want to be able to show a dated document. ## What the disclosure can sound like The regulation says what has to be clear and leaves the wording open, and it’s the wording that decides whether the disclosure reads as a warning or as good service. Here are two examples that meet the requirement and sound natural read aloud: - “You’re chatting with an AI assistant. Type ‘human’ and we’ll connect you to our support team, weekdays 8am–5pm.” - “This reply was written by AI and reviewed by our support team before it was sent. Reply to this email to reach a person on our team.” The second example describes a way of working where a person reads the reply before it goes out. Use that wording only if it’s true for you. A claim of review that nobody performs is worse than no disclosure at all, because it can be checked and it’s false. For published text on public matters, that review is also exactly what the exception rests on. Then use the same wording everywhere the system meets customers, so someone moving between chat, email and phone gets the same message. ## The exception a marketing team needs to know about Article 50(4) requires AI-generated text to be labeled if it’s published to inform the public on matters of public interest. The Commission names politics, justice, rights and health as examples. The exception applies when the text has been reviewed by a person or has undergone editorial control, and a natural or legal person holds editorial responsibility for the publication. The Commission explains what editorial control means: a review of the substance by someone with the authority to approve or stop the text after checking the facts. A spell check falls short, and so does an approval given after a quick skim. So a company using AI in its content production needs a way of working it can show: who reads, what that person may stop and where that’s visible. It’s cheaper to set that up from the start than to reconstruct it afterwards. ## What ignoring the rules costs Under Article 99(4), breaching Article 50 or several other provisions can cost up to €15 million or 3% of total worldwide annual turnover, whichever is higher. For small and medium-sized enterprises, including startups, Article 99(6) applies the lower of the two. Under Article 113, the penalty chapter has applied since August 2, 2025. So breaches of Article 50 can be fined from the day Article 50 itself took effect. Supervision is national. On June 15, 2026, the Swedish government designated the Swedish Authority for Privacy Protection (IMY) as the market surveillance authority for the AI Act in Sweden. IMY’s remit includes AI systems in law enforcement and credit assessment, and it works alongside the Swedish Post and Telecom Authority and Finansinspektionen, the financial supervisor. Other authorities share supervision within their own sectors, so questions from a regulator can come from any of them. ## More time for generative systems already on the market Regulation (EU) 2026/1744, also known as the Digital Omnibus on AI, entered into force on July 27, 2026. It gives a four-month transitional period for the machine-readable marking in Article 50(2) to providers of generative AI systems that were on the market before August 2, 2026. That period runs until December 2, 2026. The relief applies only to that marking. The duty to tell people a chatbot is AI has applied since August 2, to new and old systems alike. ## What this guide leaves unanswered This guide is our reading of the regulation and the Commission’s own pages, so a specific case still needs a lawyer’s assessment. It sticks to the transparency duties in Article 50. The prohibitions in Article 5 and the rules for high-risk systems, whose timetable Regulation 2026/1744 changed, fall outside it. It describes the position as of September 16, 2026, and the dates and links below let you check whether anything has changed since. **Read next** - [AI crawlers and agents: how they read your site](https://torn.studio/en/insights/ai-crawlers-and-agents-on-your-site) - [AI in your existing systems: one bounded job at a time](https://torn.studio/en/insights/ai-in-your-existing-systems) - [AI and automation that frees up working hours](https://torn.studio/en/services/ai-and-automation) ## Common questions ### Do the rules apply to us if we only use an AI tool we bought? Partly, yes. A company using a system it bought counts as a deployer. The duties Article 50 places on deployers then apply to it directly: disclosing deepfakes and labeling AI-generated text on public matters. The notice that the chatbot is AI also goes into an interface you control, so in practice it lands with you. ### Is it enough to say in our terms of service that the chatbot is AI? No. Under Article 50(5), the information has to be clear and easy to spot, and it has to come no later than the first interaction. For a chat widget, that means the moment it opens, and the disclosure has to work with assistive technology such as screen readers. ### Do we have to label everything AI helped us write? No. The labeling duty in Article 50(4) covers text published to inform the public on matters of public interest. If a person with editorial responsibility has reviewed the substance and can stop the text after checking the facts, an exception applies. ### What does machine-readable marking actually mean? It’s a mark a computer can detect, such as a digital watermark, metadata or cryptographic provenance data. Under Article 50(2), the provider of the generative AI system is the one who has to apply it, and the Commission’s Code of Practice describes the options. The Code also states that no single technique today meets all four requirements in the article. ### Who supervises this in Sweden? On June 15, 2026, the Swedish government designated the Swedish Authority for Privacy Protection (IMY) as market surveillance authority for the AI Act. IMY works with the Swedish Post and Telecom Authority and Finansinspektionen, and other authorities share supervision, each within its own sector. ### What happens to systems we already had running? The chatbot disclosure has applied since August 2, 2026, regardless of when the system launched. For the machine-readable marking in Article 50(2), Regulation (EU) 2026/1744 gives providers whose systems were on the market before that date four more months, until December 2, 2026. ## Sources - [Regulation (EU) 2024/1689 (the AI Act) — EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) — Source for Article 50 in full, for the penalty ceilings in Article 99(4) and 99(6), for the penalty rules applying since August 2, 2025 under Article 113, and for the requirement to inform clearly no later than the first interaction. - [Transparency obligations under Article 50 of the AI Act — European Commission](https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act) — Source for the split between provider and deployer, for what editorial control means, and for Article 50 applying from August 2, 2026. - [Code of Practice on Transparency of AI-generated Content — European Commission](https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content) — Source for the June 10, 2026 publication date, for the number of signatories by the end of July, and for the Code being voluntary while Article 50 is legally binding. - [Regulation (EU) 2026/1744 (Digital Omnibus on AI) — EUR-Lex](https://eur-lex.europa.eu/eli/reg/2026/1744/oj) — Source for entry into force on July 27, 2026 and for the four-month transitional period for the marking duty in Article 50(2). - [IMY blir marknadskontrollmyndighet för AI-förordningen (in Swedish) — IMY](https://www.imy.se/nyheter/imy-blir-marknadskontrollmyndighet-for-ai-forordningen/) — Source for the Swedish government’s decision of June 15, 2026, for the areas of responsibility and for the cooperating authorities.