EU AI Act transparency guidelines: what providers and deployers need to separate

EU AI Act transparency guidelines: an implementation brief

Quick answer

On 20 July 2026, the European Commission published guidelines explaining the scope and practical application of Article 50 of the EU AI Act. The transparency obligations apply from 2 August 2026. The operational lesson is not “add one AI label.” Article 50 assigns different duties according to whether an organisation is the provider or deployer of a system, what the system does, what content it produces, and how a natural person encounters the system or output.

Teams should build a role-and-output inventory now. For each use case, record the provider, deployer, system owner, audience, interaction, content type, publication context, technical marking path, visible disclosure path, exception analysis, human review, accessibility check, and retained evidence. This article is informational and is not legal advice. Use qualified counsel to apply the Regulation and current guidance to specific facts.

What happened

The Commission’s 20 July press release announced guidelines for providers, deployers, and competent authorities preparing for Article 50. The guidance covers interactive AI, generated or manipulated content, emotion recognition, biometric categorisation, deepfakes, and certain AI-generated or manipulated text. It also explains concepts, exceptions, and ways to demonstrate compliance.

The release follows the 10 June publication of the Code of Practice on Transparency of AI-Generated Content and its subsequent adequacy assessment by the Commission and AI Board. The documents have different jobs. The Regulation is the legal basis. The guidelines explain the Commission’s interpretation across Article 50. The voluntary Code offers measures for signatories addressing the marking and labelling obligations under Article 50(2), (4), and (5). The Code does not replace the Regulation or guidelines, and signing it is not the only possible route to demonstrating compliance.

Why it matters

A single organisation can occupy more than one role. A developer placing a chatbot on the EU market under its own name may be a provider. A business using that chatbot under its authority in a professional workflow may be a deployer. An organisation that develops a system and also publishes its outputs can have duties on both sides. Employees acting under the organisation’s authority are not automatically separate deployers.

That distinction changes the control. Machine-readable provenance and visible human disclosure are related but not interchangeable. A provider-side mark can support detection of artificial origin, yet a deployer cannot assume hidden metadata alone satisfies a duty to disclose a deepfake clearly to the person exposed to it. The creative AI rights and provenance guide explains the wider evidence chain around assets, terms, edits, and approvals.

Confirmed details

Article 50(1) concerns providers of AI systems designed to interact directly with natural persons. They must design the system so people are informed that they are interacting with AI unless that is obvious to a reasonably informed, observant person. The Commission FAQ says the notice should be clear from the start of the first interaction and meet accessibility requirements. Background or machine-to-machine operation without direct human contact falls outside this interaction duty.

Article 50(2) concerns providers of systems, including general-purpose AI systems, that generate synthetic audio, image, video, or text. In-scope outputs must be marked in a machine-readable format and detectable as artificially generated or manipulated. The Regulation qualifies the technical solution by feasibility, content type, implementation cost, and generally acknowledged state of the art. Standard editing assistance and outputs that do not substantially alter supplied data or meaning can fall outside this marking duty. The Commission FAQ also describes excluded output contexts and a narrow business-to-business or industrial treatment subject to the guideline conditions.

Article 50(3) concerns deployers of emotion-recognition or biometric-categorisation systems. They must inform natural persons exposed to those systems, subject to the Regulation’s scope and exceptions. The notice duty can apply to real-time or later operation.

Article 50(4) concerns deployers using AI to generate or manipulate content. Deepfakes—qualifying image, audio, or video that resembles existing persons, objects, places, entities, or events and would falsely appear to a person to be authentic or truthful—must be disclosed clearly. AI-generated or manipulated text published to inform the public on matters of public interest also has a disclosure rule. The Regulation includes specific treatment for artistic, creative, satirical, fictional, or analogous works and an exception for text that has undergone substantive human review or editorial control where a person holds editorial responsibility. A superficial grammar check is not the substantive review described by the Commission FAQ.

Article 50(5) sets a horizontal presentation boundary: information under paragraphs 1 to 4 must be clear, distinguishable, and accessible, no later than the first interaction or exposure. The exact implementation therefore needs both technical and human-interface testing.

Who is affected

Product and platform teams need an inventory of interaction surfaces, generation systems, output formats, and release paths. Communications, media, and marketing teams need to know when published content enters deepfake or public-interest-text analysis. Procurement must establish which party supplies marking, detection, label, documentation, and change notices. Governance teams need evidence that controls survive export, transformation, syndication, and reuse.

Legal and compliance owners should validate role, scope, exceptions, and current applicability rather than infer them from a vendor’s generic “AI compliant” statement. The AI governance tooling guide provides an operating structure for owners, risk tiers, exceptions, and review dates. The AI procurement checklist helps turn those findings into product requirements and contract evidence.

Sources and verification note

All five official sources were publicly accessible on 29 July 2026. The EUR-Lex Regulation establishes the legal text. The Commission press release, guideline library, Article 50 FAQ, and Code page establish the publication date, Commission interpretation, role distinctions, implementation guidance, and voluntary Code status used here. No vendor blog or secondary legal commentary is used for a legal claim.

The public guidance does not decide a specific organisation’s facts. It can also change as legislation, standards, technical feasibility, and Commission materials develop. Preserve the version and review date behind each conclusion and recheck before launch.

Limitations and remaining unknowns

The documents do not make every marking technology equally effective. Metadata can be removed during screenshots, transcoding, copying, or platform processing. Watermarks can affect accessibility or presentation. Detection systems can create false positives and false negatives. Teams still need format-level tests across the actual creation, editing, export, upload, distribution, archive, and retrieval chain.

The current record also does not answer every cross-border, sector-specific, employment, copyright, privacy, consumer-protection, or platform-law question. Article 50 operates alongside other EU and national obligations. A documented transparency control should not be treated as clearance for the underlying data, model, likeness, or publication.

What to do next

1. Inventory EU-facing AI interactions and generated or manipulated audio, image, video, and text.
2. Assign provider, deployer, product, publication, legal, accessibility, and evidence owners for each flow.
3. Map the relevant Article 50 paragraph, scope criteria, exceptions, first-interaction or first-exposure point, and required control.
4. Test whether machine-readable marks survive the real content pipeline and whether visible labels remain clear, distinguishable, and accessible.
5. Record substantive human review and editorial responsibility where a public-interest text exception is relied on.
6. Decide whether to evaluate the voluntary Code, and document adequate alternative measures if the organisation does not use it.
7. Recheck the official Regulation, Commission guidelines, and FAQ before the 2 August release boundary and after material workflow changes.

The live AIGovTool profile on ToolVerse is an Intel SGX and hardware-attestation governance proof of concept, not an Article 50 compliance solution. It is useful only as a reminder to test evidence and attestation claims against a bounded workflow. For broader tooling discovery, retain the ToolVerse AI productivity category as the fallback route.

The immediate decision is whether every in-scope interaction and output has an accountable role, a tested transparency control, and reviewable evidence before exposure—not whether a product can display a generic “AI-generated” badge.