On 8 May 2026, the European Commission published the draft Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of Regulation (EU) 2024/1689 (the “AI Act”). The 40-page text, issued by the AI Office, is open for stakeholder consultation until 3 June 2026 and is intended to apply alongside Article 50 itself from 2 August 2026.
In this Insight, we focus on what we think actually matters in practice. We treat two areas in depth: the marking and detection obligation under Article 50(2) and the deepfake regime under Article 50(4). The remaining two limbs are treated more briefly.
AI Act Article 50 Guidelines: what they are and how they bind
The Guidelines are issued under Article 96(1)(d) AI Act and set out the Commission’s interpretation of Article 50 for providers, deployers and competent authorities. They are explicitly non-binding, and only the CJEU can deliver an authoritative interpretation. In practice, that disclaimer carries limited weight: national market surveillance authorities and the AI Office are likely to follow them closely, and any divergence will need to be justified.
The relationship to the Code of Practice is as follows: the Guidelines cover all of Article 50 and address everyone in scope. The Code of Practice is voluntary, limited to paragraphs (2) and (4), and serves primarily as a compliance demonstration vehicle for signatories.
Horizontal topics
Before reaching the four operative paragraphs, the Guidelines work through a horizontal section that resolves some recurring questions and quietly reframes others:
“Mere distribution” remains outside the regime, for now. Para. 12 confirms a useful negative finding: actors whose role is limited to disseminating or transmitting AI-generated content (including online platforms) are not deployers within the meaning of the AI Act. The Guidelines stop short of conditioning that conclusion on the absence of any “practical control” over the system.
The personal-use carve-out is narrower than it reads, and FOSS does not help. The “purely personal non-professional activity” exception in Article 2(10) AI Act is explicitly limited where the activity affects public discourse: a deepfake of a local mayor shared on social media to criticise policy decisions cannot be hidden behind the personal-use exception (para. 17). Equally importantly, and easily missed, the Guidelines confirm that AI systems released under free and open-source licences remain fully subject to Article 50.
Interplay with the GPAI regime in Article 53:
- The Guidelines confirm that Article 50 attaches at the AI system layer, while Article 53 attaches at the model layer (paras. 23–24). A single product can engage both: a generative AI system built on a GPAI model will typically have to mark its outputs (Article 50(2)) and satisfy the model-level documentation duties (Article 53).
- The Guidelines go further and “encourage” GPAI model providers, including those whose models are integrated by downstream system providers, to implement marking measures at the model level even where they would not formally fall within Article 50 (paras. 24, 70). This is where the Guidelines and the second draft Code of Practice noticeably diverge. The Code’s Measure 1.4 treats upstream model-level marking as a compliance obligation for signatories; the Guidelines treat it as a strongly suggested best practice. For GPAI model providers that are not Code signatories, the practical question is whether to follow the stricter Code path voluntarily, or to rely on the Guidelines’ softer formulation and accept the dependency this creates for downstream system providers.
Article 50(2) – Marking and detection of AI-generated content
Article 50(2) is the limb that has attracted the most industry attention, and rightly so: it imposes provider-side technical obligations that reach across the whole AI economy, from foundation-model labs to single-purpose generative tools. The provision imposes both a marking and a detection duty (para. 65), and read with Article 50(5), the detection means must be available to third parties at the latest at the point of exposure to the content. Compliance reasoning focused only on the marking leg misses half the duty.
Scope and exceptions: what the Guidelines clarify. Four points on the boundary of Article 50(2) deserve to be highlighted:
- Article 50(2) is not GPAI-specific. Para. 54 is unambiguous: any AI system generating or manipulating synthetic audio, image, video or text content is captured, including single-purpose tools such as a translation engine, a voice cloner or a single-domain image generator. The public debate’s focus on foundation models has tended to obscure the breadth of the trigger. Many vendors of narrow-purpose generative tooling that have so far positioned themselves outside the marking conversation will need to revisit that position.
- The Guidelines exempt source code outputs (para. 64). This is a sensible carve-out: automated code generation sits at the heart of agentic developer tools such as Claude Code, Cursor and Copilot. But the boundary is not fully spelled out. In our reading, the exemption covers source code proper, including inline comments and docstrings that form part of the code artefact, but does not extend to standalone documentation such as README files, marketing-style product descriptions or natural-language explanations generated separately by the same tool. Those outputs are text in the ordinary sense and re-enter Article 50(2) on that basis. The point will need to be confirmed by the final Guidelines or supervisory practice, but coding-agent vendors should design their disclosures around that delineation rather than rely on a blanket “we generate code” framing.
- The B2B/industrial carve-out in para. 81 is materially narrower than the term suggests. Two conditions are cumulative: the output must be strictly technical in nature (engineering designs, predictive-maintenance results, internal workflow documents pre-finalisation), and it must be intended only for a limited, pre-defined audience of professionals acting within the organisation. Any leakage of the output to an external counterparty (a customer, a supplier, a contractor) collapses the second leg and reinstates the obligation. “We only use it internally” is therefore not, on its own, sufficient. Industrial deployments that envisage any external recipient (and most do) will need to plan for marking from the outset.
- The Guidelines develop a purpose-driven carve-out for video games (para. 82). Where synthetic visual or audio content is generated as part of gameplay, the user is plainly aware of the generative-fictional nature of the environment, and the deceptive risk that Article 50(2) is designed to address does not arise. The carve-out is best understood as a scenario-specific application of the no-substantial-alteration logic combined with the obviousness of the in-game context. It is not unconditional, since it depends on the obviousness of the in-game context and the absence of a deceptive purpose, but it gives studios and publishers material relief from the marking burden for in-engine generative content.
Agentic AI: where the Guidelines go further than the AI Act. The AI Act itself does not use the word “agent”. The Commission considered introducing agentic concepts via the digital Omnibus and ultimately chose not to. The Guidelines, by contrast, address agentic AI head-on in the Article 50(1) context: where a provider cannot reliably determine whether an agent will interact with a natural person, the agent must self-disclose its artificial nature in every situation where such interaction is reasonably foreseeable (para. 28). The default thus shifts from “disclose where interaction is certain” to “disclose where interaction is plausible”, which is a meaningful expansion for autonomous browsing, scheduling and outreach agents that operate without a fixed human counterparty. The Commission is using secondary interpretation to address a question that the primary legislation left open, which is worth flagging in its own right, because the regulatory expectations for agents are crystallising here, well ahead of any statutory definition.
Connection to the Code of Practice. The technical architecture that Article 50(2) implies, typically a defence-in-depth combination of watermarking, metadata identifiers, cryptographic provenance and fingerprinting, is the subject of the second draft Code of Practice, which we analysed in our January 2026 Insight. The Code formally binds only its signatories, who benefit from facilitated demonstration of compliance; the Guidelines apply the same statutory quality criteria (effective, interoperable, robust, reliable) to every provider in scope. Non-signatories therefore face roughly the same engineering bill without the regulatory comfort that signatories receive.
Article 50(4) — Deepfakes and AI-generated public-interest text
Article 50(4) sits on the deployer side and contains two distinct labelling duties. Three observations frame what we believe matters most:
- First, the form of disclosure differs from Article 50(2). Where Article 50(2) requires a machine-readable mark detectable by tools, Article 50(4) requires a disclosure that is directly human-perceivable: a visible label, on-screen overlay, audio cue or analogous method adapted to the modality (paras. 110, 124). The audience must recognise the artificial origin without using any technical tool. The practical consequence for deployers is that an Article 50(2)-compliant watermark embedded upstream does not, on its own, discharge the Article 50(4) duty.
- Second, the deepfake test has four elements. Article 3(60) defines a deepfake as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful. The Guidelines unfold this into four elements (para. 107):
- appreciable resemblance,
- capable of existing in reality,
- persons, objects, places, entities or events, and
- false appearance of being authentic or truthful.
The first and third elements set the perimeter; elements (ii) and (iv) do the operative work and deserve to be highlighted:
The simulated subject must be capable of existing in reality (para. 107(ii)). The Guidelines draw a sharp line for creative agencies: a sphinx flying over the Eiffel Tower, dragons or elephants driving cars are outside the definition because they defy nature or biology, but a photorealistic portrait of an invented person, or a photorealistic synthetic celebrity, is inside, because such a person plausibly could exist. Working with fictional likenesses does not, on its own, take an advertiser out of the regime.
The “false appearance to a person to be authentic” criterion is judged against the actual composition of the audience, not a hypothetical average person; where the audience includes vulnerable groups like children, the threshold for deception falls accordingly (para. 108). No intent on the deployer’s part is required. The Guidelines do, however, provide breathing room at the edges: AI-supported colour correction, noise reduction, lighting adjustments, re-scaling or file compression will typically not turn the underlying content into a deepfake, although substantive AI editing of journalistic image content can (para. 109). For advertising workflows, the practical heuristic is: “stylised/impossible” or “minor technical adjustment” falls outside the regime; “photorealistic/plausible” or “substantive edit” falls inside.
- Third, the artistic exception softens the disclosure duty without removing it. For deepfakes forming part of evidently artistic, creative, satirical, fictional or analogous works or programmes, the disclosure may be made in an attenuated manner that does not hamper the display or enjoyment of the work. The Guidelines illustrate this with an unobtrusive label in the credits or loading screen rather than an immersion-breaking in-frame disclosure (paras. 111, 115). The exception is the natural release valve for the fictional-but-plausible category captured under element (ii) of the deepfake test above: a photorealistic invented character is squarely within the definition of a deepfake, but where it sits inside an evidently fictional work (a feature film, a series, a video game), the disclosure burden is materially lighter. Two points sharpen the contour:
- The work must “evidently” fall within one of the five categories: content that is ambiguous to the audience is excluded, and advertisements or documentaries qualify only where they serve a primarily informative rather than commercial purpose (para. 114).
- The carve-out attaches to the form of the disclosure, not to underlying rights: personality rights, IP and data protection continue to apply in full (Recital 134; para. 116). For gaming and entertainment clients, the carve-out is the natural home for synthetic talent and AI-generated characters in fictional contexts, but it softens the disclosure form, not the rights regime behind it.
The remaining limbs: interactive AI systems and biometric and emotion recognition
Article 50(1) and (3) do not lend themselves to the same depth of analysis as paragraphs (2) and (4), but each contains a clarification that warrants flagging.
- Article 50(1) – Interactive AI systems. Three points stand out. First, the Guidelines bring AI agents into scope with an operational default (para. 28): where a provider cannot reliably determine whether an agent will interact with a natural person, the agent must self-disclose “in every situation where it is likely that the agent may interact with a natural person.” Second, the obviousness exception is anchored in the UCPD’s average consumer standard, with a sensitivity layer for vulnerable groups (paras. 40–42). The burden shifts from “any reasonable user would understand” to the worst-case audience member the system is foreseeably reaching. For general-audience systems, and especially AI companions which the Guidelines call out by name, the exception is, in our view, largely closed. Third, the Guidelines deliver an unusually explicit negative catalogue (para. 35): disclosure in T&Cs, machine-readable signals alone, generic references to an “assistant”, and statements like “this system uses LLMs” all fail Article 50(1). Several are common practice today, which means the Guidelines require an active adjustment to existing disclosure designs, not merely their maintenance.
- Article 50(3) – Emotion recognition and biometric categorisation. Two points matter. First, although emotion recognition systems are almost always also high-risk under Annex III (or prohibited under Article 5(1)(f) in workplace and education settings), the Article 50(3) duty applies in addition and on its own terms. Second, and more easily missed, Article 50(3) covers all biometric categorisation systems, including those outside the high-risk classification (para. 98). Systems that infer age range, gender or ethnicity for advertising, store analytics or content adaptation, even where providers have screened them out of the high-risk catalogue, still owe an Article 50(3) notice when operating in the Union. For gaming and entertainment clients, affective and biometric features in interactive experiences trigger the deployer notice independently of any Article 5 or Chapter III analysis, and the disclosure should be addressed at the design stage.
Operational takeaways
On 7 May 2026, EU co-legislators agreed on a targeted grandfathering rule for Article 50(2): generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to comply (the Commission had originally proposed 2 February 2027). The relief is limited to Article 50(2); the other three transparency duties under Article 50(1), (3) and (4) continue to apply from 2 August 2026 without any transition. Only legacy systems benefit. Generative AI systems newly placed on the market after 2 August 2026 must comply from day one. The substantive compliance requirements are unchanged.
The Guidelines (para. 141) already reference the Omnibus measure one day before the political agreement was reached, which suggests close coordination between the Article 50 interpretive work and the Omnibus negotiations.
Fines under Article 50 reach up to EUR 15 million or 3 % of worldwide annual turnover (para. 140; EUR 750,000 for EU bodies). Article 50 therefore sits in the second-highest of the AI Act’s fine bands, which is sometimes overlooked in practice.
The consultation on the Guidelines closes on 3 June 2026; final adoption is expected before Article 50 takes effect on 2 August 2026.
For further information, please contact:
Oliver Belitz, Partner, Bird & Bird
oliver.belitz@twobirds.com
