AI Act transparency obligations:
What companies need to implement

The AI Act transparency obligations in Article 50 have applied since 2 August 2026. Depending on their role and use case, companies may need to tell people that they are interacting with AI, add machine-readable marks to synthetic output, or visibly label deepfakes and certain public-interest text. The correct first step is therefore not a universal “AI-generated” badge. It is a defensible mapping of each system, output, company role and exposed audience.

This guide turns the Regulation, the Commission guidelines and the voluntary Code of Practice into a technical and editorial work plan for product owners, software teams and SMEs. It is practical orientation, not legal advice. Edge cases should be assessed against the actual system and the official material.

What the AI Act transparency obligations require since 2 August 2026

Article 50 of the EU AI Act contains several distinct transparency duties. The European Commission guidelines, updated 6 August 2026, distinguish direct AI interaction, machine-readable marking of synthetic content, emotion recognition and biometric categorisation, and disclosure of deepfakes and certain text publications.

A company may be a provider when it develops an AI system, or has one developed, and supplies it under its own name. A deployer is generally the organisation using the system under its authority for professional purposes.

Provider or deployer: the role determines the task

A procurement label does not settle the role. A business that integrates a third-party model into its own customer product may be the provider of the finished AI system. A company using an off-the-shelf tool for marketing, support or internal analysis is more likely to be a deployer. One organisation can hold both roles, and the assessment belongs at the level of the system function.

Use case	Typical role	Practical duty
Chatbot, agent or avatar interacting directly	Provider	Inform people clearly from the start of the first interaction, unless the AI interaction is obvious
System generates synthetic audio, image, video or text	Provider	Mark affected output in a machine-readable form using an effective, robust and, where feasible, interoperable method
Emotion recognition or biometric categorisation	Deployer	Inform exposed people about the system's operation and meet separate data-protection duties
Published deepfake	Deployer	Disclose the content clearly to people no later than their first exposure
AI text on a matter of public interest	Deployer	Label it clearly unless substantive human review, editorial control and editorial responsibility are present

This matrix is a starting point, not an automatic legal determination. The guidelines distinguish standard editing, machine-to-machine output and certain closed industrial development environments. Record any exclusion with the system version, output type, audience and reasoning.

Four transparency mechanisms that solve different problems

1. Interaction notice: a visible and accessible notice tells a person that they are communicating with AI. It belongs at the start of the first interaction, not only in terms or privacy copy. A support chatbot might place a plain statement above the input field and provide the equivalent announcement on a voice channel.

2. Machine-readable marking: this supports technical detection and travels with the output. Methods may include metadata, watermarking, provenance credentials or another robust technique. The method must be effective, interoperable, robust and reliable as far as technically feasible.

3. Visible or audible disclosure: deployers cannot rely only on embedded metadata for deepfakes. People must receive the disclosure without specialist tools—for example, through an intelligible audio announcement or a perceivable visual label.

4. Editorial evidence: for text on a matter of public interest, genuine human review can remove the specific labelling duty. The Commission FAQ, updated 24 July 2026, describes substantive review by people with relevant knowledge and professional judgement, together with editorial responsibility. Spell-checking or a purely formal approval is not enough.

A seven-step AI transparency implementation plan

1. Inventory AI functions. Record chatbots, agents, content generators, media editing, emotion recognition and biometric functions. Connect each item to its provider, model, version, audience and output channels.
2. Assign roles per function. Document who supplies the system under its own name and who uses it professionally. Assess the finished product, not only the underlying model.
3. Classify outputs. Separate direct interaction, synthetic media, deepfakes, public-interest text, standard editing and internal machine-only output. Keep uncertain cases explicit.
4. Build notices as product requirements. Define wording, location, timing, language and accessible alternatives. Test web, app, voice, export and embedded views separately.
5. Carry marks through the pipeline. Check whether conversion, compression, transcoding, the CMS, social publishing or download strips machine-readable information. Log the delivered artefact, not only the generated file.
6. Operationalise human review. Name qualified reviewers, substantive criteria, approval authority and the editorially responsible person. Retain the version, sources, material edits and approval decision.
7. Test evidence regularly. Sample real end channels. Confirm that notices remain perceivable, marks survive, and any exclusion still matches the current system behaviour.

This ATMAN implementation analysis connects legal roles to the points where transparency is often lost: interfaces, exports, media pipelines, approval and change management.

Technical requirements for product and web teams

Treat transparency as an end-to-end property. Provenance can disappear when an image is cropped, a video is transcoded or an asset leaves the CMS. Follow a representative output to the delivered artefact and retain its hash, version, marking method and test result.

Put interaction notices in the design system and test deep links, widgets and voice sessions. Visual-only labels exclude blind users; audio-only notices exclude deaf users. Connect the control to software architecture and release management, version each component, and require external vendors to explain which marks survive export.

Editorial control needs more than an approval button

“Human in the loop” is not enough by itself. A qualified person must examine claims, sources and conclusions, be able to change or reject the content, and hold responsibility for publication. A spelling check does not meet that threshold.

Retain the reviewed draft, sources, material edits, approver, time and final version. Teams integrating AI into operational workflows should plan this evidence alongside model and data changes.

Implementation checklist for September 2026

• Are all externally visible and internally operated AI functions recorded with an owner and version?
• Does each function state whether the company is provider, deployer or both?
• Do chatbot and agent notices appear accessibly from the start of the first interaction?
• Do machine-readable marks survive until the content actually delivered?
• Are deepfakes disclosed visibly or audibly no later than first exposure?
• Does public-interest text have demonstrable substantive review and editorial responsibility?
• Are exclusions recorded with their source, system version, reasoning and next review date?
• Is the 2 December marking deadline planned for systems supplied before 2 August?

Frequently asked questions about AI Act transparency obligations

Must every company chatbot be labelled as AI?

A provider must generally inform people clearly, from the start of the first direct interaction, that they are communicating with an AI system. The duty only falls away when this is obvious to a reasonably well-informed and observant person; the Commission guidelines interpret that exception narrowly.

Is a visible label enough for AI-generated content?

Not always. Providers of generative systems must generally mark affected outputs in a machine-readable form and make them detectable. Deployers must also give people a clear disclosure for certain deepfakes and text on matters of public interest.

Must human-reviewed AI text be labelled?

The specific labelling duty for text on matters of public interest does not apply when substantive human review or editorial control has taken place and a person or organisation holds editorial responsibility. Spell-checking or purely formal review is not sufficient.

Is there a grace period for existing AI systems?

Only a limited one. For systems placed on the market before 2 August 2026, only the machine-readable marking duty under Article 50(2) moves to 2 December 2026. The other transparency obligations have applied since 2 August 2026.

Sources and methodology

• European Union: Regulation (EU) 2024/1689 – Artificial Intelligence Act, particularly Article 50, published 12 July 2024, accessed 3 September 2026
• European Commission: Guidelines on transparency obligations for providers and deployers of certain AI systems, updated 6 August 2026, accessed 3 September 2026
• European Commission: Transparency obligations under Article 50 of the AI Act – questions and answers, updated 24 July 2026, accessed 3 September 2026
• European Commission: Code of Practice on Transparency of AI-generated Content, final code published 10 June 2026, page updated 31 July 2026, accessed 3 September 2026
• European Commission: Enforcement and new transparency requirements from 2 August, published 31 July 2026, accessed 3 September 2026

Legal statements were checked against the Regulation and current Commission material. The role matrix, implementation plan and priorities are ATMAN analysis based on those sources and are not legal advice.