AI labelling obligations since August 2026: what Article 50 actually requires

Do you use AI that is visible to the outside? WZ-IT reviews AI use, settles the role question and runs models on your own infrastructure, see AI solutions. Discuss your setup

Article 50 of the AI Act has applied since 2 August 2026. Coverage of it reduces to a single sentence: companies must label their chatbots and mark AI content.

That sentence is right on substance and wrong on attribution. Article 50 distributes its four obligations across two different roles, and most companies carry only part of them. Anyone skipping the role question builds notices they do not owe and misses the obligation that actually applies to them.

This article assigns the four paragraphs to their addressees, sets out the 2 December 2026 deadline, and covers the case that shifts the roles: the self-hosted model.

All details from the regulation text, as of 31 August 2026.

Table of contents

• The role question comes first
• The four paragraphs and their addressees
• Paragraph 1: the notice that it is a machine
• Paragraph 2: machine-readable marking
• Paragraph 4: what the deployer must disclose
• The 2 December 2026 deadline
• Self-hosted models shift the role
• What Article 50 does not regulate
• How we approach this at WZ-IT
• Further guides

The role question comes first

The AI Act knows two roles, and almost every obligation hangs on them.

A provider develops an AI system or has it developed and places it on the market or puts it into service under their own name or trademark.

A deployer uses an AI system under their own authority.

A company that buys a chatbot from a vendor and embeds it on its website is a deployer. A company that runs a language model in house and builds an assistant from it that it provides under its own name is a provider.

This distinction is not a technicality. It decides which of the four obligations in Article 50 apply at all.

The four paragraphs and their addressees

For a company that uses finished AI tools, paragraphs 3 and 4 are therefore the relevant ones. Paragraphs 1 and 2 are owed by the maker of the tool.

This is where the common summary "companies must label their chatbots" misleads. A purchased chatbot must arrive with the notice built in. Whoever deploys it should check that it does, but does not owe it themselves.

Paragraph 1: the notice that it is a machine

Paragraph 1 requires that AI systems intended to interact directly with natural persons are designed and developed so that the persons concerned are informed that they are interacting with an AI system.

Two points about this are regularly missed.

The notice must be built into the system. The wording targets design and development, not a line in the privacy policy.

The exemption is narrow. No notice is needed where this is obvious from the point of view of a reasonably well-informed, observant and circumspect person. For an assistant that answers in full sentences and follows up on questions, that exemption does not hold.

Under paragraph 5 the information must be provided at the latest at the time of the first interaction, in a clear and distinguishable manner, and must meet accessibility requirements. A notice that only appears after the third answer does not satisfy this.

The obligation applies regardless of whether the counterpart is a customer or an employee. An internal assistant falls under it.

Paragraph 2: machine-readable marking

Paragraph 2 requires providers of AI systems generating synthetic audio, image, video or text content to mark those outputs in a machine-readable format and make them detectable as artificially generated or manipulated. The obligation expressly includes general-purpose AI systems.

Exempt are assistive editing functions that do not substantially alter the input data. A spellchecker does not fall under this; a full rewrite does.

For image, audio and video the path is mapped out: embedded provenance data and watermarking are established methods.

For plain text there is no settled method. Watermarking text is a subject of research, but none of it is a standard an assessor could expect. That is an open point in the regulation, and it affects precisely the case that occurs most often in companies. Anyone wanting to be safe here documents traceably which content was machine-generated, rather than claiming a marking that does not technically hold.

Paragraph 4: what the deployer must disclose

Paragraph 4 addresses the deployer and has two parts.

Deepfakes. Anyone deploying an AI system that generates or manipulates image, audio or video content constituting a deepfake must disclose that the content has been artificially generated or manipulated.

Informative text. Anyone publishing AI-generated or manipulated text in order to inform the public on matters of public interest must disclose this.

The second part is often read too broadly. It targets content of public interest, not every text on a corporate website. A product description generally does not fall under it.

Two exemptions matter in practice:

• Artistic, creative, satirical or fictional works: here the obligation is limited to disclosing the existence of such content in an appropriate manner without hampering the display of the work.
• Editorial responsibility: content that has undergone human review or editorial control and for which a person holds editorial responsibility is exempt.

The second exemption is the workable route for most companies: review and take responsibility for AI drafts, rather than marking every paragraph.

The 2 December 2026 deadline

For systems already placed on the market or put into service before 2 August 2026, the machine-readable marking obligation under paragraph 2 applies only from 2 December 2026.

That grace period is not in the original regulation text. It came through the Digital Omnibus on AI, published in the Official Journal on 24 July 2026 and in force since 27 July 2026. Anyone consulting the 2024 text will not find it, and Article 111 on pre-existing systems does not cover it either.

Three points for context:

• The grace period applies only to paragraph 2, not to the other obligations. The notice under paragraph 1 and the disclosure under paragraph 4 have applied since 2 August 2026 with no transition.
• It applies only to pre-existing systems. A system going live after 2 August 2026 must bring the marking from the start.
• The same Omnibus postponed the high-risk obligations: Annex III to 2 December 2027, embedded systems under Annex I to 2 August 2028. We covered that separately.

Self-hosted models shift the role

Here lies the point missing from most accounts.

Anyone running a language model on their own infrastructure, for instance with vLLM or Ollama behind their own interface, and providing an application from it under their own name, is no longer merely a deployer. They are putting an AI system into service under their own name and thereby become a provider.

The consequence: paragraphs 1 and 2 are added.

This is not an argument against self-hosting. It is an argument for settling the role question before the architecture decision and building the paragraph 1 notice into the interface straight away, rather than retrofitting it later.

For environments where data must not leave the premises, the reasons for self-hosting outweigh this anyway. How that looks in practice we described for local AI in companies. What is added is traceable logging showing which model produced which output, see Langfuse.

What Article 50 does not regulate

Three boundaries that come up regularly in conversation:

Article 50 is not a permission. It governs transparency, not admissibility. Whether an AI deployment is lawful under data protection law is answered by the GDPR, not the AI Act.

Article 50 requires no certification. There is no notification, no registration and no conformity assessment for transparency obligations. Anyone claiming such an obligation is confusing it with the high-risk requirements.

Article 50 displaces nothing. Paragraph 6 makes clear that other transparency obligations under Union or national law continue to apply alongside.

How we approach this at WZ-IT

We start with an inventory rather than a measure: which AI systems run in house, which of them interact with people or generate content, and which role you hold for each.

That usually yields a short action plan. In the cases we have seen it comes down to a few places: a notice in the interface of a self-built assistant, documented editorial responsibility for AI-assisted text, and the question of which pre-existing systems need marking by 2 December.

Where models run on your own infrastructure, we set up logging so that it remains traceable later which model produced which output. Article 50 does not expressly require this, but it is the basis for any account you may have to give.

Further guides

• EU AI Act: high-risk obligations and what applies from August 2026 - the postponement through the Digital Omnibus
• Self-hosting Langfuse - logging for AI applications
• vLLM, Ollama or llama.cpp - inference servers for self-hosting
• Local AI or ChatGPT Business - cost and control compared
• AI solutions at WZ-IT - overview of the offering and approach

Unsure which role you hold? We review your AI use, assign each application to a role and set out what obligations follow. Book a call

Sources

• Article 50 of the AI Act: transparency obligations
• Article 113: entry into application
• Article 111 in the European Commission's AI Act Service Desk
• Digital Omnibus on AI: entry into force and amendments
• Analysis of the Omnibus changes to the deadlines