The EU's new rules on AI transparency came into effect on 2 August 2026. Transparency obligations for certain AI systems are outlined under Article 50 of the EU AI Act, requiring providers and deployers of AI systems operating in the EU to label certain AI-generated content and services that interact with humans.

The rules aim to help people recognise when they are interacting with AI or are exposed to AI-generated content, so that they can more clearly identify "misinformation or deception." For businesses, this represents a significant shift in how AI-powered products and services must be presented to users, and non-compliance carries material financial risk.

What are the transparency requirements?

In short, Article 50 of the EU AI Act sets out specific transparency obligations in the following situations:

• AI systems interacting directly with humans (chatbots and voice assistants): Users must be clearly informed when they are interacting with an AI system rather than a human. This applies to any AI system designed to interact with natural persons, including customer service chatbots, virtual assistants, and automated agents.
• General purpose AI systems (including those generating synthetic audio, image, video or text): Providers must ensure that AI outputs are marked in a machine-readable format and are detectable as artificially generated or manipulated. This does not apply to organisations authorised by law to detect, prevent, investigate or prosecute criminal offences. 
• AI-generated text: Deployers of AI systems that generate text published for the purposes of informing the public on matters of public interest must label that content as AI-generated. This obligation does not apply where the content has undergone meaningful human editorial review and oversight.
• Synthetic media (deepfakes): Deployers of AI systems that generate or manipulate image, audio, or video content in a way that could falsely appear authentic must disclose that the content has been fully or partially artificially generated or manipulated. This includes synthetic or manipulated depictions of real people.
• Emotion recognition and biometric categorisation: Providers and deployers of AI systems that identify or infer emotions, or categorise individuals based on biometric data, must inform individuals when these systems are being used on them.

Who is affected?

The transparency obligations may apply if: 

(a) your business is established within the EU; or 

(b) if your business is established outside of the EU, for example, in the UK, but your AI outputs are accessed or consumed by users located within the EU. 

This broad territorial scope reflects an effects-based approach to jurisdiction and means that just because you are not based in the EU, does not mean that the transparency obligations do not apply to you.  

Obligations differ depending on whether an organisation is acting as a provider (i.e. developing or placing an AI system on the market) or a deployer (i.e. using an AI system in the context of its own products, services, or operations). In practice, many organisations will be acting as deployers, even if they were not involved in developing the underlying AI system, for example, a business that has integrated a third-party generative AI tool into its customer-facing website. 

A practical example of a deployer is any retailer using AI to put together mock-ups of their product in practice (for instance fashion retailers using AI-generated models, technology retailers creating AI-generated images of products in use, food and drink businesses creating AI-generated images of their products served up on plates).  Where those images are used on a website accessible by individuals in the EU, it is likely that those images would be treated as “deepfakes” for the purposes of the EU AI Act.

The voluntary code of practice

The European AI Office has developed a non-binding Code of Practice on Transparency of AI-Generated Content (the Code), approved and published by the European Commission on 10 June 2026. Organisations operating in the EU may voluntarily adopt the Code of Practice as a framework for demonstrating adherence to Article 50 of the AI Act.

Adoption of the Code does not replace the need to comply with the binding legal obligations, but it does provide a structured compliance framework and a degree of regulatory comfort. Crucially, non-adoption does not exempt businesses from the underlying legal obligations: organisations that choose not to adopt the Code must still demonstrate compliance by alternative means. 

The Code also includes various approved icons that may be incorporated into AI-generated material to assist with labelling requirements. There is an option to label content that has been partially AI-generated, for example, where pre-existing, human-created content has been partially altered using AI. 

View the icons on the EU website

Consequences of non-compliance

Failure to comply with the Article 50 transparency obligations may result in:

• regulatory investigation and enforcement action by competent national authorities;
• remediation orders requiring corrective action;
• fines of up to €15 million or 3% of total global annual turnover (whichever is higher) for providers and deployers; and
• fines of up to €750,000 for EU institutions, bodies, and agencies.

Beyond the direct financial penalties, enforcement action, or simply negative press coverage arising from a lack of transparency, could cause significant reputational harm. Proactive compliance is therefore not only a legal imperative but also a sound business decision. 

Even outside the EU, one long term effect could be to influence what consumer regulators find to be “misleading” for the purposes of advertising legislation and codes of practice.

What can you do now? Practical steps for businesses

Given that the obligations are already in force, businesses should prioritise the following actions:

1. Conduct an AI systems audit

Map all AI systems currently in use across your organisation, including third-party tools integrated into your products, services, customer communications, or internal operations. For each system, assess whether it falls within the scope of Article 50 and which specific transparency obligations apply to you.

2. Identify whether you are a provider, deployer, or both

Determine your role in the AI supply chain for each system you use or offer. If you are a deployer, review the contractual arrangements with your AI providers to understand how compliance responsibilities are allocated between you, and whether your existing contracts provide adequate protections.

3. Implement disclosure mechanisms

Where disclosure is required, put in place clear and prominent notification mechanisms. These should be presented at the point of interaction, and not buried in terms and conditions. The EU AI Act also contemplates the use of machine-readable disclosures and the EU AI icon where applicable; businesses should consider implementing these alongside human-readable disclosures.

4. Review and update customer-facing terms and privacy notices

Your terms of service, privacy notices, and other customer-facing documentation should be reviewed and updated to reflect the new transparency requirements. In particular, ensure that any use of AI in customer interactions or AI-generated content is clearly disclosed in accessible language.

5. Update internal policies and contracts

Review and update supplier contracts, agency agreements, and internal AI governance policies to ensure they reflect the new obligations and appropriately allocate compliance responsibilities. Where third-party providers are generating content or operating systems on your behalf, contractual provisions should address who is responsible for ensuring Article 50 compliance.

6. Train your employees

Ensure that employees, contractors, and agencies who work with AI systems, or who manage content produced by AI, understand the new requirements and their practical implications. This is particularly important for marketing, customer service, and product teams who may be deploying AI tools on a day-to-day basis.

7. Consider adopting the Code 

Voluntary adoption of the Code signals a proactive and transparent approach to AI governance, and provides a structured framework for demonstrating compliance. Businesses should consider whether adoption is appropriate and, if so, begin the sign-up process.

8. Establish an ongoing monitoring process

AI transparency obligations are likely to evolve as the EU AI Act is implemented further and as guidance from the European AI Office develops. Businesses should put in place a process for monitoring regulatory developments and updating their compliance measures accordingly.

If this is something you would like to discuss further, we would be delighted to hear from you. Please do not hesitate to get in touch with our Data, privacy and cybersecurity team.