EU AI Act Article 50 and Article 5: An Explainer on the Transparency and Prohibited-Practice Rules Already in Force

Key Takeaways

• Article 50 was not postponed. Its transparency duties have applied since 2 August 2026. The Digital Omnibus deferred the high-risk regime, not the transparency regime.
• Article 5 prohibitions have been enforceable since 2 February 2025, at up to EUR 35 million or 7% of global annual turnover.
• Article 50 breaches carry up to EUR 15 million or 3% of global annual turnover under Article 99(4).
• Two deadlines are still ahead, both on 2 December 2026: machine-readable marking for generative systems already on the market before 2 August 2026, and the new Article 5 prohibitions covering non-consensual intimate imagery and AI-generated CSAM.
• High-risk obligations now land on 2 December 2027 (Annex III) and 2 August 2028 (Annex I). That runway does not cover chatbots, synthetic media, emotion recognition, or deepfakes, which Article 50 governs regardless of risk tier.
• Article 50 splits duties between providers and deployers. Buying a third-party model does not move the deepfake or public-interest-text disclosure off the deploying company.

Two parts of the EU AI Act are enforceable against most enterprises today: the Article 5 prohibitions and the Article 50 transparency obligations. Much of what dominated 2025 planning cycles has moved.

The move was real, and it was legislated. The Digital Omnibus on AI was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, six days before the original high-risk deadline. Stand-alone high-risk systems under Annex III now have until 2 December 2027. High-risk AI embedded in products regulated under Annex I has until 2 August 2028.

Article 50 did not move, and it touches far more companies. It applies to any organization whose systems talk to people, generate synthetic content, infer emotion, or produce deepfakes, whatever risk tier those systems sit in. Data from the EU AI Act Compliance Checker puts transparency as the second most common compliance trigger after AI literacy, reaching around 33% of respondents. For companies with no Annex III exposure at all, Article 50 is the whole obligation set.

Preparedness lags the calendar. Littler’s European Employer Survey, completed by more than 400 HR executives, business leaders and in-house lawyers, found 18% of respondents considered their organization very prepared for the AI Act and 20% not at all prepared. The European Commission reports that around 190 organizations had signed the Code of Practice on Transparency of AI-Generated Content by the end of July 2026.

This article sets out what applies, to whom, and from when.

Timeline of Every EU AI Act Provision

Provision	What it covers	Applies from	Changed by the Omnibus?
Article 5 (original 8 prohibitions)	Manipulation, exploitation, social scoring, predictive policing by profiling, facial scraping, emotion inference at work and school, biometric categorization, real-time remote biometric ID	2 February 2025	No
Article 4 (AI literacy)	Training and awareness for staff operating AI	2 February 2025	Wording softened on 27 July 2026
Article 99 penalties, national market surveillance	Enforcement machinery	2 August 2025	No
Articles 53–55 (GPAI models)	General-purpose model provider duties	2 August 2025	No
Article 50(1), (3), (4), (5)	AI interaction disclosure, emotion and biometric notice, deepfake and public-interest text labelling, manner and timing	2 August 2026	No
Article 50(2), new systems	Machine-readable marking of synthetic output	2 August 2026	No
Article 50(2), legacy systems	Same duty for generative systems on the market before 2 August 2026	2 December 2026	Yes, grandfathering added
Article 5, two new prohibitions	Non-consensual intimate imagery and AI-generated CSAM	2 December 2026	Yes, newly added
Annex III high-risk obligations	Risk management, documentation, logging, human oversight, conformity assessment, registration	2 December 2027	Yes, deferred from 2 August 2026
Annex I high-risk obligations	Same duties for product-embedded AI	2 August 2028	Yes, deferred
Member State regulatory sandboxes	At least one operational sandbox per Member State	2 August 2027	Yes, deferred by a year

What Are the Main Prohibited Practices Under the EU AI Act?

Article 5 bans placing on the market, putting into service, or using AI for practices the legislature treated as incompatible with fundamental rights. There is no conformity assessment route and no mitigation that makes a prohibited system lawful. The only compliant position is not running it.

The eight original prohibitions, enforceable since 2 February 2025:

1. Subliminal, purposefully manipulative or deceptive techniques that materially distort behavior and cause or are likely to cause significant harm. The Commission’s guidelines on prohibited practices confirm that lawful advertising is not caught by itself.
2. Exploitation of vulnerabilities tied to age, disability or a specific social or economic situation, where behavior is distorted, and significant harm is likely.
3. Social scoring: evaluating people over time from social behavior or inferred characteristics, where the score produces treatment unrelated to the original context or disproportionate to the behavior.
4. Individual criminal-offence risk prediction based solely on profiling or personality traits. Systems supporting a human assessment grounded in objective facts linked to criminal activity remain permitted.
5. Untargeted scraping of facial images from the internet or CCTV to build or expand facial recognition databases.
6. Emotion inference in workplaces and educational institutions, with narrow carve-outs for medical or safety purposes.
7. Biometric categorization inferring race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. Labelling or filtering lawfully acquired biometric datasets is not covered.
8. Real-time remote biometric identification in publicly accessible spaces for law enforcement, subject to narrow exceptions that require prior authorization.

The Omnibus added two more from 2 December 2026: AI systems that generate non-consensual sexually explicit or intimate content of identifiable people, and systems that generate child sexual abuse material within the meaning of Directive 2011/93/EU. Both have to name providers and deployers.

Three details drive most of the risk. The prohibitions are extraterritorial, so a company incorporated outside the EU is in scope when its system is used in the EU or its output affects people there. Prohibition 8 binds law enforcement actors, while prohibitions 1 through 7 bind anyone. And terms of service forbidding a prohibited use do not settle the question of whether the system’s normal operation produces that outcome anyway.

How Does Article 50 of the EU AI Act Impact AI Developers and Deployers?

Article 50 sets four substantive duties. Paragraphs 1 and 2 fall on providers at design time. Paragraphs 3 and 4 fall on deployers at use time. Paragraph 5 governs delivery, and paragraph 6 confirms that none of this displaces Chapter III.

Article 50(1): Disclosure of AI Interaction

Providers must design systems that interact directly with people so that people are informed they are dealing with an AI system. 

The duty falls away where the AI is obvious to a reasonably well-informed, observant and circumspect person in the circumstances of use. A second exemption covers systems authorized by law to detect, prevent, investigate or prosecute criminal offences, unless the system is available for the public to report a crime. The “obvious” carve-out is narrower than product teams assume, and the final Guidelines added specific expectations for AI agents.

Article 50(2): Machine-Readable Marking of Synthetic Content

Providers of systems generating synthetic audio, image, video or text, including general-purpose AI systems, must mark outputs in a machine-readable format so they are detectable as artificially generated or manipulated. Solutions must be effective, interoperable, robust and reliable as far as technically feasible, judged against implementation cost and the state of the art. 

Two exemptions apply: systems performing an assistive function for standard editing that do not substantially alter the deployer’s input data or its semantics, and uses authorized by law for criminal-offence purposes. Systems on the market before 2 August 2026 have until 2 December 2026. Content generated before 2 August 2026 needs no retroactive marking.

Article 50(3): Emotion Recognition and Biometric Categorization Notice

Deployers must inform the people exposed to the system that it is operating, and process personal data under the GDPR and its law-enforcement counterpart. Biometric categorization that is ancillary to another commercial service and strictly necessary for objective technical reasons sits outside the duty, as does use permitted by law to detect, prevent or investigate criminal offences. Note the interaction with Article 5: emotion inference at work or in schools is banned outright, so paragraph 3 governs only the permitted contexts that remain.

Article 50(4): Deepfakes and Public-Interest Text

Deployers generating or manipulating image, audio or video content that constitutes a deepfake must disclose that it is artificially generated or manipulated. Where the content is part of an evidently artistic, creative, satirical or fictional work, the duty narrows to disclosure that does not spoil the work. Deployers publishing AI-generated or manipulated text to inform the public on matters of public interest must disclose that too, unless the text went through human review with a named person or entity holding editorial responsibility. The Commission reads “public interest” broadly and the editorial exemption narrowly.

Article 50(5): Manner and Timing

Information must reach people clearly and distinguishably, at the latest at first interaction or exposure, and must meet applicable accessibility requirements. A disclosure buried in terms of service does not satisfy this.

Two instruments now carry the interpretive weight. The Commission published its final Guidelines on Article 50 on 20 July 2026, and national market surveillance authorities use them as the reference point. On 8 and 9 July 2026, the Commission and the AI Board confirmed the Code of Practice as adequate for implementing Articles 50(2), (4) and (5). Signing is voluntary and is not a guarantee of compliance, though the Commission has said non-signatories may face more information requests about their marking and labelling practices.

Provider versus Deployer: Who Owes What

Duty	Provider	Deployer
Tell people they are interacting with an AI system, Art. 50(1)	Yes, by design	Inherits the provider’s implementation; verify it is present and visible
Mark synthetic output machine-readably, Art. 50(2)	Yes	No, but check the marking survives your pipeline
Notify people exposed to emotion recognition or biometric categorization, Art. 50(3)	No	Yes
Disclose deepfakes, Art. 50(4)	No	Yes
Label public-interest AI text, Art. 50(4)	No	Yes, unless human editorial responsibility applies
Deliver disclosure clearly and at first exposure, Art. 50(5)	Yes	Yes

For example, a marketing team using a third-party video generator is a deployer. The vendor marks the file; the team still owes the deepfake disclosure. Contracts should allocate these responsibilities explicitly, because the Act does not.

Penalty Exposure

Tier	Trigger	Maximum Penalty
Article 99(3)	Breach of Article 5 prohibitions	EUR 35 million or 7% of total worldwide annual turnover, whichever is higher
Article 99(4)	Breach of most other obligations, including Article 50	EUR 15 million or 3% of total worldwide annual turnover, whichever is higher
Article 99(5)	Incorrect, incomplete or misleading information to authorities	EUR 7.5 million or 1% of total worldwide annual turnover

For SMEs and start-ups, the lower of the fixed sum and the percentage applies. 

Article 99(8) prevents double punishment for the same conduct under both the AI Act and the GDPR. 

Member States set and notify their own penalty rules, so the national regime where you operate matters alongside the Regulation.

What Should Companies Do to Ensure Compliance with the EU AI Act?

Here is an enterprise EU AI Act compliance checklist that fits inside one quarter:

1. Inventory every AI system and classify it against Article 5 first. Prohibited use is a stop-work finding, not a remediation item.
2. Record provider or deployer status per system. The same company is often both, on different systems, and this field determines which Article 50 paragraphs apply.
3. Audit every user-facing interface for the Article 50(1) disclosure, including voice assistants, agents, and embedded widgets.
4. Confirm machine-readable marking with each generative vendor in writing, then test that the marking survives your own processing, format conversion, and CDN delivery.
5. Tag legacy versus new generative systems. Anything on the market before 2 August 2026 must meet Article 50(2) by 2 December 2026.
6. Map where AI text is published on matters of public interest and document the human editorial review supporting the exemption. Name the accountable person.
7. Decide on the Code of Practice. Sign it, or run a documented gap analysis against its commitments and keep that analysis current.
8. Set the evidence standard now. For each disclosure, be able to show what was displayed, to whom, and from when. Screenshots gathered during an inquiry are weaker than logs generated continuously.
9. Refresh AI literacy records under the amended Article 4. The duty is now to take measures supporting AI literacy rather than to guarantee a level, and national authorities gained inspection powers on 2 August 2026.
10. Use the December 2027 runway for high-risk work deliberately. The Omnibus lightened the calendar, not the requirements.

How Lumenova AI Helps With Your EU AI Act Compliance

Most of the cost in this work is not the control itself. It is the interpretation, the tracking, and the evidence.

Lumenova AI ships pre-built EU AI Act compliance modules that map Article 5 and Article 50 to concrete, testable controls, so teams stop rebuilding a reading of the Regulation for every new feature. Its centralized governance workflow holds classification, provider or deployer status, vendor attestations, and disclosure decisions in one system of record instead of scattered spreadsheets and email threads. Continuous observability generates the disclosure and documentation evidence market surveillance authorities ask for, on an ongoing basis rather than during a scramble.

The outcome compliance officers care about: shipping generative features without a fresh legal review each time, and answering an authority’s information request from records that already exist.

Conclusion

Article 5 has been enforceable since February 2025 at up to EUR 35 million or 7% of turnover. Article 50 has been enforceable since 2 August 2026 at up to EUR 15 million or 3%. Legacy generative systems have until 2 December 2026 to meet the marking duty, and the nudification and CSAM prohibitions start the same day. High-risk obligations arrive on 2 December 2027 for Annex III and 2 August 2028 for Annex I.

If your product ships a chatbot, a generative feature, or published AI-assisted content into the EU, the question is not what to prepare for. It is what evidence you can produce this week.

Book a discovery call with a Lumenova AI EU AI Act expert and walk through your Article 5 and Article 50 exposure system by system, ending with a mapped set of controls and an evidence plan.

EU AI Act Change Log

Date	Change
8 September 2026	Page published. Reflects Regulation (EU) 2026/1744 (in force 27 July 2026), the Commission’s final Article 50 Guidelines (20 July 2026), and the Code of Practice adequacy confirmations (8 and 9 July 2026).

Frequently Asked Questions

---

Related topics: EU AI Act