Does AI in an application need to be labelled?

01

What does Article 50 of the EU AI Act require?

Article 50 contains four transparency duties. Providers design AI systems for direct interaction so that people find out about it, and mark generated content in a machine-readable way. Deployers inform people about emotion recognition and biometric categorisation, and disclose deepfakes and certain published texts. The information must be given no later than the first interaction, clearly and accessibly.

Paragraph 5 governs form: the information must reach the people affected no later than the time of the first interaction or exposure, in a clear and unambiguous way and in an accessible format. Under Article 3(60), a deepfake is AI-generated or manipulated image, audio or video content that resembles real people, objects, places, entities or events and would falsely appear authentic.

Where labelling sits on the road from prototype to production is shown by From prototype to a production-ready application. The other rules for software, from product liability to NIS2, are covered by Who is liable when AI-generated code causes damage?

For context on the consequences: for breaches of Article 50, Article 99(4) sets fines of up to EUR 15 million or up to 3% of worldwide annual turnover, whichever is higher. For SMEs including start-ups, paragraph 6 applies the lower of the two, and paragraph 7 requires all the circumstances of the individual case to be taken into account.

02

Since when has the labelling duty applied?

Article 50 has applied since 2 August 2026. Regulation (EU) 2026/1744, in force since 27 July 2026, kept that date and added a transition period for the machine-readable marking under paragraph 2: providers whose systems were on the market before 2 August 2026 have until 2 December 2026 to comply.

Regulation (EU) 2026/1744 also recast paragraph 7: the Commission assesses whether compliance with codes of practice is sufficient to meet the duties under paragraphs 2 and 4. According to that regulation's recitals, such codes carry limited legal effect and do not establish a presumption of conformity.

03

When is a company a provider, and when a deployer?

Under Article 3(3), a provider is anyone who develops an AI system, or has one developed, and places it on the market or puts it into service under their own name. Under point 4, a deployer is anyone who uses an AI system under their own authority, except for personal, non-professional use. A company can hold both roles simultaneously.

One detail matters for small applications: under Article 3(11), putting into service also covers making an AI system available for own use. Anyone who develops an internal assistant themselves, or has it developed, and deploys it under their own name can therefore be the provider of that system while also using it as its deployer.

What remains open is at what point enough of a company's own work, added on top of using a third party's model through an interface, turns that into its own AI system within the meaning of the regulation, for example an interface with its own system instructions, its own document search and its own name. The regulation distinguishes providers of general-purpose AI models from providers of AI systems. Role changes on procurement and on modifying third-party systems are covered on Implementing the EU AI Act.

04

When can a small internal application be covered?

Article 50 contains no general exemption for internal or small applications; Article 2(10) excludes only the deployer duties of natural persons for purely personal, non-professional use. Whether an internal application can be covered depends on the trigger point of the relevant paragraph: direct interaction, generated content, or publication.

Article 2(8) excludes research, testing and development activity before placing on the market or putting into service. When an internal pilot with real users tips over into putting into service is a matter of interpretation. How a business unit's application is covered overall before approval is set out in The business unit built an app.

05

What does labelling look like in practice?

In the interface, it is a recognisable notice at first contact, for example at an assistant's input field, also readable by screen readers. For generated media, a machine-readable marking is added, such as provenance metadata or a watermark, and for deepfakes a visible disclosure. The Commission's code of practice describes methods for this and provides EU symbols.

Notice in the interface

Paragraph 5 requires the information no later than the first interaction. This can be implemented, for example, with a short sentence at the input field or in the first reply, a name that identifies the system as AI, and the same information as accessible text for assistive technology. A notice that appears only in the terms of use, as a rule, does not reach people at the moment of interaction.

Machine-readable marking of generated media

For providers, the code of practice names machine-readable marking, watermarks and metadata. Common technical building blocks are the IPTC Digital Source Type vocabulary, whose value trainedAlgorithmicMedia denotes media generated with a trained AI model, and the specification of the Coalition for Content Provenance and Authenticity (C2PA), which cryptographically binds provenance information to a file. Metadata can be lost during conversion or upload; paragraph 2 requires solutions that are, as far as technically feasible, effective, interoperable, robust and reliable.

Visible disclosure for deepfakes and texts

For deployers, the code of practice provides for visible labels, including EU symbols that the Commission supplies. For published texts, the exemption in paragraph 4 depends on two conditions at once: human review or editorial control, and a person who holds editorial responsibility.

06

Which questions belong in a conversation with legal counsel?

A first orientation on classifying an application under the whole regulation is given by the EU AI Act check. The path here stays with Article 50.

07

Which assumptions do not fit the wording?