If you ship an AI feature that people in the EU can use, the main transparency rules come from Article 50 of the EU AI Act. Users must be told when they are talking to an AI system. Synthetic text, images, audio and video must be marked so machines can detect them. Deepfakes and certain AI-written public-interest text must be disclosed. These rules reach US companies too, because they follow where the output is used, not where you are incorporated.
I'm Hanad Kubat, a senior software engineer in Vienna. I build AI features for SaaS companies at a fixed price, and transparency is one of the first things I check in any AI audit. This guide explains the rules in plain words and then shows what they mean in your product.
Key Takeaways
- Article 50 covers four situations: AI that talks to people, AI that generates content, emotion recognition and biometric categorization, and deepfakes or AI-written text on matters of public interest.
- The rules apply to providers and deployers, including those outside the EU, when the output is used in the EU.
- The disclosure must come at the latest at first interaction or exposure, and it must be clear and easy to find.
- Generative systems already on the market before 2 August 2026 have a grace period for the marking duty until 2 December 2026.
- In engineering terms, this is a small amount of work if you plan it at design time, and an annoying rebuild if you bolt it on later.
Table of Contents
- What "transparency" means, and what the law actually requires
- Who has to comply: providers and deployers
- The four duties in Article 50
- Exceptions you can plan around
- What to build: a practical checklist
- Perspective: why I treat this as a design decision
- When to get help
- FAQ
- Sources
What "transparency" means, and what the law actually requires
In the research literature, transparency means giving stakeholders information about an AI system across its whole life cycle and ecosystem, so they can assess it for their own needs. Academic work on transparency of AI systems frames it as a prerequisite for trust. That is the broad, responsible-AI meaning.
It is also different from explainability. Transparency concerns information about the system as a whole, while explainability clarifies the reasons behind a specific output or decision. A model card or a public description of your system is transparency. An explanation of why one loan application was rejected is explainability.
The AI Act's legal duties are narrower and more concrete. Article 50 does not ask you to publish everything about your model. It asks you to make specific facts visible to specific people at a specific moment: this is an AI, this content is synthetic, this system is analyzing your emotions. When people search for "AI transparency requirements" in a compliance context, this is almost always what they need.
Other duties, such as documentation for high-risk systems and the AI literacy obligation, sit elsewhere in the Act. I cover the wider picture in a practical EU AI Act compliance checklist for founders. This article stays on Article 50.
Who has to comply: providers and deployers
The Act splits responsibility between two roles, and you may be both.
Providers are people or organizations that develop an AI system, or have one developed, and place it on the EU market or put it into service under their own name or trademark. The Commission's guidelines on Article 50 use this definition. If you build a SaaS product with an AI feature and sell it under your brand, you are a provider, even if the model underneath comes from someone else.
Deployers use an AI system under their own authority in a professional setting. Purely personal, non-professional use is excluded, according to the European Commission's FAQ on Article 50. The same guidelines say deployers are responsible for the decisions and manner of use, whether or not they control the technical operation. A law firm that puts a vendor's chatbot on its website is a deployer. So is a marketing team that publishes AI-generated images.
The practical split is this: providers mostly handle what is built into the product (the disclosure mechanism and the marking of outputs). Deployers mostly handle how the output is used (labeling a deepfake, disclosing AI-written news-style text). If you are a founder reselling a model through your own interface, expect to carry both.
Do the rules apply to a US company?
Yes, if your output reaches the EU. The Commission's FAQ states that providers are covered whether they are established in the EU or in a third country, as long as the system's output is used in the Union. Deployers are covered when they foresee dissemination in the EU; the guidelines say this does not extend to cases where content reaches EU audiences unforeseeably or beyond the deployer's control.
So a US startup with European customers, a German-language landing page, or EU pricing in euros has foreseen EU use. A US-only tool that someone in Lyon happens to open is a different case. If you are unsure which side you fall on, that is a question for counsel, and the answer should be written down.
There is no single US federal statute that mirrors Article 50, and some US states have started to pass their own disclosure and provenance laws. Those rules differ by state and change quickly, so check your state's official legislature pages before you assume the EU rules are the only ones you face.
The four duties in Article 50
1. Tell people they are talking to an AI
Providers must design AI systems that interact directly with people so those people are informed they are dealing with AI. The exception is when it is obvious to a reasonably well-informed, observant and circumspect person in context. This is the wording on the official AI Act Service Desk page for Article 50.
The timing matters. The information must be given at the latest at the first interaction or exposure, and in a clear, distinguishable and accessible way. A line buried in your terms of service does not meet that bar.
What this means in a product:
- A support chatbot needs a visible label or opening message such as "You're chatting with an AI assistant."
- A voice agent needs to say so in the first seconds of the call, since there is no screen to carry a badge.
- A product where AI is the obvious point (a text-to-image generator, say) may fall under the "obvious" exception, but I would not rely on it for anything that mimics a human conversation.
2. Mark synthetic output so machines can detect it
Providers of systems that generate synthetic audio, images, video or text must ensure the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. The solutions should be effective, interoperable, robust and reliable as far as technically feasible, according to the Article 50 text.
Compliance can be shown by following the EU Code of Practice on Transparency of AI-generated Content, or by equivalently adequate means, as set out on the Commission's guidelines page. Metadata, watermarks and fingerprinting are the usual building blocks. If your product is built on a third-party model API, check whether the model vendor already marks its outputs, and whether your own post-processing (resizing, re-encoding, copying text into a template) strips that marking.
For background on what counts as machine-generated material and why marking it matters beyond compliance, see this explainer on AI-generated content and SEO.
There is a timing detail worth knowing. Under the Commission's FAQ, providers of generative AI systems placed on the market before 2 August 2026 have a grace period until 2 December 2026 to meet the marking and detection requirements of Article 50(2). Systems placed on the market after that date do not get it. Check the Commission's page for the current position before you plan around that date.
3. Disclose emotion recognition and biometric categorization
Deployers of emotion-recognition or biometric-categorization systems must inform the people exposed to them, per the Article 50 text. If your product reads sentiment from faces or voices in a call-center tool or a hiring flow, the disclosure to the person being analyzed is on you or your customer, and your product should make it easy to deliver. Note that these systems can also fall under stricter rules elsewhere in the Act, and under GDPR, so transparency is the floor and not the whole job.
4. Label deepfakes and AI-written public-interest text
Deployers who generate or manipulate a deepfake must disclose that the content is artificially generated or manipulated. Text that is published to inform the public on matters of public interest must also be disclosed as AI-generated, unless it went through human review or editorial control and someone holds editorial responsibility. That is the position in the Article 50 text.
For content spread through distribution chains, the Commission's guidelines say deployers should take proportionate measures so that labels are clear and distinguishable at first exposure. A label that appears only after a user clicks "more" is a weak fit for that wording.
Exceptions you can plan around
The Act carves out a few cases, again per Article 50:
- Systems authorized by law for detecting, preventing, investigating or prosecuting criminal offences.
- AI that performs an assistive function for standard editing, or that does not substantially alter the input data.
- Deepfakes that are evidently artistic, creative, satirical or fictional, where the disclosure can be limited to an appropriate form that does not spoil the work.
- AI-generated public-interest text that has gone through human review or editorial control with a named responsible party.
The editorial-control exception is the one founders ask me about most. It is real, but it is not a loophole for "someone glanced at it." If you rely on it, keep a record of who reviewed what, and make sure the review can actually change the output.
What to build: a practical checklist
Here is how I translate the legal text into engineering tasks. Most of it is small if done early.
| Situation | What the product needs | Where it lives |
|---|---|---|
| Chatbot or voice agent | AI disclosure at first contact, visible and persistent | UI copy, first message, call script |
| Generated images, audio, video | Machine-readable marking on every output | Generation pipeline, export step |
| Generated text delivered as files or API output | Marking where technically feasible, plus clear labeling to users | API response metadata, document properties |
| Emotion or biometric analysis | Notice to the person being analyzed, at first exposure | Onboarding flow, consent screen |
| Deepfake or public-interest text | Label next to the content, plus an editorial-review record if you use the exception | Publishing flow, audit log |
A few habits make this durable:
- Centralize the disclosure. One component or one system prompt template carries the AI notice, so you do not forget it on the third screen that embeds the chat.
- Mark at the last step. Put marking at the point where output leaves your system, so later transformations do not strip it.
- Log what you show. Keep a record of which disclosure version a user saw and when. If anyone asks, you can prove it.
- Write the "obvious" judgment down. If you decide a disclosure is unnecessary because AI use is obvious in context, record why.
- Test with a stranger. Show the screen to someone who does not know your product for five seconds. If they cannot say it is AI, the disclosure is not clear and distinguishable.
Transparency also connects to other parts of a safe AI feature. Personal data in prompts raises GDPR questions, which I cover in GDPR for AI and in a guide to keeping raw PII out of prompts. If you need to document risks formally, the AI DPIA template gives you fields to copy. And a system that tells users it is AI should also be reliable, which is where reducing hallucinations in production and evaluation metrics come in.
Perspective: why I treat this as a design decision
Most founders meet transparency as a compliance ticket, usually after a customer's procurement team sends a questionnaire. By then the chat widget is in six places, the model output is post-processed by three different functions, and nobody knows which one drops the metadata.
I build these features end to end myself, at a fixed price, in two to four weeks, and I put the disclosure and the marking into the first version. It costs a few hours at the start and days at the end. You also own the code from the first commit, so your lawyer or your next developer can read exactly where the notice is shown and where the marking happens.
I also keep the stack deliberately boring (TypeScript, Next.js, Node, Cloudflare Workers) so a future engineer can pick it up and adjust the disclosure when the rules or the guidance change. If an off-the-shelf tool already meets your need, I will tell you so. Transparency done well is a trust feature your enterprise buyers will notice, and not only a legal cost.
Hanad Kubat
When to get help
If you have a working AI feature and are unsure what Article 50 means for it, a short audit is the cheapest first step. My fixed-price Prototype Audit is €1,500, takes 3 to 5 days, and is credited against the build if you continue. For a new AI feature or an MVP, builds start from €12,000 at a fixed price and fixed scope. The price holds because there is no agency overhead, no project-manager layer and no offshore markup: you work with the one engineer who writes the code. See what I build and how to book.
If you want to self-assess first, the AI audit checklist is a good start, and the phased rollout plan shows where transparency checks fit before launch. For the guardrails around it, see five AI guardrails for SaaS founders.
FAQ
Does the EU AI Act transparency requirement apply to my US-based company?
It can. Providers outside the EU are covered when their system's output is used in the Union, and deployers are covered when they foresee distribution there. If you sell to or market in the EU, plan as if you are in scope, and confirm with a lawyer who knows the Act.
When exactly must I tell users they are interacting with AI?
At the latest at the first interaction or exposure, in a clear, distinguishable and accessible way. The only exception is where it is obvious to a reasonably well-informed person in context. A visible label in the first message or screen is the safe pattern.
What is the difference between AI transparency and explainability?
Transparency is information about the AI system as a whole, including how it is built and used. Explainability clarifies the reasons behind one specific output or decision. The AI Act's Article 50 duties are about transparency toward people, not about explaining individual outputs.
Do I have to watermark AI-generated text?
Providers must mark synthetic outputs in a machine-readable way as far as technically feasible, and text is among the content types covered. Separately, deployers must disclose AI-written text published to inform the public on matters of public interest, unless it had human review or editorial control. Follow the Commission's code of practice or an equivalent method to show compliance.
Sources
- Article 50: Transparency obligations for providers and deployers, AI Act Service Desk
- Transparency obligations under Article 50 of the AI Act, European Commission FAQ
- Guidelines on transparency obligations for providers and deployers, European Commission
- Commission guidelines C(2026) 5054 final, 20 July 2026
- Transparency of AI Systems, Dagstuhl OASIcs 2024
- Transparency for AI systems: a value-based approach, Springer 2024
- What Is AI-Generated Content and Its SEO Impact