Transparency obligations under Article 50 of the EU AI Act: What your business needs to know now

The most important facts at a glance

In this article, we explain which measures you need to implement as a company right now.

Depending on the case group, the obligations affect both AI providers and the companies that use AI systems (deployers). A structured audit of all AI applications in use in a business context is no longer optional for companies, but a regulatory obligation.

The regulatory background & why August 2026 is the turning point

The EU AI Act as a whole has already been in force since 1 August 2024, but the requirements are being phased in gradually. With the deadline of 2 August 2026, a critical phase has now entered into force: transparency obligations under Article 50 of the EU AI Act are becoming binding. This means that companies that have not documented their use of AI and implemented transparency mechanisms by then face a compliance risk.

The wording of the law is deliberately detailed, as there is no general labelling requirement for every use of AI. Instead, the legislator is focusing on four specific case groups where transparency is essential for the protection of citizens and consumers. This precision is both an opportunity and a challenge, as companies now need to understand exactly when the obligation applies and when it does not.

The transparency obligations from Art. 50 EU AI Act have been binding since 2 August 2026, with one exception: Generative AI systems that were already in use before this date may retroactively add the machine-readable marking by 2 December 2026. All other requirements, such as chatbot disclosure, deepfake labelling, and public texts, are due without a transitional period. Companies should therefore act promptly.

The four main categories of transparency obligations

Category 1 | Direct interaction with humans (provider obligation)

The first case group concerns AI systems that interact directly with natural persons. If an AI system conducts a direct conversation with a human, users must be informed by the providers that they are interacting with artificial intelligence. This particularly affects chatbots, voicebots, virtual assistants and AI avatars as well as automated dialogue systems.

Labelling is not required if it is obvious to a reasonably well-informed person that they are dealing with an AI. This could be the case, for example, with a virtual assistant designed clearly as such and not presented as human support.

For companies, this means: If you use a chatbot in customer service, it must proactively disclose that an automated system is replying, not just after several steps of exchange, but right from the very first interaction.

Avoid the following:

Category 2 | Synthetic content: text, image, audio, video (provider obligation)

The second category covers all AI systems that generate synthetic audio, image, video or text content. If a generative AI tool produces content, these outputs must be marked in a machine-readable format and be recognisable as artificially generated or manipulated. This is a much stricter requirement than just a visible label. It also demands technical traceability of origin.

This category affects practically every corporate department. Especially teams that use generative AI tools to generate product descriptions, AI-generated images, AI audio for videos or automated texts, for example.

Labelling must not only be carried out for external communication, but wherever synthetic content is generated and passed on. This also applies internally between departments.

Avoid the following:

Category 3 |  Deepfakes and realistic manipulated content (deployer obligation)

The third category relates to deepfakes. AI-generated or AI-manipulated image, audio or video content that appears realistic and makes a person, place, event or thing look authentic. If AI generates or manipulates such content, it must be disclosed by the deployer that the content has been artificially generated or manipulated.

This is a particularly critical category, as deepfakes carry significant potential for abuse. From fake video statements by prominent figures to manipulated news reports. Here, the legislator directly addresses the risk of disinformation.

Therefore, if your company produces training videos with AI avatars or creates personalised video messages with synthetic faces, you must label this clearly.

Avoid the following:

Category 4 | AI texts on matters of public interest

The fourth category concerns AI-generated or AI-manipulated texts published to inform the public on matters of public interest. This includes economic, political, social and scientific topics.

If the text has already been subjected to human editorial responsibility and review, the labelling requirement does not apply. A report written by AI that is fully reviewed and editorially accounted for by a journalist or editor does not need to be labelled across the board, provided this review is documented.

AI-generated market reports, industry analyses or press releases on economic policy issues must either be labelled or prove the exception through documented editorial review.

Avoid the following:

ADDITIONAL: Emotion recognition and biometric categorisation (deployer obligation)

In addition to the four main groups, affected individuals must also be informed by the deployers if AI is used for emotion recognition or biometric categorisation. This applies, for example, to AI systems in the application process that analyse facial expressions or security systems at the entrance that categorise people based on biometric features.

Timings and nature of transparency notices

The transparency notices must be provided clearly, unambiguously and recognisably at the latest at the time of the first interaction with the AI system or the first perception of the respective AI content. A mere mention in general terms of use is not sufficient. Visibility in the immediate context of use is required.

Depending on the scenario, the obligations affect providers of AI systems and/or deployers. Even if your company is not the developer of the model, as the deploying company you may be responsible for labelling and information, especially when publishing content and during user interactions. Timing is a core component of the legal requirement.

The shadow AI problem & why it represents a massive risk

One of the biggest untapped challenges for companies lies not in the regulation itself, but in the uncontrolled use of AI tools by employees. This phenomenon is often referred to as shadow AI. 

Employees use Anthropic's Claude, OpenAI's ChatGPT or other generative AI services via private accounts or even free versions without the company knowing about it, inventorying these tools or being able to implement labelling obligations at all.

The global KPMG study „Trust, attitudes and use of AI: A global study 2025“ (KPMG & University of Melbourne, 2025) showed that already in the previous year, 73 per cent of employees worldwide used generative AI at work, mostly via freely accessible tools.

For instance, marketing employees create copy using ChatGPT, Gemini or Claude, designers create mockups with Midjourney, and HR managers write job advertisements with AI assistance. All of this happens without central visibility or control. 48 to 49 % of respondents admitted to uploading sensitive corporate data into public AI systems, including financial figures, sales and customer data, or even copyrighted material (KPMG & University of Melbourne, 2025).

Why shadow AI is a significant compliance risk

For companies subject to Art. 50 AI Act obligations from 2 August 2026, shadow AI represents an existential compliance risk:

Lack of labelling: If an employee publishes AI-generated text, images or videos externally (e.g. on the company website, in social media or in customer communication) without the company's knowledge, the company potentially violates the transparency obligations under Art. 50 of the EU AI Act. The employee does so in ignorance, but the company bears the responsibility for content published under its name or from its channels. A lack of monitoring and insufficient governance can lead to fines.

No documentation: Without a central AI inventory, it is impossible to prove which content is AI-generated and which is not. In the event of an official audit, the company is left unable to demonstrate that it has met its obligations.

Uncontrolled data flow: Company data is transferred to external AI services without legally compliant data processing agreements being in place. This can result in additional fines.

No machine-readable marking: Private tools often offer no way to integrate the required technical notices of origin or metadata. Even if an employee adds „AI-generated", it is not machine-readable and does not fully meet the requirement.

Security risks: Confidential company information can end up in AI training data when employees input it into public AI models.

The underestimated risk of decentralised AI use

Without central governance, the following quickly arise:

The solution is centralisation instead of bans

A key protective mechanism against these risks is to offer employees simple, data-secure and, above all, legally compliant access to AI. Instead of banning tools and thereby driving shadow AI, the competitive advantage in the future will belong to companies that show their employees clear, secure paths forward.

NENNA.AI as a solution through "transparency by design"

NENNA.AI was designed from the ground up for the European regulatory framework, addressing the transparency requirements of Article 50 not as an afterthought but as an integral component of the platform architecture.

Specific advantages for Art. 50 EU AI Act compliance:

Traceability of the AI inventory: NENNA.AI protects over 300 AI models in the browser. In doing so, usage can be logged anonymously. An AI inventory can thus be created during ongoing operations without tedious manual maintenance. This supports compliance with the documentation obligation under Art. 50 of the EU AI Act without having to build a separate administrative infrastructure. A clear compliance advantage over fragmented tool landscapes.

Transparency logging as a basis for traceability: Interactions with AI models can be logged in NENNA.AI. This creates an important basis for audits by authorities and supports your auditability. This is not only a compliance requirement but also a signal of trust to customers and partners.

Control instead of shadow AI: Via a single, central platform, NENNA Chat, employees gain simple, data-secure access to all leading AI models. This reduces the incentive to resort to uncontrolled external tools. Sensitive data is masked and thus never even reaches the AI models. It remains encrypted within the German infrastructure and is not subject to the risk of uncontrolled disclosure. If external AI tools are still used by employees in the browser, NENNA Watch can help protect over 300 AI models in the browser. Depending on company preferences, models can be blocked company-wide or simply protected so that prompts and documents are anonymised before being sent to these tools.

Configurable output and labelling: NENNA.AI can assist companies in designing their outputs with transparency requirements in mind and reducing the manual effort for labelling. However, such an implementation requires specific configurations.

Made in Germany infrastructure: Legal compliance as a fundamental prerequisite: Data processing takes place encrypted, hosted exclusively under BSI C5 security standards on European servers from Exoscale in Frankfurt am Main. This is not just a compliance feature but a fundamental difference to US-based AI services. GDPR and EU AI Act compliance are built into NENNA.AI from the very beginning, not added later. Thus, no data transmissions to US servers or third countries without an adequate level of protection take place.

Multi-model approach with a uniform governance basis: Whether OpenAI, Claude, Llama, Deep Seek, Mistral or specialised domain models, all can be used with NENNA.AI under a uniform framework. This enables companies to maintain central governance for the use of various models and creates a basis for audit trails.

Transparency as a strategic trust & competitive advantage

Transparency under Art. 50 of the EU AI Act is not a bureaucratic burden but a central anchor of trust when dealing with AI. Those who implement the obligations in a structured way now gain legal certainty, strengthen customer and partner trust, and lay the foundation for deploying AI in a scalable way without reputational risk. The decisive factor is whether one of the legally specified cases applies.

This is precisely why a systematic approach to AI deployment is needed, integrated into daily workflows. A central protective mechanism is the use of a controlled, European AI platform that brings logging and the basis for governance „by design“. NENNA.AI was developed to meet this standard: Made in Germany infrastructure, GDPR and EU AI Act compliance, and 300+ models under a unified framework.

The solution lies in the centralisation and professionalisation of AI use. A platform like NENNA Chat and our browser extension NENNA Watch enable the prevention of shadow AI and central control, with an infrastructural basis that understands compliance not as a restriction but as a native feature of European AI usage.

Would you like to implement AI usage in your company quickly, in an auditable manner, and without the risk of shadow AI?

Contact our team for a non-binding consultation and a demo of our platform.