knowledge 20 August 2026 |

AI Transparency: European Commission’s Guidelines on Article 50 – Part 2 (Deployer Obligations)

On 20 July 2026, the European Commission (the Commission) published its finalised, non-binding Guidelines on the transparency obligations under Article 50 (the Guidelines), which aim to reduce the risks of impersonation, deception, misinformation, manipulation and fraud arising from AI systems.

Part 1 in this series covers the Guidelines relating to the obligations on providers of AI systems under Articles 50(1) and 50(2).

This Part 2 briefing seeks to cover the obligations on deployers of AI systems under Articles 50(3) and 50(4), the general requirements for transparency disclosures under Article 50(5), and the related Code of Practice and enforcement regime. It also sets out some suggestions of what organisations navigating this regulatory landscape should do next to achieve compliance.

By way of reminder, a deployer is any organisation (or individual acting in a professional capacity) that uses an AI system in its own operations – the downstream operator rather than the developer. This includes businesses that purchase or license AI tools from third-party providers and then apply those tools in their day-to-day activities.

Obligations on Deployers of AI Systems

Article 50(3) –Biometric Categorisation and Emotion Recognition Systems

Article 50(3) requires deployers of emotion recognition and biometric categorisation systems to inform exposed natural persons of their operation, whether used in real time or ex-post.

No specific disclosure method is prescribed, provided disclosures are clear, distinguishable and accessible e.g. via written notice, icons, oral announcement, or a combination, depending on audience and context.

The obligation does not apply where the system is authorised by law to detect, prevent, investigate or prosecute criminal offences, subject to appropriate safeguards for third parties’ rights and freedoms.

Article 50(4) – Labelling of Deepfakes and Certain Text Publications

Article 50(4) requires deployers to clearly disclose deepfake content generated or manipulated using AI, and AI-generated or manipulated text on matters of public interest, unless an exception applies.

Deepfake disclosures must be clear and perceivable - machine-readable markings alone are insufficient - though a reduced disclosure regime applies to deepfakes forming part of evidently artistic, creative, satirical, fictional or analogous works, provided disclosure does not interfere with enjoyment of the work.

For AI-generated text on public-interest matters, an exception applies where the content has undergone genuine human review or editorial control and a person holds editorial responsibility for the publication.

Deployers are also exempted where the deepfake or text generation is authorised by law for law enforcement purposes.

General Requirements for Transparency Disclosures

All transparency obligations are subject to common requirements under Article 50(5) on the manner, timing and accessibility of disclosures. Notifications must be clear and distinguishable - noticeable, easy to understand and identifiable as separate from surrounding content - and provided at the latest at the point of first interaction (for interactive systems) or first exposure (for AI-generated content). Providers and deployers should separately assess whether their product, service or content is subject to accessibility requirements under other regimes, since Article 50(5) does not itself create additional accessibility requirements.

Code of Practice and Enforcement

The Commission has published a voluntary Code of Practice on Transparency of AI-Generated Content (the Code), addressing the Article 50(2), (4) and (5) obligations. The European Commission recently announced that about 190 organisations signed the Code ahead of the entry into application of the Article 50 legal obligations. Signing up to an adequate code does not itself prove compliance, but allows providers and deployers to rely on it to demonstrate compliance and may mitigate penalties. Non-signatories must otherwise demonstrate compliance through other adequate means.

Supervision and enforcement will be carried out by national market surveillance authorities, the AI Office and, where relevant, the European Data Protection Supervisor, each empowered to investigate on their own initiative or following a complaint.

Non-compliance with the transparency obligations under Article 50 may attract administrative fines of up to €15 million or, for undertakings, up to 3% of total worldwide annual turnover, whichever is higher. EU institutions, bodies and agencies face fines of up to €750,000; and SME/startup fines are capped at the lower of the relevant monetary threshold or percentage of turnover.

What Should Organisations Do Now?

The Guidelines provide welcome clarity on the practical application of Article 50 and signal the Commission’s intent to enforce these requirements seriously. With the 2 August 2026 deadline having passed, organisations should as a matter of priority:

• audit their current use of AI systems across the business to identify which systems fall within the scope of Article 50;
• assess whether existing disclosures and notices meet the requirements set out above, as expanded upon in the Guidelines;
• implement or update transparency notices for interactive AI systems, biometric categorisation and emotion recognition systems, and any AI-generated content; and
• consider whether signing up to the Code would be beneficial as a means of demonstrating compliance to regulators.

How Can McCann FitzGerald LLP Help?

For further information or assistance, please reach out to one of the key contacts below, or your usual contact at McCann FitzGerald LLP.

Also contributed to by Eva Keane.