AI Act Article 50 for apps and chatbots: disclosure and AI-image marking

This article is technical guidance, not legal advice. Whether and how Article 50 applies to your product is a question for your legal adviser.

Since 2 August 2026, the transparency rules in Article 50 of the EU AI Act apply. For most software teams they come down to two engineering tasks: telling people when they are talking to an AI, and marking AI-generated content so that machines can recognise it. This article covers what the text asks for, the dates that matter, and how we approach both tasks in web and mobile applications.

What Article 50 requires

The quotes below come from the text of Article 50 as published on the European Commission's AI Act Service Desk (the original regulation is on EUR-Lex).

• Paragraph 1, chatbots and other interactive systems (providers): AI systems "intended to interact directly with natural persons" must be designed so that people "are informed that they are interacting with an AI system", unless this is obvious to a person who is "reasonably well-informed, observant and circumspect", given the context.
• Paragraph 2, generated content (providers): providers of AI systems that generate "synthetic audio, image, video or text content" must ensure the outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated". The solutions must be "effective, interoperable, robust and reliable as far as this is technically feasible". There is an exception for systems that perform "an assistive function for standard editing" or do not substantially alter the input.
• Paragraph 4, deep fakes and public-interest text (deployers): deployers must disclose deep fakes, and must disclose AI-generated text published "with the purpose of informing the public on matters of public interest", unless it has undergone human review or editorial control and someone holds editorial responsibility.
• Paragraph 5, how to inform: the information must be given "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure" and "shall conform to the applicable accessibility requirements".

Paragraph 3 covers emotion recognition and biometric categorisation, which is outside the scope of this article. Whether your company is the provider or the deployer of a given system (for example, a chatbot built on a third-party model) is defined in Article 3 and is the first thing to settle with your adviser, because it decides which paragraphs are yours.

The dates that matter

• 2 August 2026: the regulation applies from this date, with the exceptions listed in Article 113. Article 50 is not among those exceptions, so the transparency rules apply from this date.
• 2 December 2026: the Digital Omnibus on AI added a transition to Article 111: providers of AI systems that generate synthetic audio, image, video or text and "have been placed on the market before 2 August 2026" must comply with Article 50(2) "by 2 December 2026". The Commission's AI Act Service Desk FAQ describes the same timeline.
• Content made earlier: according to the Commission's FAQ on the Code of Practice, outputs generated and made available before 2 August 2026 "do not need to be marked or labelled retroactively".

Two supporting documents are worth knowing. On 10 June 2026 the Commission published the final Code of Practice on marking and labelling of AI-generated content, a voluntary code with one section for providers (machine-readable marking and detection) and one for deployers (labelling). The Code's page also mentions a set of EU icons that deployers may use to label AI-generated content, and says a draft of the Commission's guidelines on Article 50 was published on 8 May 2026 for consultation.

Chatbot disclosure in practice

For a chatbot or AI assistant inside a website or app, the work is usually small but has to be done carefully:

• Say it before or in the first exchange. Show a persistent label near the chat input, and let the first assistant message state it as well. The assistant on ruicodex.com, for example, opens with "Hello! I am the Rui Codex AI Assistant."
• Do not rely on the "obvious" exception. A robot avatar or a product name is not the same as a clear statement, and the exception depends on context.
• Make it accessible. Paragraph 5 refers to accessibility requirements, so the disclosure should be real text that screen readers announce, with enough contrast, not only an icon or a colour.
• Cover every channel. If the same assistant answers in a widget, a mobile app and a messaging channel, each one needs its own disclosure. A voice assistant should say it at the start of the conversation.
• Handle handovers. If a human agent can take over, show when the conversation switches between the AI and a person.

A minimal example of the markup (illustrative):

<div class="chat-header">
  <span class="chat-ai-badge">AI assistant</span>
  <p class="chat-disclosure">
    You are chatting with an AI system, not a person.
    Answers can contain mistakes.
  </p>
</div>

Marking AI-generated images

Article 50(2) asks for machine-readable marking. In practice we combine layers, because each one can fail on its own:

1. IPTC metadata. The IPTC Digital Source Type vocabulary defines trainedAlgorithmicMedia ("Created using Generative AI") and compositeWithTrainedAlgorithmicMedia ("Edited using Generative AI"). The value is written to the XMP field Iptc4xmpExt:DigitalSourceType; with ExifTool that is a single command:

   exiftool -XMP-iptcExt:DigitalSourceType="http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia" generated.png

2. C2PA Content Credentials. A C2PA manifest is a signed record of how the file was made, and it can carry the same IPTC source type. The open-source c2patool command line tool and the c2pa-rs SDK can add one:

   c2patool generated.jpg -c '{"assertions":[]}' --create trainedAlgorithmicMedia -o generated-signed.jpg

   Signing requires a certificate. The c2patool documentation states that private keys in settings files are for development and testing only, and recommends a subprocess signer or a remote signing service in production.
3. Watermarking. Metadata is easily lost: image resizing, CDNs and upload pipelines on social platforms often strip it. Since the text asks for solutions that are "robust and reliable" as far as technically feasible, evaluate an invisible watermark as an additional layer. If you generate images through a third-party model API, check what the provider already embeds, and make sure your own post-processing does not remove it.
4. A visible label where people need it. Machine-readable marking is for software. Where deep fakes or public-interest text are involved, paragraph 4 requires disclosure to people, and the EU icons mentioned above are one option.

Whatever you choose, test the full path: generate an image, run it through your real upload, resize and delivery pipeline, download the final file, and check that the metadata and manifest are still there.

A short checklist

1. List every feature that talks to users through AI or generates audio, images, video or text.
2. For each one, settle with your adviser whether you are provider or deployer and which paragraphs apply.
3. Add disclosure at or before the first interaction, as accessible text, in every channel.
4. Add IPTC metadata and a C2PA manifest to generated media, and evaluate watermarking.
5. Verify that marking survives your own pipeline.
6. Record what you implemented and when, so you can show it later.

Common questions

Does a chatbot that only answers FAQ questions need a disclosure?

If it is an AI system that interacts directly with people, paragraph 1 applies unless its AI nature is obvious from the context. A short, clear statement costs little, which is why we add it by default.

Do I have to mark images I generated before August 2026?

According to the Commission's FAQ on the Code of Practice, outputs generated and made available before 2 August 2026 do not need to be marked or labelled retroactively.

Rui Codex helps teams with the technical side of AI transparency: chatbot disclosure in web and mobile interfaces, and IPTC and C2PA marking of generated media, built into your own application. See our AI automation services or contact us.

Sources: AI Act Article 50, Article 111 and Article 113 (European Commission, AI Act Service Desk, consolidated text); Regulation (EU) 2024/1689 on EUR-Lex; Commission press release IP/26/1328; Code of Practice on transparency of AI-generated content; FAQ on signing the Code; IPTC Digital Source Type; c2patool. Checked on 22 October 2026.