Article 50 of the EU AI Act: who actually owes what — and the trap that ruins half of questionnaire responses
When an enterprise buyer's questionnaire asks "Are you compliant with EU AI Act Article 50 transparency obligations?", most software vendors answer as if all five paragraphs applied to them equally. They don't — and buyers' security teams increasingly know it. Answering the wrong paragraph signals that you haven't read the Regulation, which is worse than having a gap.
The obligation map, paragraph by paragraph
Article 50 assigns each transparency obligation to a specific role — provider (who develops the AI system or places it on the market under their name) or deployer (who uses it under their own authority):
| Paragraph | Obligation | Who owes it |
|---|---|---|
| 50(1) | Inform people that they are interacting with an AI system (chatbots, conversational AI). Exception: where this is obvious to a person who is "reasonably well-informed, observant and circumspect". | Provider |
| 50(2) | Machine-readable marking of synthetic content (audio, image, video, text) so it is detectable as artificially generated. | Provider |
| 50(3) | Inform people exposed to emotion-recognition or biometric-categorisation systems. | Deployer |
| 50(4) | Disclose deepfakes; disclose AI-generated text published to inform the public on matters of public interest. Exceptions include creative/satirical works (reduced transparency) and text under human review with editorial responsibility. | Deployer |
| 50(5) | The information above must be clear, distinguishable, and provided at the latest at the time of first interaction or exposure. | Both, per paragraph |
The trap: you are probably the provider, not the deployer
A SaaS company that integrates GPT, Claude or any foundation model into its product under its own brand is, for the purposes of Article 50(1), the provider of the resulting AI system — not a mere deployer of someone else's model. The same applies to a deployer who substantially modifies a system or markets it under their own name.
This is the single most common error we see in vendor questionnaire responses: the vendor answers "our AI provider (OpenAI/Anthropic) handles transparency obligations", when in fact the disclosure duty toward the vendor's own end users sits with the vendor. A buyer's legal reviewer who spots this will re-read every other answer in your questionnaire with suspicion.
The dates, after the Digital Omnibus — what moved and what didn't
The Digital Omnibus (adopted by the European Parliament on 16 June 2026 and by the Council on 29 June 2026) changed the calendar for high-risk systems — and only for them:
- Article 50 transparency obligations were NOT postponed. They apply from 2 August 2026, as set by Article 113.
- High-risk obligations (Annex III use cases) were delayed to 2 December 2027; high-risk AI embedded in regulated products to 2 August 2028.
- One grace period touches Art. 50: the machine-readable marking duty of 50(2), for systems already placed on the market, benefits from a transition until 2 December 2026.
- Article 4 (AI literacy) has applied since 2 February 2025; the Omnibus softened it from "ensure a sufficient level" to "support the development" of AI literacy — an obligation of means, not of result.
If a questionnaire response — or a consultant — tells you "the AI Act was delayed, you have until 2027", that is true only for the high-risk chapter. For the transparency questions buyers actually ask SaaS vendors, the date is August 2026.
What non-compliance actually costs (the honest version)
Article 99(4)(g): infringement of Article 50 can be fined up to €15,000,000 or 3% of total worldwide annual turnover, whichever is higher. Two facts that alarmist vendors' blogs usually omit:
- For SMEs and startups, Article 99(6) applies the lower of the two amounts — not the higher.
- Fines are imposed by member states, and not every member state has its enforcement regime in force yet. Spain, for example, approved its draft AI law in the Council of Ministers on 26 May 2026 and it is still in parliamentary passage (designating AESIA as lead authority).
The practical risk for a B2B SaaS vendor in 2026 is therefore not primarily the regulator — it is the enterprise buyer who won't sign until the AI section of their vendor assessment is answered convincingly. The deal, not the fine, is what's on the line this quarter.
How to answer "Are you Article 50 compliant?" in a questionnaire
Never answer a blanket "yes". A response that survives legal review has four parts:
- Classification — state what your system is and is not (most B2B SaaS is limited/minimal risk, outside Annex III).
- Applicable obligations — name the exact paragraphs that apply to you and in which role (provider vs deployer), with dates.
- Measures in place — the concrete controls you already run (disclosure labels, human review, logging), stated factually.
- Ongoing work — real gaps with a proportionate plan. A defensible "not yet, here's the plan" beats a hopeful "yes" that collapses in due diligence.
- Regulation (EU) 2024/1689, Official Journal — Art. 50, Art. 99, Art. 113, Art. 4 (ELI: data.europa.eu/eli/reg/2024/1689/oj)
- Digital Omnibus: European Parliament position 16 June 2026; Council adoption 29 June 2026 (consilium.europa.eu press releases, 7 May and 29 June 2026)
- European Commission, AI literacy Q&A (digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers)
- Spain: draft AI law approved by Council of Ministers 26 May 2026 (in passage; AESIA as lead authority)