What changed, and what did not.
EU AI Act
Article 50: what it requires, and since when.
Last reviewed: 5 October 2026
Article 50 of the EU AI Act has applied since 2 August 2026. It requires that a person is told they are interacting with an AI system, unless that is obvious, and that synthetic audio, image, video and text are marked in a machine-readable way. Two of the four duties in Article 50 fall on the deployer rather than the provider: emotion recognition and biometric categorisation under 50(3), and deep fakes under 50(4). It is a transparency duty. It does not prohibit deploying AI, and it does not require a licence.
What the law requires
- A person interacting with an AI system must be informed of that, unless it is obvious from the circumstances and the context of use.
- Regulation (EU) 2024/1689, Art. 50(1)
- Providers of systems that generate synthetic audio, image, video or text must mark the output in a machine-readable format, detectable as artificially generated.
- Regulation (EU) 2024/1689, Art. 50(2)
- Deployers of an emotion recognition system or a biometric categorisation system must inform the natural persons exposed to it of the operation of the system, and must process the personal data in accordance with the data protection rules. This duty is on the deployer, not the provider.
- Regulation (EU) 2024/1689, Art. 50(3)
- Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake must disclose that the content has been artificially generated or manipulated. This duty is on the deployer, not the provider.
- Regulation (EU) 2024/1689, Art. 50(4)
- A deep fake is defined as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful. Audio sits inside that definition, which is why a cloned or imitative voice is worth measuring against Article 50(4).
- Regulation (EU) 2024/1689, Art. 3(60)
- The information required by paragraphs 1 to 4 must be given to the person concerned at the latest at the time of the first interaction or exposure, clearly and distinguishably.
- Regulation (EU) 2024/1689, Art. 50(5)
- The duty follows the market, not the letterhead: a provider or deployer established outside the Union is in scope where the output of the system is used in the Union.
- Regulation (EU) 2024/1689, Art. 2(1)(c)
- A breach of the Article 50 transparency duties sits in the middle penalty tier: up to €15 million or 3% of worldwide annual turnover.
- Regulation (EU) 2024/1689, Art. 99(4)(g)
- A full provenance chain is not mandatory. The Commission guidelines say so explicitly.
- Commission guidelines C(2026)5054 of 20 July 2026, point (73)
- For SMEs and start-ups, the penalty ceiling is the lower of €15 million or 3% of worldwide annual turnover, not the higher.
- Commission guidelines C(2026)5054 of 20 July 2026, point (152)
- Systems placed on the market before 2 August 2026 only have to satisfy Art. 50(2) from 2 December 2026.
- Digital Omnibus (EU) 2026/1744, in force 27 July 2026, inserting Art. 111(4)
What Audact does about it
- The disclosure is spoken inside the call flow, at the position the policy for that country requires (Germany active · Netherlands in progress · Belgium, Austria queued). Not written in a policy document.
- In controlled testing
- A receipt is visible in the product for governed calls. The evidence record holds the approved disclosure text, its language, and the moment its audio finished being sent.
- Policy differs per jurisdiction, because the national layer on top of Article 50 differs.
- Germany: national policy layer active. Netherlands: in development. Belgium and Austria: planned.
- Machine-readable marking of synthetic audio under Art. 50(2). It would be part of a later release; no date has been established and it is not in the product today.
- Planned
- A shareable attestation page per agent, so a client or a buyer can check disclosure coverage without writing to you first.
- In development
Who it applies to
Provider or deployer: the distinction that decides your obligations.
The Act splits duties between the provider of an AI system and the deployer who puts it to use, and Article 50 places duties on both of them. Article 50(1), telling a person they are speaking to an AI, falls on the provider of the system. Article 50(2), marking synthetic output in a machine-readable format, also falls on the provider.
The deployer is not outside Article 50. Article 50(3) puts the duty to inform on the deployer of an emotion recognition or a biometric categorisation system. Article 50(4) puts a disclosure duty on the deployer of a system that generates or manipulates image, audio or video content constituting a deep fake. Neither of those two attaches to the provider, so a supplier who has covered 50(1) and 50(2) has not covered them for you.
Article 50(4) is the paragraph to read closely if you use a synthetic voice. Article 3(60) defines a deep fake to include audio content that resembles an existing person and would falsely appear to be authentic or truthful. A voice built to sound like a particular human is inside that wording on its face; a synthetic voice that resembles no existing person is not. Which of the two you are running is a question of fact about your own setup, and it decides whether the disclosure duty in Article 50(4) sits with you.
This matters most for agencies. An agency that puts its own name on a voice agent and sells it to an end client is, in most readings, the provider of that system, not merely a deployer of someone else's. That is a different set of duties and a different exposure, and it is worth establishing which side of the line a given setup falls on before the first call rather than after.
A second deadline
Product liability changes on 9 December 2026.
Separately from the AI Act, the revised Product Liability Directive (EU) 2024/2853 applies from 9 December 2026. It treats software as a product and treats a party that puts its own name on someone else's product as the manufacturer of it.
For a white-label agency, that is the same structural position as the provider question above, arriving through a different statute. Note that it is a directive, so the exact transposition runs per member state.
Where the duty bites
Any system built to speak to a person, in any channel.
Article 50(1) attaches to AI systems intended to interact directly with natural persons. The channel is not what decides it; the interaction is. A voice agent placing calls, an inbound line answering them, a website chatbot, an email autoresponder and a WhatsApp or SMS agent are all in scope on the same reasoning.
Who the person is does not by itself take a system out of scope either. A tool used only by your own staff is still a tool interacting with natural persons; what the exception in Article 50(1) turns on is whether the AI nature is obvious from the circumstances and the context of use, not on whether the person is a customer.
- Outbound and inbound voice agents.
- Website and in-product chatbots.
- AI-generated or AI-assisted email.
- Messaging agents on WhatsApp, SMS and comparable channels.
- Any AI-generated communication where a person could reasonably take the counterpart for a human.
Penalties
Three tiers, and the one that applies to Article 50 is the middle one.
The Act fines by category of breach, not by incident type. Transparency sits in the middle tier. The headline figure that circulates in the press (€35 million or 7%) belongs to the prohibited practices of Article 5 and does not apply to a disclosure failure.
- Breach
- Prohibited AI practices
- Ceiling
- €35M or 7% of worldwide annual turnover
- Source
- Art. 99(3)
- Breach
- Transparency duties, including Article 50
- Ceiling
- €15M or 3% of worldwide annual turnover
- Source
- Art. 99(4)(g)
- Breach
- Incorrect, incomplete or misleading information to authorities
- Ceiling
- €7.5M or 1% of worldwide annual turnover
- Source
- Art. 99(5)
- Breach
- SMEs and start-ups, all three tiers
- Ceiling
- The lower of the amount or the percentage
- Source
- Art. 99(6) · guidelines C(2026)5054, point (152)
Note
Information, not legal advice.
This page sets out the rules as we read them, with the article numbers so you can check us. It is not legal advice, and your own position depends on facts this page cannot know. Take advice from qualified counsel before you rely on it.
Questions
- Does Article 50 ban AI phone calls?
- No. It is a transparency duty. It requires that the person is told, and that synthetic output is marked. Deploying an AI voice agent in the EU is lawful; doing it without the disclosure is what creates exposure.
- Is the disclosure enough, or do I need evidence that it happened?
- The Article itself requires the disclosure, not proof of it. Whether you can show that it happened becomes relevant only when someone asks: a client, a regulator, a court. That is what a compliance receipt is for: one per governed interaction, three fields of which anyone can recompute without a key — no account, no access to our database. See a receipt field by field at /proof.
- What is the maximum fine for a small company?
- For SMEs and start-ups the ceiling is the lower of €15 million or 3% of worldwide annual turnover, per Article 99(6) and point (152) of the Commission guidelines of 20 July 2026. The formulation 'whichever is higher' circulates widely and is incorrect for this group.
- My company is outside the EU. Does Article 50 reach me?
- It can. Article 2(1)(c) brings providers and deployers established in a third country into scope where the output of the system is used in the Union. A US company whose voice agent calls someone in Dublin is on the same footing as a Dutch one.
- We white-label a voice agent for our clients. Who owes the disclosure?
- Putting your own name on a system and placing it on the market is what the Act describes as being its provider, and the Article 50 duties attach there. It is worth establishing which side of the line a given setup falls on before the first call rather than after: the same question decides your position under the revised Product Liability Directive from 9 December 2026.
Article 50 inside the call, not in a document
Audact places the disclosure in the call flow and records that it happened. See how the policy engine decides what is said, in which country, at which point in the conversation.
Related
The 2 August 2026 date Product liability, 9 December 2026 Why white-label changes your position.
GDPR The duties that were already there.
NL Telecomwet The Dutch layer on top.
See a receipt, field by field Three values anyone can recompute without a key.
Check your own setup A few questions, one answer.
All frameworks