How to Review AI App Transparency Under EU Article 50

On August 2, 2026, the transparency obligations of Article 50 of the EU AI Regulation began to apply. These do not equate to a general rule requiring every AI-produced text to be marked; they establish different duties depending on who offers the system, who uses it, and the type of interaction or content involved. European Commission

This distinction matters for SMEs and users. The provider is the entity that develops a system and places it on the market or puts it into service under its name; the deployer is the one who uses it in an activity under their authority. A company integrating a third-party chatbot may be a deployer, even if they did not create the model. AESIA

The article covers several situations: direct interaction with AI systems, marking of certain synthetic contents, warnings about deepfakes, and specific AI-generated or manipulated publications on matters of public interest. Therefore, checking an app is not about finding a universal seal, but identifying which obligation corresponds to the product and specific use. European Commission

For providers, Article 50 stipulates that outputs from systems generating audio, images, video, or text must be marked in a machine-readable format and detectable as artificially generated or manipulated. The regulation foresees that marking be effective, interoperable, robust, and reliable where technically feasible, recognizing exceptions such as certain assisted editing uses that do not substantially alter the input or its semantics. European Commission

This does not mean every result must display a visible mark, nor that any absence of marking alone proves an infringement. The technical requirement is primarily directed at the provider; the specific form may vary, and some systems may face technical limits. The user or deployer's obligation also depends on the content type and its distribution. AESIA

In practice, a person can review if the application explains how it identifies its results as synthetic and if contents retain labels or metadata when downloaded or shared. However, a visual inspection does not verify machine-readable marking by itself: it is not equivalent to analyzing metadata, checking technical functionality, or evaluating legal compliance. The useful question is what mechanism the provider declares, not if all images carry a visible watermark. European Commission

If a person interacts directly with an AI system, the article provides that they must be informed they are dealing with AI, unless this is obvious to a reasonably informed, observant, and circumspect person given the circumstances. For an SME, this places the notice in the context of use: an automated customer service assistant may need clear communication, but the specific obligation must be evaluated according to the system and interaction. AESIA

There is also an obligation for those deploying systems that generate or manipulate images, audio, or video constituting a deepfake: they must reveal that the content was artificially generated or manipulated. The Regulation contemplates an appropriate form of presentation that does not hinder the viewing or enjoyment of the work when the content forms part of a manifestly artistic, creative, satirical, fictional, or similar work. European Commission

For AI-generated or manipulated text published to inform the public on matters of public interest, the duty to reveal its origin applies under conditions, including the absence of human review or editorial control and relevant editorial responsibility. It does not automatically extend to all AI-assisted text. Distinguishing these conditions prevents turning the rule into a general requirement to label any email, draft, or commercial publication. European Commission

A practical review can start with the information provided by the provider, without assuming that a privacy policy substitutes for Article 50 transparency obligations. First, check the identity of the responsible company, the description of generative functions, and whether the application warns when conversing directly with an AI system. AESIA

Next, determine the intended use: if the tool produces content that will be distributed, what format it generates, and who will publish it. For realistic images, audio, and video, find out if there is a way to identify the synthetic origin and how viewers are informed; for publications on matters of public interest, check if there will be human intervention and editorial control. The distribution context can change which duties apply. European Commission

A brief list to document the review:

• Identify provider and deployer; do not confuse them if the SME integrates an external tool.
• Review interaction notices and explanations about result marking.
• Record content type, audience, publication purpose, and any human editorial review.
• Consult guidelines and the code of good practices; the latter is voluntary and serves as a support path, not a substitute for the Regulation.
• If the provider's response is unclear, save the documentation and request a specific explanation about the mechanism and applicable scope. European Commission

The Commission maintains a compliance checker to guide on which rules might affect an AI system and its operators. The tool is identified as a beta version and a work in progress; it is useful for organizing questions, not as a legal ruling or certification that an application complies. EU Checker

Information about the synthetic origin of a result and information about personal data are related but distinct issues. Article 50 regulates notices and marking in certain interactions and contents; it does not by itself turn a privacy policy into proof of compliance, nor does it require, in those terms, that every app publish a complete inventory of training data or a universal voluntary exclusion mechanism. European Commission

If the concern is that the app uses personal data, separately review its privacy notice and the controls it offers for data processing. The assessment of these aspects may involve other rules and depend on the service, purpose, and relationship between parties. Do not infer personal data use from the presence or absence of a synthetic content label. AESIA

This distinction avoids a frequent confusion in business purchases: a tool may visibly explain that it generates content and still require an independent privacy, security, or contracting assessment. Similarly, an extensive privacy policy does not by itself prove that results are technically marked or that the interaction notice is adequate. These are separate checks, with different evidence. European Commission

If an application does not explain its functioning, it is advisable to formulate a specific question to the provider: if the system generates or manipulates content, what marking it incorporates, what technical limitations it recognizes, and in which cases it expects the client to inform those who interact with or receive the content. For an SME, keeping the response and the version of the terms consulted helps document diligence, although it does not by itself resolve whether compliance exists. AESIA

When a breach is suspected, first describe the case precisely: function used, content or interaction, date, country, notice shown, and provider response. The official checker can help identify potential obligations; it should not be presented as a complaint channel or resolution. For a legal decision or formal complaint, relevant channels must be followed and, if necessary, specialized advice sought. EU Checker

The operational conclusion is moderate: from August 2026, there are transparency obligations applicable to defined situations, but there is no single visual proof that allows certifying compliance for any app. Identifying each actor's role, the type of result, and the publication context offers a more useful verification than looking for a generic label or treating the privacy policy as the answer to all questions. European Commission