What decides your AI Act exposure
is not in your AI inventory.
Article 50 of Regulation (EU) 2024/1689, the AI Act, gathers the transparency obligations: informing people that they are interacting with AI, marking synthetic content and making it detectable, informing people exposed to emotion recognition and biometric categorisation, and disclosing deepfakes and text published on matters of public interest. They have applied since 2 August 2026 and reach systems outside the high-risk regime. They also reach organisations established outside the Union: under Article 2(1) reach is set by the connection to the European market, irrespective of where the company is established. On 20 July 2026 the European Commission adopted Guidelines on implementing them. The Guidelines are explicitly non-binding: authoritative interpretation of the AI Act rests with the Court of Justice of the European Union.
Two obligations, two calendars.
Transparency, Article 50
- Applicable since 2 August 2026
- Reaches systems outside the high-risk regime
- 50(2) marking due 2 December 2026 for generative systems already on the market
- Fines under Article 99(4)(g): up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher
The high-risk regime
- Article 6(2) and Annex III: 2 December 2027
- Article 6(1) and Annex I: 2 August 2028
- Postponed by Regulation (EU) 2026/1744
- Stated reason: harmonised standards and national authorities unavailable in time
The high-risk postponement did not reach Article 50. A compliance programme calibrated to August 2026 as the high-risk milestone is ready for the deadline that moved, and exposed on the one that did not. The dates above reflect the text in force in August 2026, and the AI Act calendar has already been amended once.
Exposure is decided by role and audience, and held up by perimeter.
- A
The legal role
Whoever builds it and puts it live under their own name is a provider.
The four Article 50 obligations split by role. Providers owe 50(1), informing a person that they are interacting with an AI system, and 50(2), marking synthetic output in a machine-readable format and making it detectable. Deployers owe 50(3), informing people exposed to emotion recognition or biometric categorisation, and 50(4), disclosing deepfakes and text published to inform the public on matters of public interest. The Commission holds that an organization which develops an interactive or generative AI system in-house and puts it into service under its own name or trademark occupies the provider role, and that the same applies to one which modifies a third-party system and puts it into service under its own name. A single organization can hold both roles at once.
The prevailing self-image, "we use AI, we do not make AI", breaks down precisely on the systems a company is proudest of: the agents it built rather than bought.
- B
The audience the system faces
The same build falls under a different regime depending on who is on the other side.
The exception to the 50(1) disclosure duty is obviousness to a reasonably well-informed, observant and circumspect member of the system's targeted and reasonably foreseeable audience. The Commission directs that the exception be read restrictively, because it deprives people of the right to be informed, and states that general awareness that AI systems exist does not imply recognising them in an interaction. The worked examples published in the Guidelines cut a single technology down the middle: an internal employee-facing assistant for properly trained, AI-literate staff, in HR, legal, procurement, compliance or IT support, falls outside the scope; an AI chatbot on an online platform or helpdesk, whose output users may perceive as human-generated, falls inside.
The obligation attaches to the deployment context. Re-pointing an internal assistant at an external audience reopens that system's classification, and in operations the same move usually passes as a configuration change. Audience is an inventory attribute, and almost no AI inventory has that field.
- C
The controls already installed
The industrial carve-out holds only with a perimeter, and fails without one.
The Commission recognises limited cases of industrial or business-to-business applications, excluding public and consumer-facing systems, where no 50(2) marking and detection is required. Three conditions must hold cumulatively: the output is strictly technical in nature; it is intended to be perceived and processed only by a limited, pre-defined number of natural persons acting in a professional capacity inside the organization; and it is not intended to be shared outside the company or usable by external persons, with appropriate safeguards against reasonably foreseeable misuse, for example cloud isolation and role-based controls.
Cloud isolation and role-based access are the acceptable-use perimeter a mature governance function has already installed. An organization that installed it can evidence the exemption system by system. One that did not, marks.
Article 50 obligations may apply cumulatively to a single system, engaging different actors. Sources are listed at the end.
Governance here is not a compliance cost. It is the difference between demonstrating an exclusion system by system and having to mark everything.
The Alkemia read
The inventory's regulatory axis is one-dimensional.
An AI inventory asks which risk class each system falls into. That question does not reach Article 50, which the AI Act treats as its own category: transparency risk. Role and audience are properties of a deployment: who put the system live, under what name, and in front of whom. The same model, from the same vendor, on the same build, produces two different regimes depending on those two answers. Until the inventory records both, the organization does not know what it owes, and cannot demonstrate what it does not.
None of this means your company is in breach. Much of what an organization with an installed perimeter runs internally should fall outside the scope, and the Commission Guidelines are guidance rather than law: they themselves state that authoritative interpretation rests with the Court of Justice. The Alkemia position here is deliberately narrow. The question the inventory answers today is not the question that determines exposure, and classifying any specific system should be validated with counsel rather than deduced from a guidance document.
Six points to check in your AI inventory.
- 01
Legal role, per system
For every interactive or generative system operating with reach into the European Union: who put it into service, and under what name or trademark? A system developed in-house and made available under your own name places the organization in the provider role, with the design-time obligations that come with it. A third-party system modified and put into service under your own name does the same.
- 02
Audience, per deployment
Who is on the other side of each system today, and who might be next quarter? The obviousness exception is calibrated to the targeted and reasonably foreseeable audience, and is to be read restrictively. Record the audience as an attribute of the system, and treat a change in it as an event that reopens the classification.
- 03
Generative systems that predate August
Regulation (EU) 2026/1744 inserted a new Article 111(4) into the AI Act: providers of systems generating synthetic audio, image, video or text placed on the market before 2 August 2026 have until 2 December 2026 to comply with 50(2). That is the full reach of the transition. The 50(1) disclosure duty fell due in August, with no additional time.
- 04
The industrial carve-out, evidenced
For every system the organization would treat as exempt from marking: do the three conditions hold in writing? Strictly technical output, a limited pre-defined internal professional audience, no external destination, and safeguards against reasonably foreseeable misuse. An exemption the company cannot document is an exemption it does not have.
- 05
Human review of published text
Where the company publishes text on matters of public interest with AI assistance, the editorial-control exception requires substantive human review and a named editorial lead. The Commission expressly excludes purely formal checks, the mere existence of an editorial policy, and automated review processes. Any substantive AI intervention after editorial sign-off voids the exception.
- 06
The demonstration path
The Commission and the AI Board concluded that the Code of Practice on Transparency of AI-generated Content adequately covers Articles 50(2), (4) and (5). Non-signatories demonstrate compliance by other adequate means and, per the Commission, should run a gap analysis against the code's measures. Two caveats carry weight: the Commission states that adherence is not conclusive evidence of compliance, and the code does not reach 50(1) or 50(3).
Every point depends on the specific system, the vendor contract, and the jurisdiction. Validate the classification of each system with counsel before acting.
The two questions your inventory does not yet answer.
For the CIO who owns the inventory and the board that ratifies the exposure, the operational question is: what did the organization build, under what name did it go live, and who is on the other side of each system. A 30-minute conversation, with no commitment, maps where your organization likely occupies the provider role, which deployments change regime through audience, and what has to be on record to sustain an exemption. If the conclusion is that your exposure is already covered, that is a useful answer too.
Discuss your decisioncontact@alkemia.io
Every statement here traces to the official text.
Article 50, in decision terms.
- Our company is established outside the European Union. Does Article 50 reach us?
- The AI Act does not apply territorially outside the Union and creates no obligation on non-EU soil by itself. It reaches through the connecting factors in Article 2(1): placing a system on the market or putting it into service in the Union, even where the provider is established in a third country; acting as a deployer with a place of establishment in the Union; or, from outside the Union, producing output intended to be used in the Union, a case Recital 22 records expressly to prevent circumvention. With none of those factors, Article 50 does not reach. With any one of them, it reaches system by system, and the analysis returns to legal role and audience.
- Was Article 50 of the AI Act postponed?
- No. Regulation (EU) 2026/1744 postponed the high-risk regime to 2 December 2027 (Article 6(2) and Annex III) and 2 August 2028 (Article 6(1) and Annex I). The Article 50 transparency obligations have applied since 2 August 2026. The only transition is the new Article 111(4): generative systems placed on the market before that date have until 2 December 2026 to comply with the 50(2) marking obligation.
- Is my company a provider or a deployer under Article 50?
- It depends on each system, and it can be both at once. The Commission holds that an organization which develops an interactive or generative AI system in-house and puts it into service under its own name or trademark occupies the provider role, and that the same applies to one which modifies a third-party system and puts it into service under its own name. Classifying a specific system is a legal determination and should be validated with counsel.
- Does an internal AI assistant have to disclose that it is AI?
- The Commission treats an internal employee-facing assistant for properly trained, AI-literate staff as exempt, in areas such as HR, legal, procurement, compliance and IT support. The same technology facing customers, in a platform or helpdesk chatbot whose output may be perceived as human-generated, falls within scope. The exception is calibrated to the targeted and reasonably foreseeable audience, and the Commission directs that it be read restrictively.
- Does adhering to the Code of Practice settle compliance?
- The code is the recognised demonstration path for Articles 50(2), (4) and (5), and the Commission and the AI Board concluded that it covers those obligations adequately. Two caveats carry weight: the Commission states that adherence does not constitute conclusive evidence of compliance, and the code does not reach 50(1) or 50(3). A system owing only those two obligations has no demonstration path through the code.
- Where should we start?
- With the AI inventory. Record, for every system, the legal role the organization occupies and the audience that system faces, and treat a change of audience as an event that reopens the classification. With those two fields, the question "what do we owe?" gets an answer per system rather than an answer per policy.
Classifying any specific system under the AI Act depends on the facts of that system, the vendor contract, and the applicable jurisdiction. Before acting, it is worth validating the case with counsel.
Informational content on Regulation (EU) 2024/1689 (the AI Act), Regulation (EU) 2026/1744, and the European Commission Guidelines on the Article 50 transparency obligations, adopted on 20 July 2026. The Guidelines are explicitly non-binding, and authoritative interpretation of the AI Act rests with the Court of Justice of the European Union. This material does not constitute legal advice and does not determine the classification, role, or obligations of any specific system. Dates and figures reflect the text in force in August 2026; the AI Act calendar has already been amended once.