31 JULY 2026

AI Act: disclosure duties and the limits of fines

Article 50 separates providers from deployers. See disclosure duties, editorial exceptions and the actual penalty ceilings in Article 99.

Contents

Article 50 transparency obligations apply from 2 August 2026. They do not create one rule requiring a visible label on every AI output. The organisation’s role, the system and its use determine which obligation applies.

Different duties for providers and deployers

Providers of systems intended to interact directly with people must ensure that people know they are interacting with AI, unless that is already obvious in context. Providers of systems generating synthetic audio, images, video or text must address machine-readable marking and detectability. Article 50(2) includes an exception for standard assistive editing that does not substantially alter the input or its meaning.

Deployers generating or manipulating a deepfake must disclose its artificial origin or manipulation. Evidently artistic, creative, satirical or similar works receive a proportionate disclosure arrangement. For AI-generated text published to inform the public on matters of public interest, a separate exception applies where human review or editorial control takes place and a person or legal entity holds editorial responsibility. That exception does not automatically cover every use of AI.

A ceiling is not an automatic fine

Article 99(4) includes transparency infringements in the category capped at EUR 15 million or 3% of worldwide annual turnover for the preceding financial year. The higher ceiling generally applies to undertakings; Article 99(6) uses the lower ceiling for SMEs, including start-ups. Paragraph 6a also uses the lower ceiling for the relevant fines imposed on small mid-cap companies.

An actual sanction depends on the infringement and the individual circumstances. Using a generative tool does not by itself prove an Article 50 breach.

A practical check

Our editorial recommendation is to record each system’s purpose, the organisation’s role, affected outputs, applicable disclosure and evidence of implementation. Record the specific basis of any exception being relied on. This is a proposed working method, rather than evidence that any named organisation has complied.

Correction and update, 12 October 2026: The original report confused some dates and overstated legal obligations. This version follows the current consolidated regulation and the primary materials linked below. The original publication date is retained.

Sources:

Need an independent review of your AI or data?

CIAD offers audits of AI systems, web applications and data security for companies and organisations. The first consultation is free.

CONTACT CIAD

The CIAD weekly newsletter.

What our own measurements show, one practical AI workflow and regulation translated into clear steps. Only what we verify ourselves.

SUBSCRIBE