On 20 July 2026 the European Commission adopted its final guidelines on the transparency obligations in Article 50 of the EU AI Act. Those obligations start applying on 2 August 2026, thirteen days later. If you run an agent that talks to people, generates content, or publishes text, Article 50 hands you at least one of five disclosure duties, and the guidelines are the first detailed account of what satisfying them looks like.
The practical questions are which trigger applies to which kind of agent, where the exceptions are thinner than they look, and which parts of the work your own application has to do rather than the platform underneath it. For the wider risk-tier picture and the high-risk timeline, read our guide to EU AI Act compliance for AI agents.
What the Commission Published on 20 July
The package explains how the Commission reads Article 50 without changing a word of it. Alongside the guidelines the Commission issued a Communication approving their content, a public FAQ on the Article 50 obligations, and a short fact sheet. The goal is to get the same rules read the same way in every member state, so that people can tell when they are dealing with an AI system and when content was generated or altered by one.
None of it is binding. Only the Court of Justice can authoritatively interpret the Regulation. But the guidelines are the reference point that national market surveillance authorities and the AI Office will work from, so they are the best available preview of how those authorities will read the text from August onward.
The final text also confirms that the Commission assessed the Code of Practice on Transparency of AI-Generated Content as adequate. The Code was published by the AI Office on 10 June 2026 and adherence is voluntary. Signing it is a way to demonstrate compliance with the marking duties, not a formal legal presumption that you have met them. Skip it and nothing is automatically wrong, but you carry the full burden of showing that whatever marking you chose is good enough.
The Five Disclosure Triggers
Article 50 carries five separate obligations, split between the provider role and the deployer role, and a single system can trigger several of them at once.
Article 50(5) governs how all of it is delivered: clearly and distinguishably, at the latest at the first interaction or exposure, and in a form that meets accessibility requirements. For deepfakes the guidelines are explicit that a machine-readable mark alone is not enough. A person has to be able to perceive the disclosure.
The Trigger That Catches Most Agent Teams
The guidelines set four cumulative criteria for whether a system interacts directly with a natural person. All four have to hold:
- 1.The system qualifies as an AI system under the Regulation
- 2.There is a genuine two-way exchange, not merely collection of data from the person
- 3.The AI communicates with the person itself, rather than through a human intermediary
- 4.The counterpart is a natural person
That draws a usable line through a typical agent fleet. An agent answering customers over the Telegram connector, replying from a shared inbox through the email connector, or streaming into a support widget over a WebSocket session is squarely in scope. An agent that consumes a Kafka topic, enriches records, and writes to Postgres is not: there is no natural person on the other end of the exchange. Background systems and machine-to-machine communication are excluded.
The duty attaches to the provider, meaning whoever develops the system and places it on the market or puts it into service under their own name. If you build an agent and offer it to your customers, that is you. Because the obligation attaches at design time, the disclosure has to be built into the system rather than remembered at runtime.
Bring a customer-facing agent and we can walk through which disclosure duties it triggers, what the transparency record needs to contain, and which controls Connic covers.
Talk through your Article 50 scopeThe Exceptions Are Narrower Than They Look
Obviousness has a legal test behind it
Article 50(1) does not apply where it is obvious to the person that they are dealing with an AI. The guidelines measure that against a hypothetical average person who is reasonably well-informed, observant and circumspect, and they interpret the carve-out restrictively given how central transparency is to the Regulation. Being confident internally that everyone knows the support widget is a bot is a different thing from testing it against that standard and writing down the result. An authority will ask for the written version.
Editorial control means someone actually read it
The public-interest text obligation falls away where the content underwent human review or editorial control. The guidelines define that as a deliberate examination of the substance by one or more natural persons with relevant knowledge, plus a person or organisation who can approve, alter or reject the content on substantive grounds and who holds editorial responsibility for publication. Running a spellchecker over the output does not qualify, and neither does a cursory glance.
For teams shipping content agents this is the exception most likely to matter, and the one that turns into an evidence problem. Relying on it means being able to show who reviewed which output, when, and with what authority to reject it.
Marking has real carve-outs, and they are technical
Article 50(2) does not reach systems performing an assistive function that does not substantially alter the input data. The guidelines add further exclusions for short sequences of symbols, source code, machine-to-machine outputs, and closed-loop development environments. Evidently artistic, satirical or fictional works keep a reduced deepfake obligation: the disclosure must exist, but in a manner that does not hamper the display or enjoyment of the work.
The Dates That Matter
Retroactivity splits by modality, and the split is easy to get backwards. Images, audio and video generated or manipulated before 2 August 2026 do not have to be marked retroactively. Text works the other way. Text generated before 2 August but published on or after that date does need labelling, unless the editorial control exception applies. Scheduled content queues and evergreen libraries are worth checking on that basis.
Who Marks the Output When You Bring Your Own Key
Article 50(2) sits with the provider of the generative system, and the technical expectations behind it live where content is produced: cryptographically signed provenance metadata, imperceptible watermarks that survive format conversion, and fingerprint registries as a supplement. The Code of Practice is explicit that no single technique currently satisfies all four quality criteria it sets out, which are effectiveness, interoperability, robustness and reliability, so it pushes providers toward layered approaches rather than one mechanism.
That changes how you read your own obligations on Connic. Connic is bring-your-own-key and never hosts or resells models, so machine-readable marking of model output is a property of the model provider you choose and of the application you put in front of users. It is not something an agent runtime can retrofit onto content it did not generate. What you can do is capture the upstream provider's marking as evidence supporting your own record, which is why the fifth item in the checklist below is a question for your model provider. Their evidence supports your record. It does not transfer your responsibility.
Turning Article 50 Into an Operational Record
Disclosure duties fail audits in a predictable way. The banner exists, the label is there, and nobody can produce a dated record showing which system carries which duty, on what basis, and that the disclosure reached the person it was meant for. Connic AI Governance, an Enterprise entitlement, is where that record lives. It is documentation and evidence rather than enforcement, and it is scoped per project. Read the AI Governance reference for the full workflow.
Approvals are the editorial-control paper trail
If you plan to rely on the human review exception for public-interest text, the guidelines require substantive examination by a person who can reject the content. That is exactly what an approval gate in front of publication produces: the output, the named reviewer, the decision, and the timestamp. Pair it with the trace behind each run and you can show the exception applies instead of asserting that it does.
Where to Start Before 2 August
- 1.List every agent whose output reaches a natural person, and note the surface it reaches them through. That list is your Article 50(1) scope
- 2.For each one, decide your role. Building and offering the agent generally makes you a provider, using someone else's system under your own authority makes you a deployer, and both can apply at once
- 3.Write the disclosure copy, in every locale you serve, and place it so it lands at or before the first exchange rather than in a settings page or a footer
- 4.If you publish AI-generated text on public-interest topics, choose deliberately between labelling it and running genuine editorial review, then build the evidence trail for whichever you picked
- 5.Ask your model provider what marking they apply to generated media and how it can be detected, and record their answer as upstream evidence
For how Connic's controls line up against the wider Regulation, read the EU AI Act platform statement. None of this is legal advice, and a preliminary assessment is not a classification: the final call on which duties you carry belongs to you and your counsel.