EU AI Act transparency rules in 2026: an Article 50 checklist for SMEs
A practical Article 50 checklist for SMEs covering chatbot disclosure, AI-content marking, deepfakes, public-interest text, roles, dates, and evidence.
The EU AI Act's transparency obligations under Article 50 started to apply on 2 August 2026. For many small and medium-sized companies, this is more immediate than the later timetable for some high-risk systems. The practical question is not simply whether a business "uses AI." It is whether the company provides an AI system, deploys one in a professional setting, or publishes AI-generated or manipulated content in circumstances covered by Article 50.
The European Commission published final guidelines on 20 July 2026 to explain the scope of these duties. Spain's AI supervisory agency, AESIA, has also published a practical explanation of the four main obligation groups. This article translates those official materials into an operating checklist. It is general information, not legal advice.
First identify your role
Article 50 separates responsibilities between providers and deployers. A provider develops an AI system or places it on the market under its name or trademark. A deployer uses an AI system under its authority in a professional activity. A company can be a deployer of one tool and a provider of another.
That distinction matters. A business using a third-party chatbot for customer service may have duties as a deployer, while a software company that embeds and brands a generative feature may also have provider obligations. Do not classify the company only once; classify each system and use case.
The four Article 50 duty groups
| Situation | Primary duty | Typical owner |
|---|---|---|
| A person interacts directly with an AI system | Inform the person that they are interacting with AI, unless this is obvious to a reasonably informed and attentive person | Provider |
| An AI system generates or manipulates synthetic audio, image, video, or text | Mark outputs in a machine-readable form so they are detectable as artificially generated or manipulated | Provider |
| Emotion-recognition or biometric-categorisation systems are used | Inform exposed natural persons about the operation of the system, subject to the applicable exceptions and other law | Deployer |
| Deepfakes or AI-generated public-interest text are published | Disclose the artificial origin clearly, with specific exceptions and adaptations | Deployer |
The categories are related, but they are not interchangeable. A visible "AI assistant" label addresses human interaction; it does not automatically satisfy a provider's technical marking duty for generated media. Machine-readable marking does not replace a clear disclosure when a deployer publishes a deepfake.
The 2 December transition is narrow
Regulation (EU) 2026/1744 introduced a four-month transition for providers of systems that were already placed on the market before 2 August 2026 and are subject to Article 50(2). Those providers must take the necessary steps to comply with the machine-readable marking duty by 2 December 2026.
This is not a general postponement of Article 50. The Commission states that the transparency obligations apply from 2 August 2026. A company should document exactly which paragraph and transition it relies on instead of recording "the AI Act was delayed."
A practical SME scoping test
Review every customer-facing chatbot, avatar, voice interface, generative content workflow, emotion-recognition use, biometric categorisation use, and publication process. For each one, record:
- The system name, provider, business owner, and intended purpose.
- Whether the company is provider, deployer, or both.
- The people exposed to the system or content.
- The relevant Article 50 paragraph.
- The disclosure or marking mechanism.
- The date it became operational and, for provider marking, whether it was already on the market before 2 August 2026.
- The person who verifies that the control remains present after product or workflow changes.
If the use affects employment, health, credit, safety, biometrics, children, or fundamental rights, obtain qualified legal and technical review. Article 50 is only one part of the regulatory analysis.
Chatbots and direct interaction
For direct human interaction, the safe operating pattern is to disclose the AI nature early and in the interface where the interaction happens. Avoid hiding the information only in terms and conditions. Keep evidence of the wording, location, locale, and release in which it appeared.
The "obvious to a reasonably informed and attentive person" exception is contextual. A company should not assume that a conversational interface is self-evidently artificial in every channel. Voice, messaging, embedded support, and branded avatars can create different expectations.
Generated content and public-interest text
Provider-side marking and deployer-side labelling solve different problems. Technical marking aims to make synthetic output detectable. Public disclosure helps the audience understand what it is seeing or reading.
For deepfakes, disclosure should be clear and distinguishable. Artistic, creative, satirical, or fictional works have adapted disclosure rules so the label does not unreasonably hamper the work. For AI-generated or manipulated text published to inform the public on matters of public interest, Article 50 includes an exception where the content has undergone human review or editorial control and a person holds editorial responsibility.
That exception is not a reason to add a ceremonial approval. Keep a real editorial record: who reviewed the substance, what sources were checked, what changed, and who accepted responsibility. Standard editing assistance that does not substantially alter the input or its meaning also needs to be distinguished from generative publication.
Build an evidence pack
A small company does not need a large compliance platform to start. Keep a compact file for each relevant system containing:
- Role and use-case classification.
- Screenshots or release evidence of user disclosures.
- Provider documentation about machine-readable marking.
- Publishing templates and editorial-review records.
- Applicable dates and any documented transition.
- Named owners, review frequency, complaints, incidents, and corrective actions.
- Vendor or model changes that could alter the control.
The AI governance toolkit for SMEs provides an inventory and ownership structure. The AI acceptable-use policy template helps set employee rules, while the AI Act fines guide explains why maximum penalties are ceilings rather than automatic outcomes.
Where Polp fits
Polp's public product page describes answers grounded in connected company documents with traceable sources. That can help staff retrieve approved disclosure language, policies, and evidence. It does not decide whether a system falls under Article 50, add machine-readable provenance to another provider's output, or guarantee legal compliance.
Use a knowledge assistant as part of the evidence workflow, not as the legal conclusion. Assign an owner, preserve official source links, and re-check the control when the system, audience, channel, or publishing process changes. To see how Polp can support governed access to internal policies and evidence, request a demo.