We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

FAQEU AI Act

EU AI Act When must you disclose AI use?

Tell people when they are interacting with AI where requires it. Separate notices for users from technical marking of generated content and disclosures for deepfakes or public-interest text.

Each duty has its own responsible actor, timing and exceptions. A notice does not make a prohibited use lawful.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 21, 2026
6 sections7 primary sources
Overview

covers certain AI interactions and generated content. Most duties apply from 2 August 2026. The provider marking duty has a limited transition until 2 December 2026 for systems placed on the market before 2 August 2026. Check the responsible actor, disclosure format, timing and exceptions below.

Search this module

Find a question or answer quickly

6 of 6 questions
Question 1

When must a chatbot identify itself as AI?

Providers must design AI systems intended to interact directly with people so that users know they are interacting with AI.

A separate notice is unnecessary when the AI interaction is obvious to a reasonably well-informed, observant and circumspect person in that context. A law-enforcement exception covers legally authorised detection, prevention, investigation or prosecution of offences, with safeguards. That exception does not cover systems available to the public for reporting a criminal offence.

  • Place the notice in the product experience before or during the first AI interaction, not only in back-office documentation.
  • Test whether a normal user can tell they are interacting with an AI system in the actual context, language, device, and channel.
  • Keep a short record of the notice text, placement, version, language coverage, and the reason any obviousness or law-enforcement exception was used.

Do chatbots and AI assistants need a notice?

Yes, where the AI system is intended to interact directly with natural persons. The provider must design and develop the system so the person is informed that they are interacting with an AI system, unless that fact is obvious in the context of use.

When must people receive the information?

For (1) to (4), the information must be clear and distinguishable and provided at the latest at the time of the first interaction or exposure. It must also conform to applicable accessibility requirements.

What deadline applies to older synthetic-content systems?

Regulation (EU) 2026/1744 creates a limited transition for the provider marking duty: providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video, or text and were placed on the market before 2 August 2026 must take the necessary compliance steps by 2 December 2026. The amendment does not postpone the other duties, which apply from 2 August 2026.

Question 2

How must providers mark generated content?

Providers of systems that generate synthetic audio, images, video or text must make those outputs machine-readable and detectable as artificially generated or manipulated. This includes general-purpose AI systems.

The marking must work reliably, work with other systems and resist disruption as far as technically feasible. requires providers to consider the content type, implementation cost and generally acknowledged state of the art.

  • Record which output types the system can generate or manipulate: audio, image, video, text, or a combination.
  • Document the marking or detection mechanism, where it is applied in the generation pipeline, and how it behaves across export, editing, compression, and publication channels.
  • Document the (2) editing exclusion to the extent the system provides standard editing assistance or does not substantially alter the deployer's input data or its semantics. Record the affected functions and output types; do not assume every feature of an editing product is excluded.
  • Escalate any law-enforcement exception to legal review because limits it to uses authorised by law for detecting, preventing, investigating, or prosecuting criminal offences.

Does every AI output need a visible label?

No. (2) requires providers to make covered synthetic outputs machine-readable and detectable as artificially generated or manipulated. Visible disclosure duties for deepfakes and certain public-interest text sit mainly on deployers under Article 50(4).

Question 3

What notices do biometric and emotion systems need?

Deployers must tell people when they are exposed to an or a .

also states that personal data must be processed in accordance with the applicable EU data-protection instruments, including the General Data Protection Regulation (GDPR), Regulation (EU) 2018/1725, or Directive (EU) 2016/680 depending on the context.

  • Identify where people are exposed to the system: app flow, physical premises, camera zone, call center, interview, testing setting, or public service counter.
  • Make the notice visible before or at first exposure and align it with accessibility requirements for the channel.
  • Keep the biometric or emotion-recognition purpose, data-protection role, notice text, placement evidence, and any legal basis analysis together.
  • Use the law-enforcement exception only where the system is permitted by law to detect, prevent, or investigate criminal offences, subject to safeguards and Union law.
Question 4

When must publishers disclose deepfakes or AI text?

If a deployer uses AI to generate or alter images, audio or video that constitute a , it must disclose that the content was artificially generated or manipulated.

Deployers that publish AI-generated or manipulated text for the purpose of informing the public on matters of public interest must also disclose that the text has been artificially generated or manipulated, unless the supported human-review and editorial-responsibility exception applies.

The Commission's EU icons are optional and free to use without attribution. First check whether the content is a covered deepfake or public-interest text and whether an exception applies. Using an icon alone does not establish compliance. A non-signatory's use of an icon also does not show adherence to the voluntary Code of Practice.

  • For image, audio, or video, assess whether the content resembles existing persons, objects, places, entities, or events and would falsely appear authentic or truthful.
  • For artistic, creative, satirical, fictional, or analogous works, limits the disclosure to the existence of generated or manipulated content in an appropriate manner that does not hamper display or enjoyment.
  • For public-interest text, document whether the publication underwent human review or editorial control and whether a natural or legal person holds editorial responsibility.
  • Keep disclosure copy, publication URL or placement, content type, review owner, and exception rationale with the release record.
  • Download SVG or PNG files from the Commission's EU icons page. Choose Fully AI-Generated for covered content generated entirely by AI apart from prompting, Partially AI-Modified for human-made content altered into a deepfake or covered text, or the basic icon with a custom text label or interactive explanation.
  • Make disclosures readable and accessible by first exposure. Use clear words, visible text and enough reading time. Keep overlays from obscuring the notice. Where possible, provide image alt text or accessible interface labels (ARIA), and make interactive explanations work with assistive technologies.
  • Code signatories must implement Section 2's placement commitments. The Commission summarises these as embedding the icon in the content, except for creative works, unless an equivalent alternative such as an interface overlay is available, and keeping it visible on sharing or download. Retain the exported file and a reshared example to check that the disclosure survives publication.

When can public-interest text avoid disclosure?

(4) supports two exceptions: use authorised by law to detect, prevent, investigate, or prosecute criminal offences, or AI-generated content that has undergone human review or editorial control where a natural or legal person holds editorial responsibility for publication.

Are the EU icons mandatory?

The icons are optional and freely usable without attribution. 's disclosure duties still apply to covered deepfakes and public-interest text whether or not a deployer uses an EU icon. Article 50(4) does not require visible labels on every AI-generated output; its exceptions and limited disclosure rule for creative works still matter. Code signatories must implement the placement measures they commit to.

Do other transparency duties still apply?

Yes. leaves Chapter III requirements and other EU or national transparency duties for deployers in place.

Question 5

Are the guidelines and code binding?

The final guidelines, published on 20 July 2026, explain the Commission's interpretation of scope, definitions, exceptions, timing and provider/deployer duties. They do not replace the Regulation or bind the Court of Justice.

The marking and labelling Code of Practice was published on 10 June 2026. The Commission assessed it on 8 July 2026, and the AI Board adopted its adequacy assessment on 9 July. Signing is voluntary. Keep the legal assessment separate from the guidelines used and any code commitments made.

The 2026 amendment was published on 24 July 2026 and entered into force on 27 July. It gives providers of synthetic-content systems placed on the market before 2 August 2026 until 2 December 2026 to take the steps needed for (2) marking compliance.

  • Binding rule: map the product activity to the applicable paragraph and application date. Record the 2 December 2026 Article 50(2) transition separately for systems placed on the market before 2 August 2026.
  • Voluntary code: record whether the organisation signs, which commitments it follows, and what evidence demonstrates those commitments.
  • Final guidance: record the 20 July 2026 version and use it as Commission interpretation, not as an amendment to .
  • Change control: assign an owner to track later corrections, translations, court judgments, or amendments that alter the implementation basis.

Is the June 2026 code mandatory?

No. The code is voluntary. It may provide a structured way for signatories to demonstrate compliance with the duties it covers, but the binding duties come from and apply whether or not a provider or deployer signs the code.

Are the Commission guidelines final?

Yes. The Commission published final transparency guidelines on 20 July 2026. They state the Commission's implementation view but do not amend the Regulation or bind the Court of Justice.

Question 6

What disclosure evidence should you keep?

Keep separate evidence for provider technical marking and deployer disclosures. Record the capability that triggers the duty, the people affected, the notice or marking used, its timing and accessibility, and any exception claimed.

Include enough product or publication evidence for a reviewer to check the conclusion against and the experience people actually see.

  • Map the relevant paragraph to the system activity it affects, then note the concrete check or record needed for direct interaction, synthetic output marking, emotion recognition, biometric categorisation, deepfake disclosure, or public-interest text.
  • Provider or deployer owner, with supplier inputs if the product uses a third-party model or hosted AI system.
  • Notice text, label text, or machine-readable marking description, including language and accessibility coverage.
  • Screenshots, rendered pages, exported files, logs, or test results showing first interaction, first exposure, or published disclosure placement.
  • Exception record for obvious interactions, the (2) editing exclusion, law-enforcement authorisation, or human review with editorial responsibility. For artistic, creative, satirical, fictional, or analogous works, retain the adjusted disclosure and why it does not hamper display or enjoyment; this is a limited disclosure rule, not a complete exemption.
Get help

Review notices and generated-content markings

Sorena can help check notice wording, generated-content marking, disclosure placement, accessibility and evidence for exceptions.

Research workflow
Research AI Act requirements

Check the legal sources and answers for your use case in Research Copilot.

Explore next step
Talk to Sorena
Review your implementation

Review your AI interaction notices, generated-content markings, biometric or emotion notices, and publication disclosures with Sorena.

Explore next step
Primary sources

References and citations

European Commission - EU icons for labelling AI-generated content
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Official icon downloads, optional status, free-use licence, Article 50(4) scope, accessibility and Code placement commitments; updated 13 October 2026.
  • Official source for icon variants, downloads, free use without attribution, scope and exceptions, accessible placement and the Code's commitments.
European Commission - European Artificial Intelligence Act comes into force
ec.europa.eu
Referenced sections
  • Commission press release summarising Article 50-style specific transparency risks, including chatbot disclosures, deepfake labelling, biometric categorisation notices, emotion recognition notices, and machine-readable synthetic content marking.
"Specific transparency risk"
Regulation (EU) 2024/1689 (Artificial Intelligence Act)
eur-lex.europa.eu
Referenced sections
  • Primary legal text for Article 50 provider and deployer transparency duties, timing, accessibility, exceptions, and the 2 August 2026 application date for Chapter IV.
"Transparency obligations for providers and deployers"
Regulation (EU) 2026/1744 (Digital Omnibus on AI)
eur-lex.europa.eu
Referenced sections
  • Binding amendment published on 24 July 2026, entering into force on 27 July 2026, which revises Article 50(7) and gives providers of synthetic-content systems placed on the market before 2 August 2026 until 2 December 2026 to take the steps needed to comply with Article 50(2).
"by 2 December 2026"

Related guides

Are you the provider or the deployer? | EU AI Act

Check provider, deployer, importer and distributor roles, when changes create provider duties, and how model and system responsibilities differ.

Do you need a notified body? | EU AI Act

Find the assessment route for high-risk AI, when a notified body is required, and which declaration, CE-marking and registration records you need.

Does this tool count as AI? | EU AI Act

Check whether software counts as AI, how models differ from systems, when embedded AI is high-risk, and which scope and role evidence to keep.

How do you monitor AI after release? | EU AI Act

Understand high-risk AI monitoring under Article 72: the provider plan, deployer feedback, logs, corrective action, incidents and change reviews.

Is this industry use high-risk? | EU AI Act

See which industry AI uses fall under Annex III, when Article 6(3) can apply, and what providers must document and register.

What belongs in the technical file? | EU AI Act

See what Article 11 and Annex IV require in high-risk AI technical documentation, from system identity and testing to monitoring and retention.

Show all related guides (34)

What must general-purpose model providers do? | EU AI Act

Check general-purpose model duties, systemic-risk classification, open-source conditions, copyright, training summaries, incidents and application dates.

When must you report a serious incident? | EU AI Act

Check serious-incident outcomes, reporting roles, 15-, 10- and two-day deadlines, authority recipients, corrective action and the separate model route.

Who needs a rights impact assessment? | EU AI Act

Check who needs an Article 27 fundamental rights impact assessment, what it must cover, and how privacy assessments, notification and registration fit.

Common questions, clear answers | EU AI Act

Clear answers on AI Act scope, risk categories, provider and user duties, general-purpose models, disclosures, rights, assessments and deadlines.

EU AI Act deadlines and compliance calendar

Find the AI Act deadline for your system or model. Check high-risk dates, transparency duties, older-model transitions and the evidence to prepare.

EU AI Act fundamental rights impact assessments

Check who needs an Article 27 fundamental rights impact assessment, what it must contain and how DPIA reuse, notification and registration work.

EU AI Act GPAI model evidence checklist

Collect model documentation, integration information, copyright records and training summaries. Add testing, incident and security records for systemic risk.

EU AI Act monitoring and serious incidents

Set up high-risk AI monitoring, identify serious incidents and check reporting deadlines, recipients, deployer escalation and corrective action.

EU AI Act penalties and fines

Check the AI Act fine tiers, smaller-organisation caps, GPAI provider fines and the facts authorities consider when deciding a penalty.

EU AI Act serious incident reporting steps

Check serious-incident harm, preserve evidence and choose the reporting deadline and recipient for high-risk AI systems and systemic-risk GPAI models.

EU AI Act timeline and phased deadlines

See which AI Act rules apply now and what comes next. Check high-risk dates, older-model transitions and the difference between legal and standards dates.

EU AI Act vs ISO/IEC 42001

Compare AI Act legal duties with ISO/IEC 42001 management-system requirements. See which records can be reused and what certification does and does not cover.

EU AI Act vs NIST AI RMF

Compare AI Act legal duties with the voluntary NIST AI RMF. Map risk records to specific requirements and identify legal steps that need separate evidence.

EU AI Act: Check whether the Act applies

Use five checks to establish AI Act scope, exclusions, your role, risk categories and evidence for the decision.

EU AI Act: Choose a high-risk assessment route

Choose between provider-run internal control, notified-body assessment and a product-law procedure before release.

EU AI Act: Classify a tool before approval

Classify an AI tool or model before purchase or release. Check EU scope, prohibited uses, high-risk rules, transparency and GPAI duties.

EU AI Act: Compliance checklist

Check each AI tool, decide which duties apply, and give every action an owner and evidence link.

EU AI Act: Conformity assessment

Some high-risk systems use a provider-run assessment. Others need an authorised independent assessor or a product-law assessment.

EU AI Act: Does it apply to you?

Check whether the AI Act applies to your system or model, identify your provider or deployer role, and keep evidence for the decision.

EU AI Act: Duties for general-purpose AI models

Check GPAI provider duties for documentation, integrator information, copyright and training summaries, plus extra requirements for systemic-risk models.

EU AI Act: High-risk requirements

High-risk providers must meet system requirements before supply. Deployers must use and monitor the system under the provider's instructions.

EU AI Act: High-risk system checklist

Check the system's risk controls, data, documentation, logs, instructions, human oversight and testing before release.

EU AI Act: Is your use case high-risk?

Find high-risk AI examples in recruitment, banking, education, healthcare, public services and products. Check Article 6 conditions and exceptions.

EU AI Act: Plan your compliance work

Build a compliance plan for each AI tool: your role, the duties that apply, the evidence needed and the person responsible.

EU AI Act: Standards and quality management

Use EN 18286:2026 to organise provider quality-management procedures and keep evidence that they work for each high-risk system.

EU AI Act: Technical file and evidence templates

Build the technical file and provider records for a high-risk AI system, with owners and evidence links for each field.

EU AI Act: When must you disclose AI?

Check Article 50 chatbot notices, synthetic-output marking, biometric notices, deepfake disclosures and public-interest text exceptions.

EU AI Act: Which AI uses are banned?

Check Article 5 prohibited AI practices, the narrow exceptions, evidence to retain and the new content prohibitions from 2 December 2026.