AI labeling without panic: what Article 50 actually requires
Since 2 August 2026, the transparency obligations under Article 50 of the EU AI Act have been in force. Since then, consultants have been piling on the scare tactics: label everything, immediately, or face fines of up to 15 million euros. I looked at the whole thing from a server operator's perspective – someone running a local language model, a few n8n workflows, and occasionally publishing text. The result is a lot calmer than the headlines suggest.
First, work out which of the four boxes you're in
Article 50 covers four situations, and you only have an obligation if you fall into one of them. Crucially, this isn't about "high-risk" systems – the transparency obligations apply to every AI system, including open source. But they only apply in these four cases:
- Direct interaction with people. Chatbots, assistants, phone bots. The provider must build them so users notice they're talking to an AI.
- Synthetic content. Anyone generating text, images, audio, or video must mark the outputs in a machine-readable format and make them detectable.
- Emotion recognition and biometric categorisation.
- Deepfakes and publicly relevant text. Anyone publishing AI-generated text with the purpose of informing the public must disclose it.
The core of my work: I run a local model through Ollama and process its output in my own workflows. Does that make me a "provider" or a "deployer"? That distinction is the first step most people skip.
- A provider puts an AI system on the market – develops or operates it and makes it available to others.
- A deployer uses it on their own responsibility to produce or publish something.
Anyone who just runs their own model on their own server without offering it to customers is, in the vast majority of cases, a deployer, not a provider. That changes a lot, because the obligations differ.
The point where it gets technically thin
The machine-readable marking from Article 50(2) is technically interesting and, at the same time, the weakest link. For images and video, there's now a working standard: C2PA, the Content Credentials. An image carries metadata that proves whether and how it was generated by an AI.
Text is different. A local model that sends me an answer over an API doesn't write a C2PA field into any file on its own. There simply isn't an established, widely supported way to mark a plain-text paragraph as AI-generated in a "machine-readable" manner. Anyone seriously trying to make their text output C2PA-compliant today is looking at a toolbox that hasn't been assembled yet.
That's no reason to panic – it's a reason to be honest. For most operators, machine-readable marking of text simply isn't cleanly implementable today. The Commission is working on guidelines and a Code of Practice, but the practical standards aren't final yet. Systems already on the market before 2 August 2026 have a grace period until 2 December 2026 anyway.
What I actually do – and what I don't
Rather than waiting for the perfect standard, I've worked out a simple classification for my three real use cases:
The blog. Here I (or my agent) write texts that I read and edit before publishing. Article 50(4) has an exception for exactly this: anyone publishing AI-generated text on matters of public interest doesn't have to label it if human review takes place and someone carries editorial responsibility. That's precisely my situation – and it's the most honest solution, because it doesn't just meet the letter but also the spirit: the reader doesn't get raw model output, but something I've read and take responsibility for.
The agents and reports. My assistant produces summaries and analyses every day. These are internal artefacts, not publications for the public. The transparency obligation simply doesn't apply here – nobody is being deceived about the content, because it never goes out.
A customer-facing chatbot. I don't currently have one. If I built one, the case would be clear: the system must make it obvious from the start that an AI is answering – not hidden in the terms and conditions, but in the first moment of interaction. A one-line notice in the chat usually isn't enough to count as "clear and distinguishable"; the guidelines require it to actually stand out.
The common thread: work out the box first, then meet the minimum obligation. Someone running a chatbot has a different obligation than someone editing a blog. Most scare-tactic scenarios fall apart the moment you ask which of the four situations even applies.
The checklist I gave myself
Short and concrete – that's all you need to start with:
- Which of the four situations from Article 50 applies to me? If none: nothing to do.
- Am I a provider or a deployer? That determines which obligation I have.
- Does my AI output reach people or the public? Internal output stays out of scope.
- Do I have human review and editorial responsibility for public texts? Then the Article 50(4) exception applies.
- For anything that really goes out: label it in the first moment, clearly visible, not hidden.
The fines of up to 15 million euros or 3 percent of turnover are real – but they hit the person deceiving people with deepfakes or passing a bot off as human, not the one running their own model for internal reports.
What I take away
For me, Article 50 is above all a reason to cleanly separate: what's internal, what goes out, and who carries responsibility for what goes out. I would have needed that separation anyway – the law just forces me to make it explicit.
And as so often: work out the box first, then build. Whoever panics and plasters a label on every text, or spends weeks on a C2PA integration for text that doesn't cleanly exist yet, hasn't understood the problem. The first step isn't the technology – it's the question of which box you're in at all.