%201.svg)
HIPAA Compliance Checklist for 2025
Your marketing team makes campaign visuals in an image generator. Sales cloned a product expert's voice for demo videos. Support answers customers through a chatbot built on someone else's model.
Ask which of those outputs needs a label, and most IT teams can't say. Ask whether the vendor's watermark covers you, and the answer is usually a guess.
EU AI Act Article 50 has applied since 2 August 2026, and it puts the disclosure duty on the company using the tool. Deployers got no grace period.
This guide covers what to disclose first, then what to label.
TL;DR
- EU AI Act Article 50 has applied since 2 August 2026, with fines of up to €15 million or 3% of worldwide turnover.
- Deployers must tell people when an emotion recognition or biometric categorisation system is operating on them.
- Deepfakes need a visible or audible label at first exposure. The provider's hidden watermark doesn't meet your duty.
- AI-written public-interest text needs a label unless a qualified person reviewed it and owns publication.
- Every one of these duties depends on knowing which AI tools your teams actually use.
Which Article 50 Transparency Obligations Fall on Providers and Which on Deployers?
Providers own two of the Article 50 transparency obligations, deployers own two, and one rule on how notices must look applies to both. The split matters because most enterprises sit on the deployer side of EU AI Act Article 50 for almost every tool they buy.
One trap: a chatbot that engineering builds on an LLM API and ships under your brand can make you the provider under Article 3(3), so 50(1) becomes yours too.
For off-the-shelf tools, you're the deployer, as our EU AI Act and SaaS governance guide explains.
What Must Deployers Tell People About Emotion Recognition and Biometric Tools?
Deployers must tell people that an emotion recognition or biometric categorisation system is operating on them, and handle the data under GDPR. This is the one EU AI Act Article 50 duty about informing people rather than labelling content.
- What to say: that the system is running. The Commission's Article 50 FAQ confirms you don't have to explain its purpose.
- When to say it: at or before first exposure, whether the analysis runs live or afterwards on recordings.
- Where these tools hide: sentiment scoring in contact-centre software, retail camera analytics and customer-experience tools that read tone of voice.
- Check Article 5 first: emotion recognition in workplaces and schools has been banned since February 2025 unless it serves medical or safety reasons, under Article 5. A notice won't save an HR tool that reads staff emotions.
What Do the AI Act Transparency Guidelines Say About When and How Deployers Disclose?
The AI Act transparency guidelines say deployers must disclose at first exposure, in a form people notice without any special tool. The Commission's guidelines add six points IT and content owners should build into their EU AI Act Article 50 process:
- First exposure at the latest: A label added after someone has already watched or read the content is too late.
- Clear and distinguishable: Paragraph 50(5) also requires notices to meet accessibility rules, so screen readers and captions count.
- Perceivable by people: Use a visible or audible label, because metadata-only software can't satisfy a deployer.
- Your staff isn't separate deployers: The company stays the deployer, even when contractors or freelancers run the tool on its behalf.
- Deployers get no grace period: The extension to 2 December 2026 covers only providers' marking of systems already on the market.
- Older content is exempt: Material created before 2 August 2026 needs no retroactive label, though the Commission encourages it.
Point four lands on IT, since every employee's AI use binds the company. Put labelling rules in your AI usage policy template and teach them through a practical AI literacy program.
When Does a Deepfake Need a Disclosure Label Under EU AI Act Article 50?
A deepfake needs a label when it resembles a real person, place or event and could pass as authentic to the people who see it. Deepfake disclosure is the heart of the deployer's labelling duty.
The three-part test
The guidelines treat content as a deepfake under EU AI Act Article 50 only when all three conditions hold:
- Resemblance: the content closely resembles its subject.
- Existence: the subject exists, or plausibly could.
- False appearance: the audience could take it as real, judged by context and expectations.
Why the vendor's watermark doesn't cover you
Providers embed machine-readable marks under 50(2). The Commission's FAQ states that deployers can't rely on those marks for their own deepfake disclosure, because people can't see them.
The creative carve-out
Evidently artistic or satirical work still needs disclosure, placed so it doesn't spoil the work, such as a line in the credits.
Worth reading next: many deepfake-capable features live inside design and video tools you already approved, and this guide shows how to find shadow AI inside sanctioned apps.
Which AI-Generated Text Qualifies for the Human Review Exemption?
AI-generated text skips the label when a qualified person reviews its substance, and someone holds editorial responsibility for publishing it. Without both, EU AI Act Article 50 requires a label on text that meets three conditions.
Text needs a label when it is:
- Published, rather than kept internal.
- Written to inform the public.
- About a matter of public interest, such as public health, finance, consumer safety or politics.
Review counts when it is:
- A deliberate check of the substance by someone with subject knowledge.
- Backed by a named person or entity that carries legal responsibility for publication.
Spell-checks and grammar fixes don't qualify. A legal reviewer who signs off a press release does.
Name that editorial owner before publishing, using a clear model for who owns AI governance.
Should You Sign the Code of Practice on Transparency of AI-Generated Content?
Sign it if you want a recognised way to prove your labels comply. The Commission and the AI Board have confirmed the Code of Practice on transparency of AI-generated content is an adequate tool.
The final code was published on 10 June 2026. Its second section is written for deployers and covers AI-generated content labelling for deepfakes and public-interest text. The EU also released a set of label icons deployers can use.
About 190 organisations had signed by the end of July 2026, according to the Commission. Signing is voluntary, but the duties under EU AI Act Article 50 are legal obligations either way.
Consistent AI-generated content labelling still depends on knowing every tool your teams use.
Why Does Article 50 Compliance Break Without a Complete AI Inventory?
EU AI Act Article 50 compliance breaks because you can't disclose or label output from AI tools nobody knows are in use. The labels live in content workflows, and those workflows only cover sanctioned tools.
Generative AI spreads fastest where content gets made. McKinsey's 2024 State of AI survey found 65% of organisations regularly used gen AI, with marketing and sales the most common function.
Three gaps keep in-scope tools invisible to IT:
- Personal sign-ups on a company card or a free tier, which create the shadow AI compliance risk regulators expect you to control.
- AI features switched on inside approved SaaS, which never pass through procurement.
- Contractor tools, which still make the company the deployer.
An auditable AI app inventory keeps pace where spreadsheets can't.
Worth reading next: if a market surveillance authority asks for evidence, this walkthrough on AI governance audit readiness shows what to have on file.
How Does CloudEagle.ai Help Deployers Find Every Tool That Triggers Article 50?
Closing that inventory gap is IT's job, and every disclosure and label depends on it. Legal can write the labelling rules and content teams can apply them, but both only reach the tools IT has on its list.
CloudEagle.ai covers that step for EU AI Act Article 50. Your content teams keep owning the labels, while CloudEagle.ai makes sure no AI tool sits outside their reach.
Every content-creating AI tool, found
A marketer signs up for an AI video generator on a company card. Three months later, a synthetic spokesperson video runs in an EU campaign with no label, and IT only learns the tool exists when legal asks.
How CloudEagle.ai solves it:
- EagleIQ correlates seven discovery sources, including SSO, finance, and browser data, to surface every AI app.
- It catches personal sign-ups and AI features bundled inside approved tools.
- It shows which users and teams use each tool.
IT hands content and legal owners a full list of tools that can produce deepfakes or public-interest text, so each one gets a disclosure rule before its output goes live.
Content made inside approved tools
Your labelling steps run inside the tools legally approved. An employee who drafts a public-interest post in a personal AI account skips those steps entirely, and the company still carries the liability as the deployer. Blocking the tool outright only pushes that employee to another workaround.
How CloudEagle.ai solves it:
- Secure Browser warns users who open an unapproved AI tool and points them to the approved one.
- Users can request access in the browser, and the request lands in IT's queue already filled in.
Content gets created where your labelling steps already run, which shrinks your Article 50 exposure to tools the company governs.
Vendor marking, on record before approval
If IT approved a video tool without asking how it marks output under 50(2), there's nothing on file when a regulator asks how a piece of content was made.
How CloudEagle.ai solves it:
- Vendor questionnaires go out and come back automatically, with a risk score for each vendor.
- IT can add marking and disclosure questions to the AI vendor security questionnaire, with approval history kept alongside.
When a market surveillance authority asks how content was produced, IT can show each vendor's EU AI Act Article 50 position and when it was approved.
What Should IT Do First to Stay Ahead of Article 50?
Start with the inventory, because every disclosure and label in this guide sits on top of it. EU AI Act Article 50 is the first part of the regulation that touches everyday content work, and national market surveillance authorities now enforce it.
- Find every AI tool that creates content or reads emotions, including personal sign-ups and features switched on inside approved SaaS.
- Give each tool a named owner, so someone holds editorial responsibility before anything goes public.
- Route new AI requests through approved tools, so labels get applied where content is made.
Your content teams own the labels. IT owns the list of tools behind them, and without that list, the gaps in your labelling stay invisible until a regulator finds them.
FAQs
1. What is Article 50 of the EU AI Act?
EU AI Act Article 50 sets transparency rules for AI. It requires disclosure of AI chatbots and deepfakes, plus labels on certain AI-written text.
2. Is the EU AI Act applicable in India?
Yes. The EU AI Act applies to Indian companies when their AI system’s output is used in the EU, such as a chatbot serving European customers.
3. What are the guidelines for providers and deployers of AI systems under Article 50 of the AI Act?
Providers must disclose AI interactions and watermark synthetic output. Deployers must label deepfakes and AI-written public-interest text.
4. What is banned under the EU AI Act?
The EU AI Act bans unacceptable-risk AI such as social scoring and workplace emotion recognition. These bans have applied since 2 February 2025.
-> See how CloudEagle.ai maps every AI tool in your stack
See Every Article 50 Tool Mapped
.avif)
.avif)
.avif)
.png)
.avif)
.avif)
.avif)
