Article 50 of the AI Act is live, and the real test is about to start

The rule that came into force on a quiet summer day

On 2 August 2026, Article 50 of the EU AI Act began to apply ^[1]. It says people must be told when they're talking to an AI, and that AI-generated images, audio and video must carry a machine-readable marking. If you publish AI-generated text to inform the public and no person has reviewed it and stands behind it, you must say so.

The rule is three paragraphs, straightforward once you read them. The trouble is proving you followed them six months later, when a customer says your chatbot never told them it was AI, or when a regulator asks how you know which images got marked.

It's like being asked for a receipt from your pocket for something you bought last spring. You probably paid, but can you show it?

What Article 50 actually requires

The obligations break into three:

1. Notice for interaction. Providers of AI systems that interact with people must design them so users are informed they're dealing with AI, unless it's obvious from the circumstances ^[1].

2. Marking for generated content. Providers of systems that generate images, audio or video must ensure the outputs are marked in a machine-readable format and detectable as AI-generated. This applies to deepfakes too ^[1].

3. Labelling of unreviewed text. When someone publishes AI-generated text to inform the public and no human has reviewed it, they must label it as AI-generated ^[1].

The penalties reach up to €15 million or 3% of global annual turnover, whichever is higher ^[1]. For smaller organisations the lower figure applies, but it's still serious money.

The Code of Practice is voluntary but recognised

The European Commission published a voluntary Code of Practice in early 2026 ^[2]. It sets out practical ways to meet Article 50's transparency requirements, covering notices, watermarking and metadata standards.

More than 400 organisations have signed it, including most of the large AI developers ^[2]. Following the Code won't guarantee compliance in every case, but it gives you a recognised route and shows you tried.

Skadden, the US law firm, published a podcast on 9 October 2026 walking through the Code and what it means for businesses ^[3]. Their view: the Code is useful, but remember it's guidance, not law. The law is Article 50 itself.

Where the evidence question lands

Say a customer contacts your regulator six months from now. They say your chatbot never told them it was AI, and they relied on its answer. Your records show the notice was displayed. Their screenshot doesn't.

Or say you run an e-commerce site with product photos touched up by a generative model. A supervisor asks which images were AI-generated between March and May, and how you marked them. You have a list, but can you show it hasn't been edited since?

These aren't far-fetched scenarios. Pixofix, writing about Article 50 for e-commerce brands, pointed out that the marking requirement applies to manipulated images as well as fully generated ones ^[4]. That pulls in a lot of product photography.

The law tells you what to do. It doesn't tell you how to prove you did it.

How a digital witness fits here

This is a case where a digital witness has a clear role.

The thing to seal is each event that matters under Article 50: the fact that a notice was shown to a user at the start of a conversation, or a record of which images were marked and when. You seal a fingerprint of the record, not the content, so the data stays with you.

When a notice is displayed, your system sends a fingerprint of that event (user session, timestamp, notice text) to WitniumChain through the REST API, SDK or MCP server, and gets a witness ID back. If it's questioned months later, you share the record and the witness ID. Anyone can calculate the fingerprint again and check that it matches the sealed one.

For generated content, you seal a manifest of what was created, when and by which model version. Say an image is questioned. You show the original, the manifest and the witness ID. If the fingerprint matches, nothing has changed since the day you sealed it.

What it shows is that the record existed at that time and hasn't been altered since, even by someone with administrator access. What it doesn't show is that the marking was applied correctly in the first place, or that the notice was clear enough. Those are separate questions.

The first 2,000 witnesses a month are free. After that it's pay-as-you-go.

How it would work

1. Your chatbot displays the Article 50 notice. The backend seals a fingerprint of the event (session ID, timestamp, notice version).
2. Six months later, a user disputes ever seeing the notice. You retrieve the record and share it with the witness ID.
3. The regulator, or anyone you give it to, calculates the fingerprint and checks it against the sealed one. If it matches, the record is unchanged.

What this means for you

If you provide or deploy AI that talks to people or generates content, a few questions are worth asking now:

• Do we log each time the Article 50 notice is shown, and can we show that log hasn't been edited?
• For generated images, audio or video, do we keep a record of what was created, when and by which system?
• If a regulator or a customer asks for proof six months from now, what do we actually have?
• Does our current logging give us a record we can stand behind, or just a file we could have quietly changed?

These aren't questions the law answers for you. The law says what you must do. Whether you can prove you did it is up to you.

What to watch

The first enforcement actions under Article 50 will set the tone. No major cases have been reported yet, but that's likely because the rule is only a few months old.

Watch for guidance from national regulators on what counts as an adequate record. The Code of Practice is a start, but enforcement will clarify what holds up and what doesn't.

And if you're using AI agents that act on behalf of users, keep an eye on how Article 50 applies to them. The law doesn't yet spell that out in detail, but the transparency principle is the same: people should know when they're dealing with AI.