Article 50 compliance checklist
Article 50 bundles four separate disclosure duties, not one. Most sites and products only need to worry about one or two of them — start by figuring out which apply to you.
1. Scope check — which parts apply to you?
- You run a chatbot, voice assistant, or any AI system that talks directly to people → Article 50(1) applies to you.
- You generate synthetic audio, images, video, or text with AI (image generators, voice cloning, AI writing tools shipped as a product) → Article 50(2) applies to you.
- You deploy emotion recognition or biometric categorization → Article 50(3) applies to you, on top of GDPR.
- You publish AI-generated or AI-manipulated images/audio/video (deepfakes), or AI-generated text on matters of public interest → Article 50(4) applies to you.
2. Chatbot / AI-interaction disclosure (50(1))
- Disclosure is visible at or before the first message is sent — not hidden in a Terms page.
- Text is clear and legible — not a low-contrast one-liner easy to miss.
- The disclosure survives client-side rendering — it's present in the initial page load, not injected late by JavaScript after the user starts typing.
- No reliance on the "obviousness" exception unless you're genuinely confident a reasonable person couldn't mistake it for a human.
3. Synthetic content marking (50(2))
- AI-generated images/audio/video/text carry a machine-readable marker (e.g. C2PA content credentials or an equivalent metadata standard) — a visible watermark alone isn't the same requirement, though it can help.
- Grace period nuance: systems already on the market before August 2, 2026 have until December 2, 2026 to implement marking. Any system launched on or after August 2, 2026 must mark from day one — no grace period.
- Assistive editing functions (spell-check, minor touch-ups) are generally exempt — this is about generative output, not every tool that happens to use AI.
4. Deepfake and public-interest AI text disclosure (50(4))
- AI-generated or manipulated image/audio/video content that could pass as authentic (deepfakes) must be disclosed as such.
- AI-generated text published to inform the public on matters of public interest must be disclosed, unless it underwent human editorial review and a named natural or legal person holds editorial responsibility for it.
- Artistic, satirical, or fictional works have a lighter bar — they only need to disclose that the work has been manipulated/generated, not a detailed technical label.
5. Emotion recognition / biometric categorization notice (50(3))
- Individuals exposed to the system must be informed of its operation.
- This runs alongside GDPR obligations, not instead of them — a Article 50(3) notice doesn't substitute for a proper data protection legal basis.
6. Timing and accessibility (50(5), applies across all of the above)
- Information is provided "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure."
- Format meets accessibility requirements — don't rely on a disclosure method some users literally can't perceive.
7. Paper trail
- No official "Article 50 certified" accreditation exists — anyone selling one is selling something that isn't real. What you actually want is a dated internal self-assessment record showing you reviewed each applicable obligation.
- Know which national market surveillance authority in your member state has jurisdiction, in case you're ever asked.
Our free scanner checks items 2 (chatbot disclosure) and 3 (synthetic content marking) automatically against a page's public HTML — it won't check items 4–7, those need a human review.
Run the free scan →Related reading
Sources & further reading
This checklist is general information, not legal advice, and not a substitute for review by a qualified professional. It's a starting point for self-assessment, not proof of compliance.