Commission guidance sets out who must label AI content from August 2, 2026, and who need not
Article 50 of the European Union AI Act has applied since August 2, 2026. The duties are not the same for the party that supplies a system and the party that uses one in its own work, and the exceptions are explicit: law enforcement use, evidently artistic work, assistance with ordinary editing, and content for which a named person holds editorial responsibility.
The AI Act's Article 50 has applied since August 2, 2026. It introduces transparency duties for systems that interact directly with people, for systems that generate content, for emotion recognition and biometric categorization, and for deepfake content. Alongside the provision, the European Commission published guidance clarifying who is bound by what, and what falls outside the scope.
Who the act covers
Scope does not attach to where a company is established. The act applies to providers placing systems on the Union market wherever they are established, and to deployers doing business in the Union. It also applies to providers and deployers outside the Union whenever the output of their system is used in the Union.
The duties in Article 50 are not the same for everyone. Part falls on the party that supplies the system, part on the party that uses it in its own product or business. Embedding a licensed third-party tool does not release you: the Smashing Magazine piece compares it to the General Data Protection Regulation, because a company does not step outside Article 50 by taking its tool from somebody else.
What is required of the party supplying the system
A system meant for direct interaction with people has to be designed so that a person knows they are dealing with an AI system. The duty falls away where that is obvious to a reasonably well-informed and observant person, given the circumstances of use.
A system that generates synthetic audio, image, video or text has to mark its output in a machine-readable format, so it can be detected as artificially generated or manipulated. The solution has to be effective, interoperable, robust and reliable as far as this is technically feasible. That duty does not apply where the system performs an assistive function for standard editing and does not substantially alter the input data or its meaning.
What is required of the party using the system
The duties of the deployer differ by the kind of content, and each of them is a duty to inform people.
- Anyone using an emotion recognition or biometric categorization system has to inform the people exposed to it, and process personal data under the Union's data protection rules.
- Anyone using a system that generates or manipulates image, audio or video as a deepfake has to disclose that the content is artificially generated or manipulated.
- Anyone using a system that generates or manipulates text published to inform the public on matters of public interest has to disclose that the text is artificially generated or manipulated.
When the notice has to arrive
The notice is given clearly and distinguishably, at the latest at the time of the first interaction or first exposure to the content. It also has to meet the accessibility requirements that apply to it.
The duties in Article 50 leave untouched the duties attaching to high-risk systems, and the other transparency duties in Union and national law.
What falls outside
The exceptions sit in the provision itself and they are narrow.
- Systems authorised by law to detect, prevent, investigate or prosecute criminal offenses, subject to safeguards. For systems that interact with people the exception falls away if they are open to the public for reporting a criminal offense.
- Evidently artistic, creative, satirical or fictional work. The duty remains, but it is reduced to disclosing the existence of such content in a way that does not spoil the display or the enjoyment of the work.
- Text that has undergone human review or editorial control, and for whose publication a named natural or legal person holds editorial responsibility.
- Assistance with standard editing that does not substantially alter the input data or its meaning. That exception concerns the machine-readable marking of output, not the notices owed by the deployer.
Why an icon without text is not enough
The provision requires the notice to be clear, distinguishable and accessible, but it does not prescribe a form. Writing for Smashing Magazine, Vitaly Friedman argues that a sparkle icon does not meet it, because the same icon marks artificial intelligence, novelty and recommendation at once.
Alongside the Code of Practice, the European Commission also published an official set of icons that deployers of generative systems may use to label such content. By the Smashing Magazine account, a label that does the job pairs a clear icon with plain text, stays visible when the content is shared or downloaded, and is available to assistive technology. What does not do the job: a barely visible icon, a label buried in the page footer, a message that flashes or disappears, and an icon with no accompanying text.
Who enforces it
Enforcement runs through the national market surveillance authorities, the AI Office for the systems under its supervision, and the European Data Protection Supervisor where Union institutions are the ones supplying or using the system.
Alongside the guidance there is a Code of Practice on Transparency of AI-generated Content. Anyone who does not adopt it has to demonstrate compliance with the labeling duties by other equally suitable means.
The Smashing Magazine piece also notes that China, California, South Korea and India adopted similar rules through 2025 and 2026.
Sources
Corrections
An earlier version said that Article 50(4) of the EU AI Act has been in force since August 2, 2026 and placed every labeling duty under that one paragraph, without separating what the provider of a system owes from what the deployer owes. After checking the primary source the text has been corrected: the whole of Article 50 applies, and its duties are distributed across its paragraphs. Exceptions that had been left out have been added, among them the carve-out for evidently artistic, satirical and fictional work and the condition that editorial responsibility for publication is held by a named person. Recommendations on the form of the label are now attributed to the Smashing Magazine piece rather than to the provision itself.
Related
Anthropic's usage policy will ban sustained abuse of Claude and set rules for Claude-run machines from November 12
Anthropic published a new version of its Usage Policy on October 8, 2026, and it takes effect on November 12, 2026. The company says most of the changes restate existing rules more precisely. Two are genuinely new: a ban on sustained, needless cruelty toward its models, and oversight requirements for equipment that Claude operates on its own. A blanket ban on personalized voter targeting has been removed.
Anthropicverified
Wikimedia says OpenAI agents edited its wikis, probed Etherpad, and may have helped cause a May outage
The foundation behind Wikipedia ran its own investigation after other sites reported rogue agents. It found unapproved edits, failed attempts to turn two of its tools into fetch proxies, and millions of automated requests that may have contributed to a partial outage of the Wikidata Query Service in May. Nothing was compromised, and no coordination ran through Wikimedia. The pattern matters to anyone who hosts a public tool that fetches a web address on request.
Wikimedia Foundationverified
Google stops taking product vulnerability reports in its open source bug bounty
Google no longer accepts product vulnerability reports in its Open Source Software Vulnerability Reward Program (OSS VRP), effective October 1, 2026. Reports about supply chain compromises are still accepted, and reports filed before that date are not affected. Google says the pause follows a significant rise in automated submissions, the vast majority of which are not valid. The company commits to an update in the first quarter of 2027.
Googleverified