Who must comply with Article 50 — the AI vendor or the company using the AI?

Both, for different duties: providers carry 50(1) disclosure-by-design and 50(2) marking; deployers carry 50(3) emotion/biometric information and 50(4) deepfake and text disclosure. SME app makers are frequently both at once.

We build on a major foundation model — does Article 50 fall on them?

No. The final guidelines attach Article 50 to systems, not models: the application provider bears the duties, while upstream model providers must facilitate compliance under their own obligations.

Does Article 50 apply to companies outside the EU?

Yes — where the system is placed on the EU market or its output is used in the Union, with no establishment threshold. Only incidental, unforeseeable downstream EU use falls outside.

Kilde › Guides › AI Act Art 50 › Provider or deployer: sorting the four…

Provider or deployer: sorting the four Article 50 duties, including for non-EU companies

Current to 26 August 2026 · updates land in the changelog.

Half of Article 50 confusion is role confusion. Four duties, two roles: providers — who develop a system or have it developed and place it on the market under their name — carry 50(1) (interaction disclosure by design) and 50(2) (machine-readable marking). Deployers — who use a system under their authority — carry 50(3) (emotion/biometric information) and 50(4) (deepfake and public-interest-text disclosure).

The mapping, duty by duty

Duty	Role	In one line
50(1) interaction disclosure	Provider	Build the system so people know they're dealing with AI — chatbots, agents, voice
50(2) machine-readable marking	Provider	Generated content carries machine-readable marks
50(3) emotion/biometric information	Deployer	Inform exposed persons
50(4) deepfakes & public-interest text	Deployer	Disclose the artificial content you publish

An SME app maker running its own generative product and publishing its outputs is routinely both — and walks all four columns.

The wrapper question — settled

The final guidelines resolved the value-chain allocation: Article 50 attaches to systems, not models. The application-layer provider bears 50(1)/(2); upstream GPAI providers facilitate compliance under Articles 53–55. Building on a major model does not delegate your duties upstream — with a narrow residual caveat for fine-tuning and API edge cases the guidelines left unframed.

Non-EU companies: in scope through output

Article 2's reach covers non-EU providers placing systems on the EU market and non-EU providers and deployers where the system's output is used in the Union — no establishment threshold, no SME carve-out from the duties themselves. The guidelines' one softener: incidental, unforeseeable downstream EU use alone does not create scope. For everyone selling into Europe from outside it, the practical test is whether EU use is part of the business — not where the company sits. Penalties scale the same way; see the €15M/3% regime and its SME cap.

Related guides

Quick answers

Who must comply with Article 50 — the AI vendor or the company using the AI?: Both, for different duties: providers carry 50(1) disclosure-by-design and 50(2) marking; deployers carry 50(3) emotion/biometric information and 50(4) deepfake and text disclosure. SME app makers are frequently both at once.
We build on a major foundation model — does Article 50 fall on them?: No. The final guidelines attach Article 50 to systems, not models: the application provider bears the duties, while upstream model providers must facilitate compliance under their own obligations.
Does Article 50 apply to companies outside the EU?: Yes — where the system is placed on the EU market or its output is used in the Union, with no establishment threshold. Only incidental, unforeseeable downstream EU use falls outside.

Ship the disclosures before enforcement finds the gap.

The AI Act Article 50 Kit: the disclosure copy library (English + 中文), the marking implementation guide with survival-test protocol, deepfake and text-labeling walkthroughs, obviousness and scope memos, the evidence log, the Code of Practice accession path — built from the regulation and the final guidelines, with pinpoint citations.

Get the kit — US$190 Free 4-page sample (PDF)

Instant download · 14-day unconditional refund · single-organisation licence · full product page

General information only — not legal advice, and no clearance opinions. Sources are Regulation (EU) 2024/1689 (Articles 50 and 99), Regulation (EU) 2026/1744, the Commission's final Article 50 guidelines of 20 July 2026 (non-binding) and our audited kit research. Marking-technology status changes fast: treat vendor announcements as live only once verified. © 2026 Kilde.

Built by Kilde's founder, a practising attorney admitted to a US state bar (not an EU or Hong Kong admission). About · Verification log · Refunds · Terms · Privacy · esau@trykilde.com