Article 50 for Critical Infrastructure AI: Transparency and Disclosure
How Article 50 (transparency) applies to critical infrastructure AI: chatbots, synthetic content, dates and fines.
Providers of AI systems that interact with people or generate synthetic content must disclose this. So must deployers using emotion recognition or generating deep fakes (Article 50).
The Act has no sector-wide critical-infrastructure regime, and Article 50 has no risk-class test. The duties apply since 2 August 2026 (Article 113). Fines go up to EUR 15 million or, for an undertaking, up to 3% of worldwide annual turnover, whichever is higher (Article 99(4)). Next step: check each chatbot and content generator against Article 50(1)–(4).
Article 50, paragraphs 1 to 4, sets the disclosure duties
Each paragraph names who must disclose. Each also has an exception for uses authorised by law to detect, prevent, investigate or prosecute criminal offences; paragraphs 1 and 3 attach conditions.
- Art. 50(1)Systems that interact with people (provider)
Providers must design systems intended to interact directly with natural persons so that those persons are informed they are interacting with an AI system, unless this is obvious to a reasonably well-informed, observant and circumspect person given the circumstances and context of use.
- Art. 50(2)Marking synthetic output (provider)
Providers of systems that generate synthetic audio, image, video or text must ensure that outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. The duty does not apply to the extent the system performs an assistive function for standard editing or does not substantially alter the input data or its semantics.
- Art. 50(3)Emotion recognition and biometric categorisation (deployer)
Deployers of an emotion recognition system or a biometric categorisation system must inform the natural persons exposed to it of its operation, and process personal data in accordance with the applicable data protection law.
- Art. 50(4)Deep fakes and published text (deployer)
Deployers of a system that generates or manipulates image, audio or video content constituting a deep fake must disclose that it is artificially generated or manipulated. The same applies to text published to inform the public on matters of public interest, unless the text has undergone human review or editorial control and a person holds editorial responsibility. For an evidently artistic, creative, satirical or fictional work, the duty is limited to disclosing the existence of the generated content in a way that does not hamper the display or enjoyment of the work.
- Art. 50(5)How and when to inform
The information must be clear and distinguishable, given at the latest at the first interaction or exposure, and conform to the applicable accessibility requirements (Article 50(5)).
Article 50 applies to critical infrastructure AI without a risk-class test
The question is what the system does, not which Annex it is in.
The Act has no sector-wide critical-infrastructure regime
The Act has no sector-wide critical-infrastructure regime. This site uses the word for AI used in electricity, gas, heating and water supply, road traffic and digital infrastructure. Article 50 does not depend on a sector or an Annex: it applies to what a system does, whether or not the system is high-risk.
High-risk systems carry both sets of duties
A system that is high-risk under Annex III point 2 and also has a chat interface carries the Article 50 duties since 2 August 2026 and the Chapter III duties from 2 December 2027. Article 50 does not affect the requirements and obligations set out in Chapter III (Article 50(6)).
Examples by paragraph
Example: a customer chatbot of an energy or water utility, or an assistant that answers questions from control-room staff, interacts directly with natural persons (Article 50(1)). Example: a tool that generates reports, images or voice messages generates synthetic content and is covered by the provider’s marking duty (Article 50(2)); an operator that only uses it is a deployer, and its duties come from Article 50(3) and (4), where they apply, not from Article 50(2).
Dates
Article 113 applies the Regulation from 2 August 2026; Chapter IV, which contains Article 50, is not among the provisions to which points (a) to (d) give another date. Providers of systems that generate synthetic content and were placed on the market before that date must take the necessary steps to comply with Article 50(2) by 2 December 2026 (Article 111(4)). The Act gives no grace period for Article 50(1), (3) and (4).
Fines
Breaches of the transparency obligations of providers and deployers in Article 50 can be fined up to EUR 15 million or, for an undertaking, up to 3% of total worldwide annual turnover in the preceding financial year, whichever is higher (Article 99(4), point (g)). For SMEs, including start-ups, each fine is capped at whichever is lower (Article 99(6)). The same cap applies to small mid-cap enterprises (Article 3(14b), Article 99(6a)). Each Member State lays down rules on to what extent administrative fines may be imposed on public authorities and bodies established in that Member State (Article 99(8)).
Limits of the Act’s scope
The Act applies to providers that place AI systems on the market or put them into service in the Union, or place general-purpose AI models on the market in the Union, wherever they are established (Article 2(1), point (a)), and to providers and deployers in a third country where the output of the AI system is used in the Union (point (c)). It does not apply to areas outside the scope of Union law and does not affect Member States’ competences on national security, nor to AI systems used exclusively for military, defence or national security purposes (Article 2(3)). The Act does not apply to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development (Article 2(6)). It does not apply to research, testing or development before a system or model is placed on the market or put into service; testing in real world conditions is not covered by that exclusion (Article 2(8)). It does not apply to AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk AI systems or as an AI system that falls under Article 5 or 50 (Article 2(12)). Natural persons who use a system in the course of a purely personal non-professional activity are not bound as deployers (Article 2(10)).
What the Act leaves open for critical infrastructure
No critical-infrastructure rule, no label format
Article 50 has no critical-infrastructure rule. It names no wording or icon; the marking duty asks for a machine-readable format and detectability, taking into account the generally acknowledged state of the art, as may be reflected in relevant technical standards (Article 50(2)). The Commission is to develop guidelines on Article 50 (Article 96(1), point (d)).
Codes of practice
The Commission is to encourage and facilitate codes of practice on detecting, marking and labelling artificially generated content, and assesses whether adherence is adequate for the obligations in Article 50(2) and (4). If it deems a code inadequate, it may adopt an implementing act specifying common rules (Article 50(7)). The article does not make adherence mandatory.
Human review
The exception for human review or editorial control sits in Article 50(4), for published text. Article 50(2) has no such exception; its exceptions are assistive standard editing, no substantial alteration of the input or its semantics, and authorisation by law for criminal-offence purposes.
No labelling duty for alarms, forecasts or reports
Article 50 names no duty specific to alarms, forecasts, work orders or operating reports. A deployer’s disclosure duty arises only in the cases of Article 50(3) (emotion recognition and biometric categorisation) and Article 50(4) (deep fakes and published text on matters of public interest).
Other transparency law
Article 50 is without prejudice to other transparency obligations laid down in Union or national law for deployers of AI systems (Article 50(6)). Whether other law requires further information to customers or the public is not answered by the Act.
Questions about Article 50 in critical infrastructure
Must a customer chatbot of a utility tell users it is an AI system?
Yes, unless this is obvious to a reasonably well-informed, observant and circumspect person given the context of use. The provider must design the system so that the person is informed (Article 50(1)), at the latest at the first interaction (Article 50(5)).
Must a utility label AI-written outage notices or reports?
Article 50 sets no labelling duty specific to notices or reports. The marking duty in Article 50(2) is on the provider of the generating system. A deployer must disclose AI-generated text only where it is published to inform the public on matters of public interest and has not undergone human review or editorial control with a natural or legal person holding editorial responsibility (Article 50(4)).
Does Article 50 apply to a control-room anomaly-detection system?
Article 50 looks at what a system does. Paragraph 1 applies to systems intended to interact directly with natural persons, paragraph 2 to systems generating synthetic audio, image, video or text content, paragraph 3 to emotion recognition and biometric categorisation systems, and paragraph 4 to deep fakes and published text. A system whose output is a measurement, a forecast or an alarm is not described in those terms. If it is high-risk under Annex III point 2, Chapter III applies separately (Article 50(6)).
Related pages
Article 50: Transparency & Disclosure Requirements
Article 50 for all sectors: the four duties, exceptions, dates and fines.
EU AI Act Compliance for Critical Infrastructure
The critical infrastructure overview: how the Act reaches AI in energy, water, road traffic and digital infrastructure.
Article 53 in Critical Infrastructure: Obligations of General-Purpose AI Model Providers
Critical infrastructure AI and Article 53: model providers, documentation, copyright and training-data summary.
Prohibited AI Practices Under Article 5
The banned practices, including emotion inference at work and in education.
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.