The EU AI Act after the Omnibus: transparency obligations under Article 50

Since the Digital Omnibus on AI, Regulation (EU) 2026/1744, came into force on 27 July 2026, a common message has reached boardrooms: the AI Act has been postponed, and businesses have until 2027.

For high-risk AI systems, that is broadly correct. For transparency, it is not. The transparency obligations in Article 50 of the AI Act have applied since 2 August 2026, and the last transitional period ends on 2 December 2026.

Article 50 is also the part of the AI Act that reaches the most businesses. It does not depend on whether a system is high-risk. It applies to anyone who offers a chatbot, generates images, video, audio or text with AI, or publishes AI-generated content.

This article explains what the Omnibus changed and what it did not. It covers who counts as a provider or a deployer, what each must do under Article 50, how the rules will be enforced in Cyprus, and the questions businesses should be asking. It draws on the European Commission's Guidelines on Article 50 and its accompanying FAQ, both published in July 2026.

It builds on our earlier article, From SaaS to AIaaS: Updating Contract Terms in the Age of AI, which looked at how AI changes the contracts behind these services.

EU AI Act Article 50 transparency obligations – Aptus Legal.

Which dates changed and which didn't

The Omnibus deferred the high-risk regime and left transparency on its original timetable, with one short transition. It was published in the Official Journal on 24 July 2026 and came into force three days later.

Date	What applies	Changed by the Omnibus?
2 February 2025	Prohibited practices; AI literacy (Article 4)	AI literacy reworded
2 August 2025	Obligations for general-purpose AI models	No
2 August 2026	Transparency obligations (Article 50)	No
2 December 2026	Machine-readable marking for generative AI systems placed on the market before 2 August 2026 (Article 50(2))	New transitional period
2 December 2026	New prohibitions: AI-generated non-consensual intimate content and child sexual abuse material (Article 5)	New
2 December 2027	Stand-alone high-risk AI systems (Annex III), such as recruitment, creditworthiness and education	Deferred from 2 August 2026
2 August 2028	High-risk AI in products covered by EU product legislation (Annex I)	Deferred from 2 August 2027

Two other changes are worth noting. The new prohibitions cover realistic images, video or audio showing an identifiable person's intimate body parts or sexually explicit conduct, made without that person's explicit consent, and AI systems that generate child sexual abuse material. They apply to placing such systems on the market, putting them into service and using them.

The AI literacy duty in Article 4 remains, in a softer form. Providers and deployers must take measures to support AI literacy among their staff and others using AI on their behalf. They no longer have to guarantee a particular level of literacy for each individual. The Commission and Member States support and facilitate this effort.

Provider or deployer?

Under Article 50, what a business must do depends on its role, so the first step is to identify it.

A provider is a person or body that develops an AI system, or has one developed, and places it on the EU market or puts it into service under its own name or trademark (Article 3(3)). Providers outside the EU are covered too, including where the output of their system is used in the EU.

A deployer is anyone using an AI system under its authority in a professional context. Purely personal use falls outside the Act, but an individual who regularly earns money through AI, such as a freelance content creator, is treated as a deployer.

Three practical consequences follow:

• Branding decides, not engineering. If you put your own name on a chatbot or content tool built on someone else's model, you may well be its provider, with the obligations that come with that role. The model developer's compliance does not automatically cover you.

• The company is the deployer, not its staff. Employees who use an AI tool on the company's instructions do not take on deployer obligations personally.

• Outsourcing does not shift the role. A company that hands day-to-day operation of an AI tool to contractors or freelancers, while keeping control of it, remains the deployer.

One business can also hold both roles: a provider of its customer-facing assistant, and a deployer of the AI tools its marketing team uses.

What providers must do

Providers carry two main transparency duties, and they must build both into their systems before placing them on the market.

1. Inform people they are dealing with an AI (Article 50(1))

Any AI system built to hold a conversation with people, whether a customer-service chatbot, an agent that answers emails or a virtual avatar, must make clear that the person is dealing with a machine. The duty is aimed at systems designed for a genuine back-and-forth with a human, where the AI itself is speaking rather than relaying through a person. Tools that run quietly in the background, or that only talk to other systems, are outside it.

The disclosure belongs at the very start of the conversation, in a form people will notice and that works for users with disabilities. Article 50(1) excuses cases where the AI is obvious, but the Commission expects that exception to be used sparingly. A business relying on it should be confident that an ordinary, attentive user would never mistake the system for a person.

2. Mark AI-generated content (Article 50(2))

Systems that generate synthetic audio, images, video or text must embed a machine-readable signal in what they produce, so that the content can later be identified as AI-generated or altered. The technical solution must work in practice, as far as is technically feasible, and the Act allows for differences between, say, an image generator and a text tool.

Not every output needs a mark. The Commission's guidelines leave out content where marking would serve little purpose: very short strings, software code, outputs that never reach a human, and intermediate material that stays inside a closed production process. AI that simply tidies up a person's own work, the kind of editing help most office software now offers, is also outside the duty. A further, tightly drawn exemption is envisaged for certain business-to-business and industrial uses.

We expect the line between editing and generating to be where many difficult questions arise. A tool that corrects grammar is one thing. A tool that rewrites a paragraph in a new voice is likely to be another.

The Code of Practice on Transparency of AI-Generated Content, finalised in June 2026, sets out measures that providers can follow to show they comply.

Transition: systems placed on the market before 2 August 2026 must meet the marking duty from 2 December 2026. This transition covers only the marking duty. Every other Article 50 obligation already applies.

What deployers must do

Deployers' duties concern what people actually see. The provider's invisible mark is not enough to meet them.

Emotion recognition and biometric categorisation (Article 50(3))

Deployers of these systems must inform the people exposed to them that the system is operating. This applies whether the system works in real time or after the event. It does not require explaining the system's purpose.

Deepfakes (Article 50(4))

The Act treats as a deepfake any AI-generated or manipulated image, audio or video that resembles real people, objects, places, entities or events and would falsely appear authentic (Article 3(60)). The real test is not whether AI was used, but whether the audience could be misled. Deployers can weigh the setting: how lifelike the content is, what it says, where it appears and who will see it. A clearly stylised animation in an advertising campaign is unlikely to qualify. A realistic video of a named executive announcing results almost certainly would.

Where content does qualify, the deployer must tell people, at the latest when they first encounter it, with a label they can see or hear without special software. This is where the two sets of duties meet: the provider's invisible mark does not discharge the deployer's duty to disclose. Artistic, satirical and fictional works get a lighter touch, with disclosure that does not get in the way of the work itself.

AI-generated text on matters of public interest (Article 50(4))

Text generated or altered by AI must be labelled where it is published to inform the public on matters of public interest. That category is wider than it sounds. The Commission's examples go beyond politics and public health to include economic and financial developments, which brings much corporate and market communication within reach.

There is a way out. No label is needed if the text has been through human review or editorial control, and someone takes editorial responsibility for publishing it. The bar is about substance, not form: the reviewer needs the expertise to judge the content, or the editor needs real authority to approve, change or reject it, including checking the facts. Running a spell-checker is not enough.

For the financial sector, this is the provision to watch. Investment firms, fund managers, payment institutions and advisers increasingly use AI to draft market updates, client newsletters and commentary. Each of those pieces will now need either a qualified person who reviews it and stands behind it, or a label.

Content created before 2 August 2026 is not caught retroactively, although the Commission would like deployers to label it where they can.

Enforcement in Cyprus and at EU level

Article 50 will mainly be enforced nationally. Cyprus has split the AI Act's national roles between three bodies:

• The Deputy Ministry of Research, Innovation and Digital Policy coordinates implementation of the AI Act nationally and represents Cyprus on the European Artificial Intelligence Board.

• The Commissioner of Electronic Communications is the market surveillance authority, the notifying authority and the single point of contact for the AI Act in Cyprus. For most businesses, including on Article 50, this is the regulator to engage with.

• The Commissioner for Personal Data Protection is the market surveillance authority for certain high-risk AI systems listed in Annex III (points 1, 6, 7 and 8, which cover biometrics, law enforcement, migration and border control, and the administration of justice and democratic processes). The Commissioner also enforces the Article 5 prohibitions where they fall within her competence.

The involvement of the data protection authority is a reminder that, in Cyprus, AI and GDPR supervision will often overlap.

The EU-level role is narrow. The AI Office steps in only where the same company supplies both a general-purpose AI model and the system built on it, or where an AI system sits inside a very large online platform or search engine designated under the Digital Services Act. AI used by the EU institutions falls to the European Data Protection Supervisor. Everything else is a matter for national authorities.

The AI Act provides for administrative fines for breaches of Article 50, and allows the position of SMEs and small mid-caps to be taken into account when setting them.

Questions worth asking now

Before 2 December 2026, most businesses using AI should be able to answer four questions:

•         Are we a provider, a deployer, or both, and for which systems?

•         Does a product we built on a third-party model make us its provider?

•         Who reviews AI-assisted content before we publish it, and would that review meet the Commission's standard?

•         Do our contracts with AI vendors and customers say who marks, labels and discloses?

The answers are rarely the same for any two businesses, and they often sit across legal, product, marketing and compliance teams.

Our view

The Omnibus gave businesses more time to prepare for the high-risk regime. It did not give them more time on transparency.

In our experience, the hardest part of Article 50 is not technical. It is organisational: deciding who in the business is the provider, who reviews content before it is published, and who takes responsibility for it. These are questions of governance and contract as much as of engineering.

Article 50 is also an opportunity. Clear disclosure and real human review help build the trust that clients, counterparties and regulators increasingly expect from businesses using AI.

More information

Aptus Legal advises on technology regulation, including the EU AI Act, the Data Act, DORA, NIS2 and the GDPR, and on the contracts that underpin AI services. We help businesses build the AI policies, internal processes and governance that these obligations call for, from mapping roles and review steps to updating vendor and customer terms. We are happy to discuss how these rules apply to your business.

This article is for general information only and does not constitute legal advice. It reflects the position as at its date of publication.