The AI transparency obligation is the legal requirement for businesses to inform users, customers and affected individuals whenever they interact with an AI system or whenever AI is involved in decisions that affect them. Article 50 of the EU AI Act establishes this obligation for all organisations deploying AI systems in the European Union — regardless of company size.
Key takeaway: The Article 50 transparency rules have applied since 2 August 2026, with fines up to 15 million euros or 3% of global turnover. Only providers of generative systems already on the market before that date got extra time, until 2 December 2026, for technical marking under the Digital Omnibus. For businesses that publish AI content, a European code of practice has existed since June 2026, with a fixed label: the letters "AI".
When Must You Disclose AI Use to Users?
The EU AI Act distinguishes several situations where transparency is mandatory. The threshold is lower than many businesses expect.
Direct Interaction with AI (Article 50, Paragraph 1)
Every time a person communicates directly with an AI system, you must disclose this. Examples include:
- Website chatbots: Visitors must know they are talking to AI, not a human
- Virtual assistants: Phone bots, voice bots and automated response systems
- AI-driven forms: Systems that ask questions and interpret answers
- Automated email responses: When AI generates the content of your replies
The disclosure must happen before the interaction begins — not after. A simple statement such as "You are communicating with an AI assistant" is sufficient.
AI-Generated Content (Article 50, Paragraphs 2-3)
Do you generate content with AI that could be mistaken for authentic? Additional requirements apply:
- Deepfakes and synthetic media: Images, video or audio that imitate real people must be labelled as AI-generated
- AI-generated texts: Texts about matters of public interest (news articles, policy advice) must be marked accordingly
- Synthetic voices: Audio that sounds like a real person requires disclosure
The law splits this between two parties. The provider of the generative system (OpenAI, Google, Mistral, or whoever built your own model) must mark the output in a machine-readable way (paragraph 2). You, as the deployer publishing the content, must visibly label deepfakes and certain texts (paragraph 4). What that looks like in practice is set out in the code of practice below.
What Does the Code of Practice on AI-Generated Content Ask of Your Business?
On 10 June 2026 the European Commission published the Code of Practice on Transparency of AI-generated Content. The code is voluntary, but the Commission and the AI Board have confirmed that signing it is an adequate way to demonstrate compliance with Article 50. By the end of July about 190 organisations had signed, including OpenAI, Google, Microsoft, Anthropic and Mistral. The Dutch Data Protection Authority advises organisations to sign.
The code has two sections you can sign separately. Section 1 covers providers and asks for at least two layers of marking: signed metadata and an imperceptible watermark, because free-form text cannot carry metadata. Section 2 covers businesses that publish content, and that's where the practical rules sit:
| Situation | What the code asks |
|---|---|
| Deepfake image or video | EU icon with the letters "AI", for example in the top right corner, visible at first exposure |
| Video | label at the start, repeated at intervals where possible, and at least after interruptions |
| Audio only | short spoken disclaimer in plain language at the start |
| AI text on matters of public interest | label above the text, near the headline or in the colophon; you may label only the AI-generated part |
| Art, satire, fiction | disclosure that doesn't spoil the work, for example in the credits |
| Internal context, such as staff training | notice in the interface or setting before viewing |
The code supplies three main icons: fully generated ("AI + GENERATED"), modified ("AI + MODIFIED") and a basic icon. You can use them without attribution.
The text exception comes at a price. AI text on matters of public interest needs no label if a human reviewed it before publication and a person or organisation holds editorial responsibility. The code makes that verifiable: you record who holds that responsibility (name, role and contact details) and which organisational measures you have, and you publish those contact details if they aren't public yet. You don't have to document each individual review. A regulatory newsletter or a thought-leadership piece from your leadership team falls under this quickly.
The code also asks for internal arrangements proportionate to your size: documenting how you label, teaching staff when a label is needed, and a channel where anyone can report a missing or wrong label, which you then fix "without undue delay".
Emotion Recognition and Biometric Categorisation (Article 50, Paragraph 3)
Do you use AI that analyses emotions or categorises people based on biometric data? You must explicitly inform the individuals involved. Examples:
- Sentiment analysis in customer conversations
- Facial recognition for access control
- Voice analysis that detects emotions
For emotion recognition, you must also inform the individual about the type of data being processed and the purpose of the processing. This overlaps with GDPR requirements — read more about the intersection in our article on GDPR and AI rules.
What Transparency Requirements Apply Per AI System Type?
Not every AI system has the same obligations. The EU AI Act uses a risk-based approach that determines how extensive your documentation and communication must be.
| AI System Type | Risk Level | Transparency Duty | Documentation Duty | NL Regulator (proposed) |
|---|---|---|---|---|
| Chatbot (customer contact) | Limited risk | Disclose it is AI | Limited | AP |
| AI content generation (deepfakes) | Limited risk | Label as AI-generated | Limited | AP |
| Emotion recognition (customer calls) | High risk | Actively inform + explain purpose | Extensive (Art. 13) | AP |
| AI decision-making (credit, insurance) | High risk | Explainability + right to object | Extensive (Art. 13) | AFM / DNB + AP |
| Spam filter / recommendation algorithm | Minimal risk | No legal obligation | None | None |
| AI recruitment tool | High risk | Inform + DPIA | Extensive (Art. 13) | AP |
Emotion recognition in the workplace and in education has been prohibited since 2 February 2025, except for medical and safety reasons. The regulators in this table follow the Dutch bill of April 2026 and have not yet been designated by law.
High-Risk Systems: Article 13 Documentation
For high-risk AI systems, extensive documentation requirements apply under Article 13. "Meaningful information" means specifically:
- Intended purpose: What the system is designed for
- Accuracy and limitations: Known error margins and scenarios where the system fails
- Input and output data: What data the system uses and what it produces
- Human oversight: How human control is arranged
- Lifespan and maintenance: How long the system lasts and how it is updated
This is considerably more than the simple "this is AI" disclosure for limited-risk systems. Need help classifying your AI systems? Our AI compliance checklist for SMBs gets you started.
How Does the Transparency Obligation Overlap with the GDPR?
The EU AI Act does not exist in a vacuum. The GDPR already contains transparency obligations that apply to AI systems processing personal data.
GDPR Article 22: Automated Decision-Making
Article 22 GDPR gives individuals the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect them. This applies, for example, to:
- Automatic rejection of a loan application
- AI-driven price discrimination
- Automated candidate selection
For automated decision-making, the GDPR requires you to:
- Inform the data subject about the existence of automated decision-making
- Provide meaningful information about the underlying logic
- Explain the significance and expected consequences
- Offer the possibility of requesting human intervention
For points 2 and 3 — the actual explanation per individual decision — a separate technical setup is required. How to build that in practice, without academic complexity, is covered in explainable AI decision-making for SMBs.
Combined Obligations
In practice, this means that for many AI systems you must comply with two sets of transparency requirements. In the Netherlands both mostly end up with the same regulator: the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) supervises the GDPR and is also proposed for Article 50, with the AFM covering financial institutions.
Want to dive deeper into risks and liability? Read our article on AI risks and liability for businesses.
Time saved
Save 8 hours per week on manual compliance documentation by structuring AI transparency from the start
How Do You Implement AI Transparency in Practice?
Theory is useful, but how do you execute? Here is a concrete implementation approach for SMBs.
Step 1: Inventory All Your AI Systems
Create a list of every AI tool your organisation uses. Do not forget the "invisible" AI:
- CRM systems with AI predictions (HubSpot, Salesforce Einstein)
- Email tools with AI-driven send optimisation (Mailchimp, ActiveCampaign)
- Customer service tools with automatic routing (Zendesk, Intercom)
- Accounting software with automated categorisation (Xero, QuickBooks)
- Marketing tools with AI targeting (Google Ads Smart Bidding, Meta Advantage+)
Step 2: Classify by Risk Level
Use the table above to classify each system. In doubt? Default to the higher risk level — overcompliance is cheaper than a fine.
Step 3: Implement Disclosure Texts
For each AI interaction, you need an appropriate disclosure. Example texts:
Chatbot (limited risk):
"You are chatting with our AI assistant. A team member can take over the conversation if needed."
AI decision-making (high risk):
"We use an AI system that analyses your data when assessing your application. A team member always reviews the AI recommendation before a final decision is made. You have the right to request a fully human assessment."
AI-generated content:
"This image was generated using artificial intelligence."
Step 4: Document for High-Risk Systems
For each high-risk system, create a dossier containing:
- Technical specification of the AI model
- Training data description
- Known limitations and error rates
- Procedures for human oversight
- Log of bias audits
- Contact details of the responsible person
Want to know how to build AI systems with transparency as a design principle? Custom software built compliant from day one prevents costly retrofitting.
Step 5: Train Your Team
Transparency is not just a technical matter. Your staff must:
- Know which systems contain AI
- Be able to explain to customers how AI is used
- Know escalation procedures when customers object
- Recognise signals of AI systems exhibiting unexpected behaviour
What Fines and Enforcement Can You Expect?
The Dutch AI Act implementation bill places supervision of Article 50 with the Autoriteit Persoonsgegevens, and with the AFM for financial institutions. The bill was in consultation until 1 June 2026 and isn't law yet. Which regulator handles which use case is covered in AI Act enforcement in the Netherlands. The fines themselves come straight from Article 99 of the AI Act:
| Violation | Maximum Fine | Example |
|---|---|---|
| Failing to disclose that a user interacts with AI | EUR 15 million or 3% of global turnover | Chatbot without AI disclosure |
| Missing technical documentation (high risk) | EUR 15 million or 3% of global turnover | AI assessment system without dossier |
| Deploying prohibited AI systems | EUR 35 million or 7% of global turnover | Workplace emotion recognition (impermissible purpose) |
| Providing incorrect information to regulator | EUR 7.5 million or 1% of global turnover | Inaccurate or incomplete reporting |
For large companies the higher of the two amounts applies. For SMEs the lower one applies. Since the Digital Omnibus that also goes for small mid-caps (fewer than 750 staff), except for prohibited practices. The Omnibus also added that member states must take those companies' interests into account, and that warnings and non-monetary measures count as penalties too.
The experience with GDPR enforcement is instructive. The Dutch DPA was relatively mild in the early years but now issues fines up to EUR 3.7 million (such as the OLVG hospital fine in 2022 for insufficient access security of patient records).
Prepare your organisation for the full AI legislation landscape. Our comprehensive article on the EU AI Act and AI legislation in the Netherlands gives you the complete legal framework.
How Does AI Transparency Relate to Discoverability and Trust?
Transparency is not just a legal obligation — it is a competitive advantage. Customers and business clients who can see that an AI text is labelled, or that an editor checked it, know what they're dealing with.
Search engines — both traditional and AI-powered — also reward websites that clearly communicate about their methods. Transparency about AI use strengthens your E-E-A-T signals (Experience, Expertise, Authoritativeness, Trustworthiness). Read more about discoverability in the AI era in our article on getting found in AI search engines.
Start With AI Transparency Today
The transparency obligation does not have to be a burden. Businesses that invest now in clear communication about their AI use build customer trust and stay ahead of the competition. Start by inventorying your AI systems, classify them by risk level, and implement the right disclosure texts.
Want to know which AI systems in your organisation are subject to transparency obligations and how to make them compliant? Request a free scan — we map your AI landscape and advise on the right approach.