The EU AI Act Transparency Rules Are Live: What Product Teams Need to Build Now

The EU AI Act did not arrive all at once, and that staggered rollout has created a common misreading: teams building AI features in 2026 assume enforcement is still mostly hypothetical. For transparency obligations under Article 50, that assumption is wrong. Those rules have been in effect since August 2025.

The high-risk system requirements under Annex III — the rules that require technical documentation, conformity assessments, and registration — were deferred to December 2027 by the Digital Omnibus amendments. But Article 50 was not deferred. If your product presents an AI chatbot, generates content a user might mistake for human-created, or performs biometric categorisation or emotion inference, the transparency obligations apply now.

This is a practical account of what “transparency obligations apply” means at the level of product and engineering decisions, not legal interpretation. Treat it as a starting point, not legal counsel.

What Article 50 actually requires

Article 50 of the EU AI Act covers four main scenarios:

1. Chatbots and conversational AI: Users interacting with a chatbot must be informed they are interacting with an AI system, unless the context makes it obvious.
2. AI-generated content: Content generated by AI and intended for public consumption — text, images, audio, video — must be marked as AI-generated. Specific technical marking standards are under development.
3. Emotion recognition and biometric categorisation: Users must be informed when these systems analyse them.
4. Deep synthesis and manipulation: Realistic synthetic content representing real people requires specific labelling.

The common thread is informed interaction. Users who cannot tell whether they are reading machine-generated text, talking to a bot, or being analysed by an inference model have not consented in any meaningful sense.

The engineering implications by product type

Chatbots and AI assistants

If your product exposes a chat interface backed by a language model, the disclosure cannot live only in the terms of service or an onboarding screen the user clicked past six months ago. It must be present and unambiguous at the point of interaction.

What this means in practice:

• Label the chat interface clearly: “This is an AI assistant” or equivalent, visible in the UI without scrolling.
• If your product switches between AI responses and human agent responses, the mode must be disclosed each time it changes.
• If the AI can escalate to a human, that transition must be disclosed to the user.

The disclosure requirement does not prohibit naming the assistant or giving it a persona. It prohibits the AI from claiming to be human when sincerely asked, and from presenting in a way that would deceive a reasonable user.

AI-generated content in your product

If your application generates text, images, summaries, or reports and presents them to users or distributes them publicly, those outputs need to be identifiable as AI-generated. The specific technical marking requirements — machine-readable metadata standards — are still being finalised by the European Commission. The obligation to mark is in effect; the standardised technical method is not yet mandated.

The practical approach now:

• Add visible labelling at the content level: “Generated with AI” or equivalent, adjacent to the content.
• Investigate C2PA content credentials for images and media if your product distributes visual content. C2PA is the leading candidate for the technical standard and adoption is already underway in major publishing and media workflows.

Classification and scoring systems

If your product classifies users, scores their risk, recommends content, or infers preferences or emotional states through a model, users in the EU have a right to know that an AI system is involved in decisions that affect them.

This does not require disclosing the model’s weights or architecture. It does require disclosing that an AI system is involved and, for high-risk systems, providing a mechanism for users to contest automated decisions.

Logging and auditability as engineering requirements

Article 50 compliance is not just a UI problem. Regulators expect to be able to audit claims of compliance. That requires records.

For each AI interaction that touches an EU user:

• Log what the system did. Input, model, version, output, timestamp. Enough to reconstruct the interaction if a complaint is filed.
• Retain logs appropriately. Retention periods for AI decision logs are not specified in Article 50 specifically, but general GDPR data minimisation principles still apply. Retain what you need for accountability; delete what you do not.
• Separate audit logs from application logs. Application logs are often ephemeral, rotated frequently, and formatted for debugging. Compliance logs need to be durable, structured, and queryable.

A practical logging structure for an AI interaction:

{
  "event": "ai_interaction",
  "session_id": "sess_01j9x8…",
  "user_region": "EU",
  "ai_system": "support_chatbot_v3",
  "model": "claude-3-5-sonnet-20241022",
  "input_hash": "sha256:a1b2c3…",
  "output_hash": "sha256:d4e5f6…",
  "disclosure_shown": true,
  "timestamp": "2026-08-28T14:23:11Z",
  "interaction_id": "int_7qmr4p"
}

Hashing the input and output rather than storing them directly reduces storage cost and limits data retention scope while preserving the ability to verify what was sent and received if the interaction is contested.

What the December 2027 deadline changes

The high-risk system obligations that land in December 2027 are more demanding:

• Formal technical documentation describing system architecture, training data governance, and accuracy metrics.
• Registration in the EU AI Office database.
• Conformity assessments before deployment, with periodic review.
• A documented human oversight mechanism.

Teams building AI features now have the time to design for these requirements rather than retrofit. Architectures that log, document, and surface AI decision points are significantly easier to certify than ones that treat the AI integration as an opaque black box.

The practical advice is not to wait. If your AI features grow between now and 2027, documenting how they work from the beginning is cheaper than reconstructing that documentation under time pressure.

The compliance checklist for product teams

[ ] All chatbot/conversational AI surfaces labelled as AI at the point of interaction
[ ] AI-generated content marked visibly; C2PA credentials under evaluation for media
[ ] Emotion recognition or biometric categorisation disclosed to users before processing
[ ] AI interaction logs structured, durable, and separate from application debug logs
[ ] Log retention policy defined and reviewed against GDPR minimisation
[ ] Legal review completed for your specific product category and risk level
[ ] Monitoring in place to detect when AI systems are used in new product surfaces
[ ] Process defined for handling user inquiries about AI use

Transparency obligations are the floor, not the ceiling. Building products where users understand when and how AI affects their experience is also better for trust and engagement — independent of what the regulation requires.