EU AI Act Article 50 — the deployer checklist

Inventory every outward-facing AI

List every AI system that interacts with a person or produces content that reaches one: support bots, voice agents, lead-reply automations, marketing-content generators, sentiment tools. Internal-only models that never face a customer, partner or the public are largely out of scope — but be strict about what counts as "internal". You cannot classify what you have not listed.

Add an interaction disclosure to every bot and voice agent

First message and a persistent label for chat; an audible opening line for voice. Plain language, at the first interaction. Kill the "it's obvious" excuse for anything with a human name or persona — a wave and a first name are not a disclosure. Art. 50(1), due 2 August 2026.

Label deepfakes and public-interest AI text to the viewer

Visible "AI-generated" marking on synthetic image, audio or video that resembles real people, places or events — and on AI-written text published to inform the public, unless a named human holds editorial responsibility for it. "Someone skimmed it" is not editorial responsibility. Art. 50(4), due 2 August 2026.

Notify for emotion recognition and biometric categorisation

Surface the notice before or at the start of the interaction. Then do the separate, larger job: confirm a GDPR Article 9 legal basis and run a Data Protection Impact Assessment. In an employment context, check the use is permitted at all before you build it. Art. 50(3) plus GDPR.

Confirm machine-readable marking with your generative vendors

For any system that generates media, verify that Art. 50(2) provenance marking (C2PA or equivalent) is actually produced and survives your pipeline — a watermark your CMS strips on re-encode is not compliance. If you build on someone else's model this is a procurement question, not an engineering one. Systems already in service have until 2 December 2026; anything new marks from day one.

Layer the AI and GDPR notices — do not merge them

A short AI-transparency line at the point of interaction, linking to the fuller privacy notice. Article 50 says "you are dealing with AI"; GDPR Articles 13–14 say what personal data you process and why. Neither substitutes for the other. Give the inventory an owner so it stays current as new tools arrive.