Article 50 of Regulation (EU) 2024/1689 has four transparency paragraphs, and they do not all bind the same person. Two are addressed to the provider, who builds the system. The other two are addressed to the deployer, who uses it in the course of their activity. If your organisation uses someone else's AI tool, the first thing to know is which of the two applies to you, and for which system.
This article answers only that. The full map of the Article is in Article 50 on one page.
The two paragraphs addressed to you
Paragraph 3: emotion recognition and biometric categorisation
It says that "deployers of an emotion recognition system or a biometric categorisation system shall inform the natural persons exposed thereto of the operation of the system". The same paragraph adds that the personal data are processed under the GDPR and the other data protection rules that apply.
It reaches you if the system infers emotions or sorts people by biometric traits, and your organisation uses it with people: customers, patients or employees. It does not reach you just because you use a tool that does neither of those things, even if it processes personal data.
Paragraph 4: deep fakes and text on matters of public interest
It has two cases.
Image, audio or video. "Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated." The Regulation defines a deep fake as AI-generated or manipulated image, audio or video content "that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful" (Article 3, point (60)). There need not be a person in it: a place or an event also counts.
Where the content forms part of an "evidently artistic, creative, satirical, fictional or analogous work or programme", the obligation is limited to disclosing that such content exists, in a way that does not hamper the work.
Text. "Deployers of an AI system that generates or manipulates text which is published with the purpose of informing the public on matters of public interest shall disclose that the text has been artificially generated or manipulated." This does not apply where the AI-generated content "has undergone a process of human review or editorial control" and "a natural or legal person holds editorial responsibility for the publication of the content". The editorial route is covered in labelling AI text through the editorial route.
The two that are not addressed to you
Paragraph 1, the chatbot notice, requires providers to design systems that interact with people "in such a way that the natural persons concerned are informed that they are interacting with an AI system".
Paragraph 2, the marking of synthetic content, requires "providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content" to ensure that the system's outputs are marked in a machine-readable format.
On these two, what the deployer does is due diligence: checking that the notice appears in their channel and asking the provider whether and how it marks. It is worth putting in writing, but it is not an Article 50 obligation for an organisation that only deploys. The questions for the provider are in what to ask your provider about marking.
If your organisation is also the provider of the system —because it built the system or markets it under its own name—, all four paragraphs may be addressed to it. That is why the question comes before the answer: what role do you have in that particular system.
How to tell which one applies, system by system
Three questions, in this order, for each system in the inventory:
- What role does your organisation have in this system? Provider, deployer, or both. If you do not know, do not assume: record it as pending.
- Does the system recognise emotions or categorise people by biometric traits? If you are the deployer and the answer is yes, paragraph 3 applies to you.
- Does it generate or manipulate image, audio or video that could pass for real, or text that you publish to inform the public on matters of public interest? If you are the deployer and the answer is yes, paragraph 4 applies to you, subject to the editorial route for text.
The result may be paragraph 3, paragraph 4, both, or neither. Both at once is not an unusual case: a system that analyses a customer's reaction on video and generates a realistic avatar has both.
How it is recorded in the inventory
In Alethexis, the classification of each system stores which paragraph of Article 50 binds your organisation for that system: 3, 4, both, or neither. The role comes from the system itself or, where it has none, from the organisation. If neither is recorded, the platform assumes nothing: it leaves the classification pending review until the role is set.
With the paragraph stored, the HRA-4 legal framework view lists it under “In force today”, as an obligation that applies to your organisation for that system. If your organisation only deploys the system, paragraphs 1 and 2 are recorded as a check on the provider and do not raise the system's level. What you gain is being able to answer, system by system, the question anyone will ask first: what binds you and what binds the provider.
From when
Paragraphs 3 and 4 apply from 2 August 2026, the general date of application of the Regulation (Article 113, second paragraph). Regulation (EU) 2026/1744 did not amend them: of Article 50, it only replaced paragraph 7 (Article 1, point (20)).
Content in accordance with Article 50(1) to (4), Article 3, point (60), and Article 113 of Regulation (EU) 2024/1689, and Article 1, point (20), of Regulation (EU) 2026/1744.
This article is for information only and does not constitute legal advice.