The EU AI Act for agent builders: timeline and Article 50
Article 50 of the EU AI Act requires, from 2 August 2026, that people talking to an AI agent are told it is an AI, that synthetic content is marked and that deep fakes are disclosed. For agent builders, the rest of the timeline depends on risk: Annex III high-risk obligations arrive on 2 December 2027.
Updated: 23 October 2026 · Deibson Silva · Forward Deployed AI Engineer and Founder
Who are you under the Act when you build an agent?
Regulation (EU) 2024/1689 assigns obligations by role, so the first step is knowing who holds which role in the project.
The "provider" is whoever develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. The "deployer" is whoever uses it under its own authority, except in a personal, non-professional activity.
When a Forward Deployed Engineer builds an agent inside a client company, with its data and for its use, the company is usually the deployer, and it may also be the provider if it puts the agent into service under its own name. The contract should say so in writing.
The role matters because Article 50 does not ask the same of everyone: some obligations fall on whoever designs the system, others on whoever uses it in front of people.
What does Article 50 require of an AI agent?
Four transparency obligations, each with its own addressee:
Say it is an AI (paragraph 1, provider)
A system intended to interact directly with people is designed so they know they are talking to an AI, unless that is obvious to a reasonably well-informed, observant and circumspect person.
Mark synthetic content (paragraph 2, provider)
If the system generates synthetic audio, image, video or text, its output is marked in a machine-readable format and detectable as artificial. This does not apply to standard editing or to output that does not substantially alter the input.
Emotions and biometrics (paragraph 3, deployer)
Whoever uses an emotion recognition or biometric categorisation system informs the people exposed to it and processes their data in line with the GDPR.
Deep fakes and public-interest text (paragraph 4, deployer)
Image, audio or video that resembles real people or events is disclosed as artificial. Text published to inform the public on matters of public interest is disclosed as artificial, unless it has had human review and someone holds editorial responsibility.
When must people be told, and how?
Paragraph 5 is specific: the information is given in a clear and distinguishable manner, at the latest at the time of the first interaction or exposure, and it must meet the applicable accessibility requirements.
For a conversational agent that means saying so in the first message or the first spoken sentence, not in terms and conditions nobody opens.
If someone later asks whether they are talking to a machine, the answer is yes. Denying it undoes the disclosure, and that is exactly what the rule is there to prevent.
What is the EU AI Act timeline after the Digital Omnibus?
The dates in Article 113, with the changes made by Regulation (EU) 2026/1744, and what they mean for agent builders:
| Date | What applies | What it means for an agent |
|---|---|---|
| 1 August 2024 | Regulation (EU) 2024/1689 enters into force | The clock starts |
| 2 February 2025 | Chapters I and II: prohibited practices and AI literacy | No agent may engage in a practice prohibited by Article 5 |
| 2 August 2025 | General-purpose AI models, governance and penalties | Obligations of whoever offers the underlying model, not of whoever builds on top of it |
| 27 July 2026 | The Digital Omnibus enters into force | New wording of Article 4 and a new timeline |
| 2 August 2026 | General date of application, Article 50 included | The agent says it is an AI; deep fakes are disclosed |
| 2 December 2026 | Paragraph 2 marking for systems already on the market before 2 August 2026, and new prohibited practices on synthetic sexual content | If the agent generates content and was already in service, its marking must be ready |
| 2 December 2027 | Annex III high-risk systems | Agents involved in hiring, evaluating workers or access to essential services |
| 2 August 2028 | Annex I high-risk systems | Agents built into products covered by the Union legislation in Annex I, such as toys or medical devices |
What should you check in an agent before it goes live?
A short list for every agent, from the Qualify stage to the Deploy stage:
- 1Classify it: whether it falls into a prohibited practice, whether it is high-risk under Annex III or Annex I, and which paragraphs of Article 50 apply.
- 2Put in writing who is the provider and who is the deployer.
- 3Make it introduce itself as an AI at its first interaction, clearly and accessibly, and never deny it if asked.
- 4If it generates audio, image, video or text, agree with the provider how the output is marked in a machine-readable format.
- 5If it uses a real person's voice or face, treat it as a deep fake: that person's consent and a visible disclosure.
- 6If it publishes text to inform the public, put human review and an editor in charge in place, or disclose that the text is artificial.
- 7Document its AI Act sheet with its risk, its tests and its human oversight, and do not let it out of shadow mode until it passes the Security Test.
How is Article 50 applied on our own platforms?
Deibson Silva's twin joins Google Meet under the name "Deibson Clon IA" and says it is an AI the first time it speaks. A twin's name always ends in "Clon IA".
Its voice comes from the same recording as its face, and only real people are cloned, after consenting by email with a video of them reading a sentence and a manual anti-deepfake review. Consent can be revoked with one click.
The Legathum AI Assistant, which helps Community members prepare each sale, always says it is an AI.
In the FDE programme, the security lab ends with a simulated attack and the agent's AI Act sheet, and it is one of the two labs you must pass.
Does Article 50 apply if you build agents from the UK?
Under Article 2, the Act applies to providers placing AI systems on the EU market wherever they are established, and to providers and deployers outside the EU when the output of the system is used in the EU.
So an agent built in the UK that talks to customers in the EU must meet Article 50. The sensible approach is to design one agent that meets the rules in every market it serves.
Inside the UK, data protection is covered by the UK GDPR, and the ICO's guidance on AI and data protection explains what it expects; the ICO says that guidance is under review after the Data (Use and Access) Act.
Honest limits
- This article explains the rule; it is not legal advice on any specific agent.
- The Digital Omnibus did not delay Article 50: the general date is still 2 August 2026. It only gave systems already on the market until 2 December 2026 for marking.
- The Commission encourages codes of practice on detection, marking and labelling (paragraph 7): follow them once they are published.
- The Forward Deployed Engineer Certification attests a competence, never a job or an income.
- The SciTechBiz Institute is not a university: its certifications are awarded by the Institute itself and are not recognised by any education authority.
What people ask most
01When does Article 50 of the EU AI Act apply?
From 2 August 2026. Systems that generate synthetic content and were already on the market before that date have until 2 December 2026 to meet the marking duty in paragraph 2.
02Does a chatbot have to say it is an AI?
Yes, if it is intended to interact directly with people, unless that is obvious from the context. The information is given clearly, at the latest at the first interaction.
03Do I have to disclose that an AI wrote a text?
Only in two Article 50 cases: machine-readable marking, which is the system provider's duty, and text published to inform the public on matters of public interest, unless it has had human review and an editor holds responsibility.
04Is a voice agent with a cloned voice a deep fake?
If the audio resembles a real person and could falsely appear authentic, yes: whoever uses it must disclose that it is artificial. And before that, they need that person's consent.
05Did the Digital Omnibus delay the transparency obligations?
No. The general date of 2 August 2026 stands. The Omnibus gave a transition period for marking by systems already on the market and moved Annex III high-risk obligations to 2 December 2027.
Sources
- Regulation (EU) 2024/1689, the AI Act (EUR-Lex): Articles 2, 3, 5, 50 and 113 and Annexes I and III · accessed 23 October 2026
- Regulation (EU) 2026/1744, the Digital Omnibus on AI (EUR-Lex): Articles 5, 50(7), 111 and 113 · accessed 23 October 2026
- ICO, Guidance on AI and data protection · accessed 23 October 2026
Founder of Legathum and iPersonality and Forward Deployed AI Engineer. He leads the SciTechBiz Community from Madrid and examines the FDE Certification defence.
Start from your dashboard
On the licence page you request access; requesting access costs nothing. You then sign the contract and pay the annual licence from your dashboard.
iPersonality Global Institute, S.L. · NIF B27580042 · Madrid · Privacy policy
Prices in euros, exclusive of VAT. In Spain, Spanish VAT is added. In the rest of the EU, VAT is calculated at payment according to your country and VAT number. No Spanish VAT is charged to UK customers.