EU AI Act Article 50: Provider or Deployer? The 10-Minute Version

Start with the role, not the risk class

Most teams open the AI Act, land on the high-risk chapters, and stall there. Article 50 is a different animal: Chapter IV, transparency, and no interest in how impressive your model is. It cares who put the system on the market, who uses it, and whether the person in front of it was told what’s going on.

Get the role wrong and you’ll read the wrong half of the article. Get it right and the rest is a short checklist. Ten minutes, honestly.

Two definitions decide almost everything

A provider (Article 3(3)) develops an AI system or a general-purpose AI model — or has one developed — and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. Your name on it is what counts, not who wrote the code. A reseller who white-labels someone else’s chatbot under its own brand is a provider, whatever the contract calls it.

A deployer (Article 3(4)) uses an AI system under its own authority — except where the use is a personal, non-professional activity. You bought the tool and run it for your team or customers; you didn’t put it on the market as yours. Deployer territory.

One company is routinely both: provider of the product it sells, deployer of the vendor tools it runs internally. The duties stack feature by feature. There’s no single badge — there’s a role per system, sometimes per feature.

The four duty blocks

Article 50 is a list, not a principle: four blocks, each with its own actor and trigger. Paragraphs 1 and 2 bind providers; 3 and 4 bind deployers.

Two carve-outs are worth knowing. The 50(2) marking duty doesn’t apply to the extent the system performs an assistive function for standard editing, or doesn’t substantially alter your input or its meaning. And the 50(4) text duty falls away when the content has undergone human review or editorial control and a named person holds editorial responsibility for it. Both conditions. A spell-check pass isn’t editorial control — the Commission’s guidelines, as reported, draw the line well above that.

However you disclose, 50(5) fixes the how and when: clear and distinguishable, at the latest at the first interaction or exposure, and in line with accessibility requirements. A line buried in your terms won’t do.

Does it even reach you? Article 2(1)

Being outside the EU doesn’t settle it. Under Article 2(1), the Regulation reaches providers placing systems on the market or putting them into service in the Union, wherever they’re established; deployers established or located in the Union; and third-country providers and deployers where the output produced by the system is used in the Union.

That third limb is why a public website or app open to EU visitors gets treated as possibly in reach below. Possibly — not certainly. If you can’t tell whether your output is used in the Union, the uncertainty is itself the answer: legal review, not a shrug.

Dates and money

The Regulation applies from 2 August 2026 (Article 113), and Article 50 wasn’t given a different date. So these duties already apply. There’s exactly one transitional rule, narrower than most summaries suggest: providers of systems generating synthetic audio, image, video or text that were placed on the market before 2 August 2026 must comply with the 50(2) marking duty by 2 December 2026 (Article 111(4), inserted by Regulation (EU) 2026/1744). Marking only. Providers only. Pre-August systems only.

The stick: breaching the Article 50 obligations carries fines of up to €15,000,000 or, for an undertaking, up to 3% of total worldwide annual turnover of the preceding financial year, whichever is higher (Article 99(4)(g)); for SMEs and start-ups the lower amount applies (Article 99(6)). The Commission’s guidelines (adopted 20 July 2026) and the voluntary Code of Practice on Transparency of AI-Generated Content (10 June 2026) are guidance, not law.

Your ten minutes, in order

1. List each AI system you ship or run. One row per system, not per company.
2. Per row: did we put it on the market under our name or trademark? Yes means provider. Just using it under your authority means deployer.
3. Providers: does it interact directly with people (50(1))? Generate synthetic audio, image, video or text (50(2))?
4. Deployers: any emotion recognition or biometric categorisation (50(3))? Deep fakes, or AI text published to inform the public (50(4))?
5. Check each disclosure against 50(5): clear, distinguishable, at first interaction or exposure.
6. Any “not sure” — on reach, role or an exception — becomes “needs legal review”. That’s a result, not a failure.

This guide explains the structure; it isn’t legal advice. The checker below walks the same questions and returns a labelled starting point — likely provider obligations, likely deployer obligations, possibly both, likely out of scope, or needs legal review — to take to an EU AI Act counsel.