EU AI Act Article 50

Who it applies to

The article splits by role. Paragraphs 1 and 2 bind providers, which means whoever places the system on the EU market, wherever they are established. Paragraphs 3 and 4 bind deployers, which means the organization using the system in the EU. A company can be both at once for different products, and the two sets of duties are not interchangeable.

Timing is set by Article 50(5), which requires the information to be provided in a clear and distinguishable manner at the latest at the time of the first interaction or exposure, and requires it to meet applicable accessibility requirements. A disclosure buried in terms of service or shown after the user has already engaged does not meet that standard.

Territorially, the article follows the market rather than the company. A US provider placing a synthetic voice product on the EU market is inside paragraph 2. A US company deploying emotion recognition on EU users is inside paragraph 3. There is no establishment requirement in either case.

Two practical points for anyone buying voice data. First, paragraph 2 means synthetic output has to be markable, which is a pipeline requirement that is easier to design in than to retrofit. Second, paragraph 3 means the people whose voices are used to train an emotion recognition system may be entitled to be informed that such a system is operating, which is a purpose the consent documentation should have covered at collection time.

• Synthetic speech product placed on the EU market: provider duties under 50(1) and 50(2).
• Emotion recognition deployed on EU users: deployer duties under 50(3), plus the data protection analysis.
• Deepfake or public-interest AI text published in the EU: deployer duties under 50(4).

How to comply when you are buying data

The article is short, and the work it creates is mostly product design plus one item of paperwork that data buyers tend to miss: the recording consent has to anticipate the disclosure duties that the finished system will carry.

The two provider duties and the two deployer duties are often held by the same company at different points in the supply chain, and the disclosure wording has to work in both places. A supplier that ships synthetic audio to a customer who then publishes it is a provider, and the customer is a deployer. Both have obligations on the same file.

On voice emotion and identification projects we record the intended purpose in the consent documentation, including the fact that the resulting system may disclose its operation to people it is used on, and we flag projects where the intended purpose cannot be reconciled with what the speakers were told. We are a sourcing company rather than a law firm, so the compliance assessment of your finished system is one for your counsel.

• Decide which paragraphs apply to you before you buy data, because the answer changes what you need in the license and in the consent record.
• If you generate synthetic speech, check that the license expressly permits the creation and distribution of synthetic output, and plan the machine-readable marking into the pipeline.
• If you train emotion recognition or biometric categorisation, make sure the speakers were told that the system may be disclosed to the people it is used on. That is a purpose, and it belongs in the consent.
• Write the timing of your disclosure into the product specification. The article requires it at first interaction or exposure, which is a product decision rather than a legal one.
• Keep the corpus documentation that supports the system's technical file. The disclosure duties are on you, but the evidence that you understood your training data is what a reviewer will ask for.

How we handle consent and licensing →