EU AI Act Transparency Requirements

Who it applies to

The regulation applies to providers placing systems on the EU market wherever they are established, and to deployers established or located in the EU. A US company that puts a model on the EU market is a provider for these purposes, and a US company whose system is used inside the EU by an EU entity will often be caught through the deployer side. Establishment is not the test.

The two regimes bind different parties. Article 50 duties fall on providers for the disclosure and marking obligations, and on deployers for the emotion recognition and deepfake disclosures. Article 53 duties fall only on providers of general-purpose models. A company that fine-tunes someone else's model is generally not the provider of that model, but may be a provider of an AI system and therefore inside Article 50.

The dates are phased rather than single. The prohibitions and the AI literacy duty applied from 2 February 2025, the general-purpose model obligations in Chapter V from 2 August 2025, and the Article 50 transparency obligations from 2 August 2026, which is now in the past. The Commission published guidelines on the Article 50 duties and recognized a transparency code of practice in July 2026.

A data supplier sits outside all of this directly. The obligations are on providers and deployers, not on the people who sold them the corpus. The indirect effect is what matters commercially: buyers now need documentation they did not previously ask for.

• Provider of a general-purpose model: Article 53 duties, including the copyright policy and the training-content summary.
• Provider of an AI system built on a purchased corpus: Article 50 duties, plus the obligation to know what is in the training data.
• Data supplier: no direct obligation, but the buyer's ability to comply depends on what you can document.

How to comply when you are buying data

A data buyer's obligations under these provisions are satisfied or broken by the documentation they hold about the corpus, so the checklist below is mostly about what you ask a supplier to deliver rather than what you build.

One question decides your position, and it is worth answering before you buy anything: are you placing a model on the EU market, or deploying one that someone else placed there? The first makes you a provider with documentation duties, the second makes you a deployer with disclosure duties, and a company can be both for different products.

Where a project is destined for a general-purpose model, we can supply the source-level detail that the training-content summary requires and a written statement of the rights position on each source, and we will say plainly when a source cannot be documented. We are a sourcing company and not a law firm, so the compliance assessment for your own system remains one for your counsel.

• Establish which role you are in before you buy. Provider, deployer or neither determines which articles apply, and the answer changes what you need from the supplier.
• If you are training a general-purpose model, ask suppliers for the source inventory and the rights position per source. That is the raw material for both the Article 53(1)(c) policy and the Article 53(1)(d) summary.
• If you are building a system that talks to people, plan the Article 50(1) notice into the product, and keep the corpus documentation that supports it.
• If you are deploying emotion recognition or biometric categorisation, the Article 50(3) disclosure duty sits on you as deployer, and the notice should be reflected in what the speakers agreed to when they were recorded.
• If you generate synthetic audio, plan the Article 50(2) marking obligation into the pipeline, and check whether the license from your data supplier permits the synthetic output you intend to produce.

How we handle consent and licensing →