I built the EU AI Act tooling I wished existed. Here is what I learned about Article 50.

I ship software into the EU, and the Article 50 deadline was coming with two options on the shelf. A 200 page regulation, or a consultant quoting five figures to tell me what the regulation says. Neither one is a tool you can use.

So I built the tools, and Disclos came out of it. Here is the architecture, and the stuff I only learned by auditing real products.

Article 50 in one screen

The transparency rule starts applying on 2 August 2026, which is weeks away, not months. It breaks into five cases:

  • a chatbot or voice agent has to say it is AI (50(1))
  • AI generated content has to be marked, including a machine readable marker (50(2))
  • emotion recognition has to be disclosed (50(3))
  • biometric categorisation has to be disclosed (50(3))
  • deepfakes have to be labelled (50(4))

Most SaaS only touch the first two. They are still the ones teams get wrong.

The architecture, free to paid

Three layers. The goal was that the free layer does the obvious work and the paid layer does the part that needs a person.

1. The SDK (free). One script tag renders the disclosure in all 24 EU languages and auto detects the visitor's language. No account, no key.

``html <script src="https://www.disclos.eu/sdk/disclos.js" data-disclos="chatbot"></script> ``

Or pull the raw text and render it yourself:

``js const notice = Disclos.text("generated", "de"); ``

2. Two MCP servers (free). disclos-eu-ai-act classifies any AI system against the Act and returns the obligations cited to the articles. disclos-article-50 generates the exact disclosure text and works out which sub rules apply. Both are remote connectors you add in Claude or Cursor, so the law answers questions inside the editor instead of in a PDF.

3. The audit and Monitoring (paid). A human reads your product against the regulation. Monitoring then watches the live site every week to prove the disclosures are still present, in every language you serve, and produces a verification page and a signed audit trail.

The free SDK is the front door. The audit is the deep version.

What compliance actually looks like in practice

The things I did not expect until I was auditing real sites.

The disclosure is easy to add and easy to lose. It goes in, then a refactor four deploys later quietly removes it, and nobody is watching. Compliance is not a launch event, it is a state you have to hold, which is the whole reason Monitoring exists.

Language is where teams fail, not wording. Almost everyone has some English notice. Almost nobody has it in the languages their EU users actually read.

The machine readable marker in 50(2) gets skipped. People ship the visible badge and stop there.

And "we have no EU users" is usually wrong. Article 2 catches output used in the EU even if your servers are elsewhere, so your logs decide your scope, not your billing country.

On the stakes, the headline 35 million euros or 7 percent figure is the top tier, reserved for the banned practices in Article 5. Article 50 sits one tier down at 15 million euros or 3 percent under Article 99. For a small team that is still the whole runway.

The honest part

This is structured engineering against the regulation. Every finding points to the article it comes from, with qualified legal review where it is needed. It is not legal advice, and the tools say so on the tin.

The Founding 10

I am auditing 10 SaaS products properly before the deadline. A full EU AI Act audit, normally 997 euros, free, plus up to six months of Monitoring. Ten seats.

Start with the free tools: the SDK, the disclosure generator at https://www.disclos.eu/tools/article-50-disclosure-generator, and the two MCP servers. Then, if you want a person to read your product, apply at https://www.disclos.eu/free-audit.

Frequently asked questions

What is Article 50 of the EU AI Act?

The transparency rules in the EU AI Act. They require you to disclose AI to users in four cases: AI that interacts with people, AI generated content, emotion recognition or biometric categorisation, and deepfakes. They start applying on 2 August 2026.

Do I need this if I only use a model like OpenAI?

Yes. The obligation attaches to the product you ship to users, not the model underneath. Wrapping a model and selling it under your brand makes you the provider of that system, so the disclosure is yours to add.

Is the disclosure SDK really free?

Yes. disclos-sdk is one script tag, no account and no key, and it renders the notice in all 24 official EU languages. The paid layer is the human audit and Monitoring.

What does Disclos Monitoring do?

It checks your live site every week to confirm the Article 50 disclosure is still present, in every language you serve, then gives you a public verification page and a signed audit trail.

Is this legal advice?

No. It is structured engineering against Regulation 2024/1689, with every finding pointing to its article so qualified counsel can verify. Treat it as general information, not legal advice.

Sources

Last updated: 2026-06-23