Signatoro

EU AI Act Article 50 and email

What an AI agent that sends email has to disclose, who carries the duty, and since when.

Article 50 of the EU AI Act sets transparency duties for AI that interacts with people or generates content. For email, Article 50(1) matters most: since 2 August 2026, an AI agent that writes and sends mail to people must tell them it is an AI, and the Commission adds that it should name whom it acts for.

Who this applies to

Article 50 splits its duties by role. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name (Article 3(3)); putting into service includes supply "for own use" (Article 3(11)), so a company that builds its own email agent and runs it is generally a provider. A deployer uses an AI system under its authority, outside purely personal use (Article 3(4)). Articles 50(1) and 50(2) bind providers; 50(3) and 50(4) bind deployers, and one company can be both. The Regulation reaches providers established outside the EU and, where the output is used in the EU, deployers outside it too (Article 2(1)).

What it actually requires

Article 50(1): tell people they are dealing with an AI
Providers must design AI systems "intended to interact directly with natural persons" so that the people concerned "are informed that they are interacting with an AI system, unless this is obvious" to a reasonably well-informed, observant and circumspect person. The guidelines count interaction "via technical communication means including online interfaces, phone or e-mail", including a single exchange that the AI starts.
Agents: disclose the AI and the person it acts for
Paragraph 31 of the guidelines names agents "managing correspondence" and says they "must be designed and developed in such a way that they disclose both their artificial nature and the person on whose behalf they are acting". Where a provider cannot tell in advance, the agent should disclose itself wherever it is reasonably likely to reach a person, "including where a natural person may represent or act for a legal entity". On that wording, a business contact at a supplier counts.
Article 50(5): clear, and at the first email
The information must be given "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure". For email, the guidelines give the example of "an email generated by an AI agent sent to a natural person that features an AI label at the top", and recommend plain-language labels and persistent badges.
Where human review changes the answer
The guidelines leave out AI tools that help a person write, and AI output passed on by a person. They also say "the mere possibility for humans to intervene or review" should not be used to get around the duty: blended output needs disclosure "unless those AI outputs have been properly reviewed and sent by humans as the main interlocutors". Simple rule-based replies, such as "traditional out-of-office emails", are outside Article 50(1) altogether.
Article 50(2): the text generator's provider marks AI output
Providers of systems that generate synthetic text must mark outputs "in a machine-readable format and detectable as artificially generated or manipulated", with an exception for assistive standard editing. This sits with the model or tool provider, and the guidelines say it can apply to text an agent produces.
Article 50(4): published text, and why email generally falls outside it
Deployers must disclose AI-generated text "published with the purpose of informing the public on matters of public interest", unless a person or company holds editorial responsibility after human review. The guidelines list "private, interpersonal correspondence (for professional purposes)" and internal communications as text that is not published, so a one-to-one business email generally falls outside 50(4). A newsletter on public affairs could fall inside it.
Fines reach EUR 15 million or 3% of turnover
Breaching the Article 50 transparency duties can bring administrative fines of up to EUR 15,000,000 or, for a company, up to 3% of total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(4)(g)). For SMEs and start-ups, the lower of the two applies (Article 99(6)). Each Member State sets its own penalty rules within those limits.

Myths we hear often

The myth

The Digital Omnibus delayed Article 50 to December 2026.

What the source actually says

Regulation (EU) 2026/1744 gives providers until 2 December 2026 only for the Article 50(2) marking duty, and only for systems placed on the market before 2 August 2026. The guidelines say disclosure for AI systems that interact with people "must be ensured as of 2 August 2026".

The myth

Article 50 is for the AI vendor, so a company using an agent has nothing to do.

What the source actually says

A company that builds its own agent, on any model, and runs it under its own name is generally a provider, because putting into service includes own use. A company running a ready-made agent is typically a deployer, and the provider is expected to have built the disclosure in. Either way, the company decides what its agent sends.

The myth

A US company emailing EU prospects is outside the AI Act.

What the source actually says

Article 2(1)(c) covers providers and deployers established in a third country "where the output produced by the AI system is used in the Union". The guidelines add that incidental, unforeseeable or unauthorized use alone should not pull in a provider that does not place its system on the EU market. Deliberately emailing people in the EU is foreseeable use.

The myth

An AI line in the email signature meets Article 50(1) on its own.

What the source actually says

Article 50(5) asks for clear and distinguishable information no later than the first interaction, and the Commission's example puts the AI label at the top of the email. A signature line is a good place to name whom the agent acts for. On our reading, it works best alongside a line at the top.

A worked example

A fictional example: Larkspur Ledger
Larkspur Ledger, a fictional US bookkeeping software company, builds an agent on a third-party model that emails customers in Germany and France to book renewal calls. Because Larkspur put the agent into service under its own name, it is generally the provider for Article 50(1), and because the emails reach people in the EU, Article 2(1) brings it into scope. Every email opens with "This email was written and sent by an AI assistant." The signature reads "Renewals assistant (AI), on behalf of the Customer Success team, Larkspur Ledger Inc.", with a direct line to a person. Machine-readable marking under Article 50(2) falls on the provider of the generating system, which may be the model vendor, Larkspur, or both; what the agent tells each customer is Larkspur's to get right.

Questions people ask

What is Article 50 of the EU AI Act?

It is the transparency article of Regulation (EU) 2024/1689. It requires AI systems that interact with people to tell them they are dealing with an AI, generative systems to mark their output as AI-generated in a machine-readable way, and deployers to disclose deep fakes and AI text published to inform the public. It has applied since 2 August 2026.

Does the EU AI Act apply to the USA?

It applies to US companies in two main cases: when they place an AI system on the EU market or put it into service there, and when the output of their AI system is used in the EU (Article 2(1)). A US company whose agent emails people in the EU is generally in scope for those emails. US activity with no EU connection is outside it.

Does Article 50 apply to emails my AI agent sends?

If the agent writes and sends email to people by itself, generally yes: the Commission names agents "managing correspondence" as covered by Article 50(1). If the AI drafts and you review and send the email as your own, the guidelines treat that as an AI assistance tool, generally outside 50(1).

When does Article 50 apply?

From 2 August 2026, under Article 113. The Digital Omnibus (Regulation (EU) 2026/1744) moved only the Article 50(2) marking duty, to 2 December 2026, for systems already on the market before 2 August 2026. Disclosure to people an AI interacts with has no grace period.

What are the fines for breaking Article 50?

Up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher, under Article 99(4)(g); for SMEs and start-ups, whichever is lower. Each Member State lays down the penalty rules and enforces them.

Are the Commission guidelines on Article 50 binding?

No. The guidelines say so themselves and add that only the Court of Justice of the EU can give an authoritative interpretation. They are still the clearest statement of how the Commission reads Article 50.

Put your own details on every signature you send

Signatoro puts your name, title and contact details on every signature, free for one person. From the Up to 15 plan, a company adds one compliance footnote to everyone's signature.

Create my company Build my own signature, free

Related guides

AI agent email signature Give your signature to an AI agent Email signature MCP AI disclosure statement examples Should your AI assistant sign emails as you? Can an email your AI agent sends bind you?

Other pages in this series

CAN-SPAM and your email signature GDPR and your email signature PECR and marketing email signatures UK company email signature requirements HIPAA email disclaimer myths FINRA email disclaimer myths Do you have to disclose AI in emails? Compliance hub

Sources