AI Content Disclosure Audit: EU AI Act Article 50 Checklist for Client Work

On 31 August 2026, VIA Nederland — the Dutch advertising trade body — published guidance mapping exactly when creative agencies owe AI transparency duties (AI-transparantie voor creatieve bureaus, Dutch original), and PPC Land's September 5, 2026 coverage walked agencies through the same four triggers. The law behind the guidance is not speculative: Article 50 has been live since 2 August 2026, with Commission implementing guidelines (C(2026) 5054 final) adopted 20 July 2026. This page turns the framework into a disclosure audit you can run on client work — whether you produce the work at an agency or buy it from one.

Start the audit with the role check, then test each of the four triggers as a yes/no item. When a trigger fires, the item tells you who labels, how, and what evidence to keep.

EU AI Act Article 50 disclosure triggers

Work through the seven audit items below. Each item has a concrete verification step. If an item fails, the fix is a disclosure, a documented review, or an engineering change — not a renegotiation of the whole engagement.

1. Role check: are you a deployer or a provider for this piece of client work? A provider develops an AI system — or has it developed — and places it on the market or puts it into service under its own name. A deployer uses an AI system under its own authority for professional purposes. Most creative agencies are deployers: they do not build models, they use existing systems such as ChatGPT, Midjourney or Adobe Firefly. The role decides which duty applies. Providers must ensure synthetic output is marked in a machine-readable format and detectable as artificially generated (Article 50(2)). Deployers owe the visible, human-perceivable labels for deepfakes and public-interest text (Article 50(4)). A deployer cannot satisfy a visible label by pointing at the provider's machine-readable marking. Yes/no test: for this engagement, do you only use existing AI systems (deployer), or did you build or commission an AI system placed under your own name (provider)? Keep the role determination in the client file.

2. Trigger 1 — AI chatbot or brand assistant: is AI disclosed at first contact? When an AI system communicates directly with people — a brand chatbot answering questions, an AI brand assistant giving product advice, an AI persona — users must be informed they are interacting with AI (Article 50(1)), unless it is obvious from the point of view of a reasonably well-informed, observant and circumspect person given the context. A consumer-facing chatbot styled to resemble a human employee rarely gets the "obvious" pass. Yes/no test: does the client work deploy an interactive AI that talks to people? If yes, is there a clear AI notice at first contact — a short text notice for chat, a spoken notice for a voice assistant? A mention buried in terms and conditions, or anywhere a user must search, does not satisfy the duty. Evidence to collect: the first-contact script and proof of where the notice appears.

3. Trigger 2 — Synthetic image, audio or video: does it pass the deepfake test? A deepfake is AI-generated or manipulated image, audio or video content "that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful" (Article 3(60)). The practical test: could a viewer be deceived about the authenticity of the content? Two details matter. First, the AI person does not have to match a known real individual — what counts is whether the created person could be taken for a real one. Second, clearly fictional scenes, minor technical post-production, and the mere fact AI was in the pipeline do not by themselves make a deepfake. Yes/no test: for each AI-generated or manipulated image, audio or video deliverable, could the audience be deceived about authenticity — including a photoreal AI talent in a realistic setting, a synthetic voice resembling a known presenter, or content implying an event that did not happen? If yes, the deployer must disclose at first exposure in a clear, distinguishable, human-perceivable way. Metadata alone or an invisible technical watermark is not enough, and the artistic-content carve-out does not rescue content where the commercial message dominates. Evidence to collect: the visible label asset, its placement, and the creative-review note. If no, keep the rationale: the Commission's own example treats AI video of cartoon mice arguing over cheese in an ad as clearly fictional, not a deepfake.

4. Trigger 3 — AI-drafted text: is it public-interest text that must be disclosed? Deployers owe a text disclosure only when AI generates or manipulates text "published with the purpose of informing the public on matters of public interest" — politics, public health, public safety, fundamental rights, or other developments relevant to public debate (Article 50(4), second sub-paragraph). For agencies this usually means societal and public-awareness campaigns, not routine commercial copy, blogs or social posts. Yes/no test: is the AI-drafted or AI-assisted text informing the public on a matter of public interest? If yes, disclose that the text is artificially generated — unless it "has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication." The human review must be substantive and documented: a spellcheck or rewriting a few sentences is not enough. Evidence to collect: the label on the published text, or the editorial sign-off naming the person who reviewed it and when.

5. Trigger 4 — Custom AI tool built on a model: are you in provider territory? An agency that develops its own AI system, or an application layered on an existing model, may qualify as a provider for that specific tool — the least common but most consequential scenario. VIA's rule: each application must be assessed individually; there is no bright-line test. Yes/no test: did your agency build a custom AI tool or application on top of an existing model — for example a branded "campaign copy generator" or a client-facing assistant wrapper? If yes, assess whether the agency is a provider for that tool. If it is, synthetic output from the tool must be "marked in a machine-readable format and detectable as artificially generated or manipulated" (Article 50(2)), typically with digitally signed, time-stamped metadata plus an imperceptible watermark per the Code of Practice — not merely a visible label. Marking is not required where AI only performs an assistive function for standard editing or does not substantially alter the input. Evidence to collect: the per-application role assessment and the technical marking specification. Note: using the same API model directly to draft one client's copy does not flip the role for that engagement.

6. Responsibility-chain analysis: who in the agency-client workflow must label, and how? Article 50 duties do not follow the tool — they follow the role each organization plays in the chain. Map the workflow: which party develops or places the AI system (provider duties: machine-readable marking), and which party uses it under its own authority for professional purposes (deployer duties: visible labels)? When the agency builds the interactive tool for a client, the provider-side duties sit with the builder; when the client uses an existing off-the-shelf assistant, determine which party in the chain owes the first-contact disclosure — VIA flags this as a separate analysis with no bright-line answer. When the agency merely uses signatory tools (Google, Meta, Anthropic and roughly 190 others adhere to the Code of Practice), the agency inherits the machine-readable marking those providers add — no build work needed. Verification step: for each AI-touching deliverable, write down who must label (provider, deployer, or both), what the label must be (machine-readable marking, visible label, or both), and where in the deliverable it appears. Keep that map in the client file so a regulator, client or insurer can see the decision.

7. Evidence field: assemble the disclosure audit file. An Article 50 audit is only as good as its evidence. For each client engagement that touches AI, collect: (1) the first-contact script and placement proof for any chatbot or brand assistant; (2) the visual or audio label assets and placement proof for any synthetic image, audio or video that passed the deepfake test; (3) the machine-readable marking specification (metadata and watermark approach) for any custom AI tool your agency built on a model; (4) the editorial sign-off record naming the human who substantively reviewed public-interest text and holds editorial responsibility; and (5) the role-assessment memo documenting the deployer/provider determination per application. Store the evidence with the client file, not in a folder only the account team knows about. Verification step: open the file for a completed AI-touching engagement — can a new person reconstruct who labeled what, how, and on what date?

How this audit fits your other AI checks

The Article 50 disclosure audit covers the transparency side of client-facing AI work: who must tell the public that content or an interaction is AI. It complements the operational audits on this site — the AI agent risk checklist for agent security and permissions, and the Claude watermark and C2PA audit guide for what provenance marks do and do not prove when you verify AI content from vendors. For the agency-side explainer of the same four triggers — with the checklist table, agency examples, and the deployer/provider role split — see the EU AI Act Article 50 guide for AI agencies on Find AI Agency. If you buy AI services rather than produce them, run the same four triggers against your agency's deliverables: the duty in the chain is exactly what a vendor should be able to document.

Bottom line

EU AI Act Article 50 is enforceable law since 2 August 2026, and the Dutch trade body VIA Nederland has given agencies a concrete four-trigger framework for when client work must be disclosed as AI. The audit is runnable in an afternoon: confirm your role as deployer or provider, test the chatbot, deepfake, public-interest-text and custom-tool triggers as yes/no items, map who in the chain must label and how, and keep the first-contact scripts, label assets, marking specs and editorial sign-offs in the client file. The agencies that treat transparency as part of delivery — not a pre-launch scramble — are the ones that will be ready when a client, an insurer, or a regulator asks to see the audit trail.

Run the free AI audit tool

Frequently asked questions