AI Strategy

EU AI Act Article 50: Audit Your AI Touchpoints Before You Automate

Understand what EU AI Act Article 50 means for Australian SMBs: audit AI touchpoints, disclosure, machine-readable marking and human review before automation.

Abstract illustration of three AI transparency touchpoints connected to a human review checkpoint

Article 50 of the EU AI Act started applying on 2 August 2026. For an Australian business, the practical question is not simply whether it trained an AI model. It is where a customer, employee or member of the public encounters AI, what the system produces, and who can intervene when the workflow needs review.

What Changed on 2 August 2026?

The European Commission says Article 50 creates transparency obligations for providers and deployers of certain AI systems. Providers of systems that directly interact with people must make sure people know they are interacting with AI unless that is obvious. The notice should be clear and distinguishable from the start of the first interaction.

Providers of AI systems that generate synthetic audio, images, video or text must also support machine-readable marking and detection of AI-generated or manipulated outputs, subject to the scope, exceptions and technical feasibility described in the Act and Commission guidance.

Deployers have separate obligations in specific situations. These include informing people when emotion-recognition or biometric-categorisation systems are operating, disclosing deepfakes, and labelling certain AI-generated or manipulated text published to inform the public about matters of public interest when it has not gone through substantive human review or editorial control.

The useful starting point is the touchpoint, not the model name: identify where people meet AI, what they see, and who has authority to pause the workflow. — RxAI interpretation for Australian SMBs

Which AI Touchpoints Could Matter for an SMB?

A small business can encounter these questions without building its own model. Common touchpoints include a website chatbot, an automated social-media reply, a booking or intake assistant, AI-generated marketing material, synthetic product imagery, voice or video content, and internal tools whose output is later published or sent to customers.

The Act distinguishes between providers and deployers, so ownership needs to be recorded rather than assumed. An Australian business may also need to look more closely if its system output is used in the EU. The Commission’s FAQ says providers established outside the EU can still be subject to the Act in that situation, while the actual analysis depends on the role, service, users and output.

lightbulb

RxAI practical rule

Do not treat a vendor’s default settings as your governance record. Keep a short internal note showing the interface, the disclosure, the reviewer and the stop path.

What Should You Record for Each Touchpoint?

Start with one simple table. The aim is to create a shared operating view for marketing, customer service and management, not to present a spreadsheet as legal certification.

  1. Where is the entrance? Record the page, inbox, form, app screen or public channel where a person encounters the system.
  2. What does the system produce? Separate direct conversation from generated text, images, audio or video. Note whether the output is public, customer-facing or internal.
  3. Who owns the decision? Name the provider or vendor relationship, the internal deployer and the person who can review, edit, reject or stop the workflow.
  4. What does the person see? Save the first-interaction notice, content label, accessibility treatment and any machine-readable marking information supplied by the vendor.
  5. What evidence exists? Link to provider documentation, keep a dated screenshot, record the last test and note what changed when the workflow or model was updated.

What Can You Do in the Next 10 Minutes?

Open a spreadsheet and list three AI touchpoints that are genuinely in use today. For each one, answer two questions: when does a person first know they are dealing with AI, and which person can review or stop the output before it reaches a customer or the public?

Then ask the vendor for the transparency or marking documentation that applies to the product you are using. If a system was already placed on the market before 2 August 2026, the Commission describes a limited grace period until 2 December 2026 for the marking and detection obligation only. That is not a blanket delay for every Article 50 duty, and it is not a reason to postpone the inventory.

For implementation support, RxAI can help map the workflow, evidence trail and review points through its AI consulting services. If you need a second pair of eyes on a live touchpoint, book a consultation with the team. This article is practical guidance, not legal advice; obtain professional advice for a specific applicability or compliance assessment.

Where Can You Verify the Details?

Use the primary legal text and Commission guidance together. The FAQ and guidelines explain the role split, scope and examples in plain language, while EUR-Lex contains the binding Article 50 wording and the application date.

Frequently Asked Questions

It can. The European Commission says providers outside the EU may be subject to the Act when their system output is used in the EU. The answer depends on the business role, service, users and output, so obtain professional advice for a specific assessment.

A provider of an AI system that directly interacts with people must inform them that they are interacting with AI unless that is obvious. The notice should be clear and distinguishable from the start of the first interaction.

No. Article 50 has specific criteria for AI-generated or manipulated text published to inform the public on matters of public interest, and an exemption can apply where there has been substantive human review or editorial control with editorial responsibility.

Keep an inventory of AI touchpoints, provider documentation, disclosure wording and screenshots, the person who can review or stop the workflow, review dates and test results. This is an RxAI operating recommendation, not a legal certification checklist.