Guide · Art. 50

EU AI Act Limited Risk: What It Means and Why It's Article 50

Last updated: 8 November 2026

EU AI Act limited risk is a label, not a legal term: the phrase never appears in the Regulation. It describes AI systems with transparency duties under Article 50, such as chatbots, deep fakes and emotion recognition, which apply from 2 August 2026. Article50.io scans a public page for signs of some of these. Not legal advice.

This page is general information about the AI Act's risk tiers and Article 50.

Scan for free

“Limited risk” is not in the AI Act's text

The EU AI Act is often drawn as a pyramid with four risk tiers: unacceptable, high, limited and minimal. That picture is a useful summary, but it is not the law. The phrase “limited risk” does not appear anywhere in the text of Regulation (EU) 2024/1689. It is a label for one group of AI systems: those covered by the transparency rules in Article 50. The Commission's own AI Act page uses both names: it heads this tier “Transparency risk” and labels it “limited risk” in its risk pyramid graphic.

So when someone asks what “limited risk” requires, the legal answer is: whatever Article 50 requires for that AI system. The Regulation is built around specific articles, not tier names, and the article tells you who holds the duty and what it is. For a walk-through, see Article 50 explained.

The four tiers, mapped to the law

Here is how each popular tier lines up with the part of the AI Act that actually creates obligations.

EU AI Act risk tiers and their legal basis
Tier	Where in the AI Act	Examples	What applies
Unacceptable risk	Article 5 (prohibited practices)	Social scoring, manipulative or deceptive techniques, untargeted scraping of facial images, emotion recognition at work or in education; from 2 December 2026 also AI generating non-consensual sexual deepfakes or child sexual abuse material	Banned since 2 February 2025 (the two new bans from 2 December 2026). Fines up to €35 million or 7% of worldwide annual turnover, whichever is higher (Article 99(3))
High risk	Article 6 with Annex I and Annex III (Chapter III)	AI that is a safety component of products covered by Annex I; uses listed in Annex III, such as education and vocational training, employment and workers' management, and access to essential private and public services	Chapter III requirements, from 2 December 2027 (Annex III) and 2 August 2028 (Annex I)
“Limited risk” (transparency)	Article 50	Chatbots, voice agents, AI avatars, deep fakes, generative AI outputs, AI text on matters of public interest, emotion recognition	Disclosure and marking duties, from 2 August 2026
Minimal risk	No specific article	Other AI uses not caught above	No specific obligations beyond, for example, AI literacy (Article 4); voluntary codes of conduct (Article 95)

General-purpose AI models are a separate track: they sit in Chapter V of the Act, and their rules have applied since 2 August 2025. Dates come from Article 113 and the Digital Omnibus; the full timeline is in Was Article 50 delayed?

The tiers are not boxes

The pyramid suggests each AI system sits in exactly one tier. The law doesn't work that way. The Commission's Article 50 guidelines (C(2026) 7702 final, 5 November 2026, non-binding, para. 25) say “AI systems falling within the scope of Article 50 AI Act may also be classified as high-risk”, and that “AI systems can also fall within the scope of Article 50 AI Act without being classified as high-risk”.

✔A high-risk system that also talks to people must meet Chapter III and Article 50. Article 50(6) says paragraphs 1 to 4 do not affect the high-risk requirements.
✔A system can have Article 50 duties and no high-risk duties at all, as with many website chatbots.
✔AI literacy under Article 4 also applies to Article 50 providers and deployers (guidelines para. 25).
✔Meeting Article 50 does not make a use lawful. Recital 137 says complying with Article 50 does not mean the use is lawful under the rest of the Act, and Article 50(6) keeps other EU and national transparency rules in place.

Not sure where you stand? Start with Does Article 50 apply to you?

What counts as “limited risk”: examples by paragraph

Article 50 splits duties between the provider (who develops an AI system, or has it developed, and puts it on the market or into service under its own name) and the deployer (who uses an AI system under its authority, outside personal non-professional use). Both are defined in Article 3.

✔Chatbots, Article 50(1). Provider duty: people must be told they are interacting with an AI system, unless that is obvious to a “reasonably well-informed, observant and circumspect” person. Article 50(5) sets the timing: “in a clear and distinguishable manner at the latest at the time of the first interaction or exposure”. See Does my chatbot need an AI disclosure?
✔Voice agents, Article 50(1). The same provider duty: an AI that speaks with callers or visitors interacts directly with people.
✔AI avatars. Article 50(1) where the avatar interacts with people. If it is a deep fake of a real person, Article 50(4) also applies: the deployer must disclose that the content is artificially generated or manipulated.
✔Deep fakes, Article 50(4) first subparagraph. Deployer duty. A deep fake is AI-generated or manipulated image, audio or video that resembles existing persons, objects, places, entities or events and “would falsely appear to a person to be authentic or truthful” (Article 3(60)). For evidently artistic, creative, satirical or fictional work, the duty is limited to disclosing such content “in an appropriate manner that does not hamper the display or enjoyment of the work”.
✔AI-generated images, audio, video and text, Article 50(2). Provider duty: the provider of the generative AI system must mark outputs in a machine-readable format and make them detectable. This is not a visible label, and there is no blanket duty to put a visible label on every AI image; a visible disclosure is needed where the content is a deep fake under Article 50(4). See EU AI Act watermarking.
✔AI text on matters of public interest, Article 50(4) second subparagraph. Deployer duty: text “published with the purpose of informing the public on matters of public interest” must be disclosed as AI-generated, unless it “has undergone a process of human review or editorial control” and someone holds editorial responsibility for the publication.
✔Emotion recognition and biometric categorisation, Article 50(3). Deployer duty: inform the people exposed to the system that it is operating.

Timing: Article 50 has applied from 2 August 2026 to every system in scope, whenever it was placed on the market (guidelines para. 153). The one transition is for Article 50(2) marking: providers of generative AI systems placed on the market before 2 August 2026 have until 2 December 2026, under Article 111(4), inserted by the Digital Omnibus. More in Article 50 questions.

Fines for “limited risk” breaches

Non-compliance with Article 50 can lead to fines. Under Article 99(4)(g), breaches of the “transparency obligations for providers and deployers pursuant to Article 50” can be fined up to €15 million or, for an undertaking, up to 3% of total worldwide annual turnover for the preceding financial year, whichever is higher.

For SMEs, including start-ups, the cap is whichever of the two is lower (Article 99(6)). The Digital Omnibus inserted Article 99(6a), extending the same rule to small mid-cap enterprises. Member States set the penalties, which may also include warnings and non-monetary measures, and must take into account the interests and economic viability of SMEs and SMCs (Article 99(1)). Prohibited practices under Article 5 carry up to €35 million or 7%. Details in EU AI Act fines for Article 50.

What a website owner should do

✔List the AI on your pages that talks to people: chat widgets, voice agents, avatars. Check that visitors are told it is an AI, clearly, at the latest at the first interaction (Article 50(1) and 50(5)). If you built a chatbot in-house and run it under your own name, the guidelines treat you as its provider (para. 11).
✔Check images, audio and video. If anything is a deep fake, disclose it (Article 50(4)). For other AI images, machine-readable marking is the generator provider's duty under Article 50(2).
✔Check AI-written text that informs the public on matters of public interest. Disclose it, unless it has had human review or editorial control and someone holds editorial responsibility.
✔If you use emotion recognition or biometric categorisation, inform the people exposed (Article 50(3)).
✔Check the other tiers too. The Commission's free EU AI Act Compliance Checker is a questionnaire (currently in beta) that helps you see which AI Act rules may apply. It does not look at your website.

Then run a free scan. The Article50.io scan loads one public page in a real browser, capped at 45 seconds, with no signup. It shows the single most severe finding and lists what it couldn't check. It looks for chat widgets, voice agents and AI avatars with no AI disclosure when the page loads, AI-generated content markers, and how clearly any disclosure is shown. It covers Article 50, not high-risk rules, prohibited practices or general-purpose AI models. In our study of popular EU websites, 58 of 59 with a chat widget showed no AI disclosure at first view (automated scan, 21–22 October 2026).

The €499 scan report lists every finding from the same scan with a ready-to-paste fix (pricing). It is not legal advice, and a clean result is not a compliance clearance.

Frequently Asked Questions

Is “limited risk” a legal term in the EU AI Act?

No. The phrase “limited risk” does not appear in the text of the AI Act, Regulation (EU) 2024/1689. It is a label for AI systems covered by the transparency obligations in Article 50; the Commission's AI Act page heads the tier “Transparency risk” and labels it “limited risk” in its risk pyramid. The legal duties come from Article 50 itself.

What counts as limited risk AI under the EU AI Act?

AI systems covered by Article 50: systems that interact directly with people, such as chatbots, voice agents and interactive avatars; generative AI that produces synthetic audio, image, video or text; deep fakes; AI text published to inform the public on matters of public interest; and emotion recognition or biometric categorisation systems.

Can an AI system be high risk and limited risk at the same time?

Yes. The Commission's Article 50 guidelines (para. 25) say AI systems in scope of Article 50 may also be classified as high-risk, and that a system can fall within Article 50 without being high-risk. Article 50(6) confirms the transparency duties do not affect the high-risk requirements in Chapter III.

Do I have to put a visible label on every AI-generated image?

No, there is no blanket labelling duty. Article 50(2) requires the provider of the generative AI system to mark outputs in a machine-readable format. A visible disclosure is a deployer duty under Article 50(4) where the image is a deep fake: it resembles real persons, objects, places or events and would falsely appear authentic.

What is the fine for breaching Article 50?

Up to €15 million or 3% of total worldwide annual turnover, whichever is higher, under Article 99(4)(g). For SMEs, including start-ups, and small mid-cap enterprises, the lower of the two applies (Article 99(6) and (6a)). Member States set the penalties and must consider the economic viability of smaller businesses.

EU AI Act fines for Article 50

When do the limited risk rules apply?

Article 50 applies from 2 August 2026 to all systems in scope, whenever they were placed on the market, and the Digital Omnibus did not delay it. Providers of generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the Article 50(2) machine-readable marking duty.

If I meet Article 50, is my AI use legal?

Not necessarily. Recital 137 of the AI Act says complying with the Article 50 transparency obligations does not mean the use of the AI system is lawful under the rest of the Act. Article 50(6) also keeps other EU and national transparency rules in place, and prohibited practices and high-risk rules still apply separately.

Check your site automatically

Article50.io is an automated scanner for the Article 50 transparency rules of the EU AI Act. It scans a website for potential Article 50 transparency gaps and generates a report of what the scan found and what it could not check, with remediation guidance, implementation instructions and disclosure wording you can paste in.

The free scan shows your single most severe finding. Scans are capped at 45 seconds — no signup, public pages only. The full scan report is €499 one-off, with a ready-to-paste fix for every finding: see pricing.