The EU AI Act Just Changed Cold Email Compliance Forever

Cold email compliance was already a high-wire act. GDPR consent requirements, CAN-SPAM opt-outs, deliverability rules that punish anything automated at scale. Now the EU AI Act has added another layer: transparency about the machine.

On 2 August 2026, Article 50 of the EU AI Act came into force across the European Economic Area. The rules impose disclosure obligations on businesses that use AI to interact with people, generate content, or analyze emotions and biometric data. Providers must tell people when they're talking to a bot and mark synthetic outputs so detection tools can identify them. Deployers must label deepfakes and AI-generated text on matters of public interest.

The regulations apply regardless of where a business is established. A SaaS company in San Francisco using a chatbot that serves EU users must comply. A London-based agency deploying an AI avatar in a client campaign targeting France must comply. An Indian outsourcing firm using emotion-recognition software on EU workers must comply.

The transparency rules don't ban AI outreach. They require openness about its use. That means rethinking how AI-assisted email sequences, chatbots, and content pipelines are structured and documented.

What are the four transparency obligations under Article 50?

A business may hold both roles for the same system. A marketing agency that builds and operates an AI chatbot for a client is the provider. If the agency also uses a third-party emotion-recognition tool to test ad creative, it is a deployer of that tool.

All four obligations share a horizontal requirement: information must be provided in a clear and distinguishable manner, at the latest at the time of first interaction or exposure, and must conform to accessibility requirements. Burying disclosure in terms and conditions or menu layers does not satisfy the standard.

When must providers disclose that someone is interacting with AI?

Article 50(1) requires providers to design AI systems that interact directly with people so those people know they are dealing with a machine, not a human. This covers chatbots, AI voice assistants, AI companions, social-media bots, and agentic AI systems that autonomously contact individuals by email or phone.

The exception is narrow: disclosure is not required if the AI aspect is obvious to a reasonably well-informed, observant, and circumspect person in context. The European Commission's Guidelines interpret this restrictively. An AI code assistant used only by professional developers may be obvious. A chatbot in an online helpdesk where users expect human support is not.

The test turns on the target audience. AI-enabled non-playable characters in a single-player video game are obvious because the nature of the game makes clear no other people can participate. An AI robotic companion pet designed to mimic real human-pet interaction is not obvious, particularly where children or elderly users are involved.

Disclosure must occur at the time of first interaction for each individual, not merely the first time the system is used generally. Where deployment involves children, elderly users, or individuals in sensitive domains (health, legal, financial advice, insurance, complaints handling), periodic contextual reminders are recommended in addition to the initial notice.

Backend decision-support systems fall outside the scope. If a user simply receives an AI-generated output without a two-way exchange, Article 50(1) does not apply.

What does machine-readable marking and detection mean for generative AI?

Article 50(2) requires providers of AI systems that generate synthetic audio, images, video, or text to mark outputs in a machine-readable format and provide a means of detection. Marking alone is not sufficient; the provider must also supply detection tools.

The marking must be embedded using metadata, watermarks, or other interoperable techniques. It is not visible to end users but must be effective and resilient enough to survive routine modifications. Providers of general-purpose AI models are encouraged to implement marking at model level to facilitate downstream compliance, but this does not transfer the provider's own responsibility to verify and demonstrate compliance.

The Code of Practice on Transparency of AI-Generated Content, assessed as adequate by the European Commission and the AI Board, reflects the current state of the art. For most content, providers should apply at least two marking layers: digitally signed metadata (where the content format supports it) and an imperceptible watermark embedded within the content itself. For free-form text, where metadata cannot be carried and watermarking is inherently less reliable, a single layer of watermarking is treated as sufficient.

Standard editing is exempt. Grammar correction, spellchecking, translation, minor cropping, or noise reduction do not trigger the obligation. AI-generated summaries, face alterations, adding or removing objects from images, or converting black-and-white to colour all require marking.

Real-time content that is ephemeral and consumed immediately without being recorded, stored, or disseminated further (such as in video games or virtual reality) is exempt where marking is not technically feasible and users are made aware of the AI origin through in-experience or session-level disclosure.

The industrial or business-to-business exemption is very narrow. It applies only where three cumulative requirements are met: the AI system's output is strictly technical in nature (for example, engineering designs or industrial production workflows), the output is only intended to be perceived by a limited predefined number of professionals within the organisation, and the output must not be intended to be shared outside the organisation, with safeguards against wider dissemination.

Code signatories must implement an interoperability solution for watermark detection by 2 February 2027, so content can be verified without running it against every provider's detection solution separately. There is no obligation to retrospectively mark content produced before 2 August 2026. For systems already on the market before that date, the AI Omnibus extends the deadline to 2 December 2026.

What must deployers disclose about emotion recognition and biometric categorization?

Article 50(3) requires deployers to inform people exposed to emotion recognition or biometric categorization systems that such a system is in operation. This applies to both real-time and ex post systems.

A video game that records a player's facial expressions to capture their emotions must display a prominent pop-up notice before play begins. A retail store using facial recognition to categorize visitors by age group must provide a visible notice at each entrance.

The obligation does not entail providing information about the purpose of the system's operation. It requires only that people know the system is in use.

When must deployers label deepfakes and AI-generated text?

Article 50(4) imposes two distinct labelling duties on deployers.

Deepfakes: Deployers must disclose that image, audio, or video content constituting a deepfake has been artificially generated or manipulated, regardless of whether it is published. A deepfake is AI-generated or manipulated content that resembles existing persons, objects, places, entities, or events and would falsely appear to a person to be authentic or truthful.

Three cumulative criteria must be met: resemblance (a high level of similarity between the deepfake content and the simulated subject), existence (simulated persons, objects, places, entities, or events resemble someone or something that exists, can plausibly exist, or could have plausibly existed in reality), and false appearance to be authentic or truthful.

The Guidelines allow stakeholders to consider the level of resemblance, the potential substantive message of the content, the intended and foreseeable deployment contexts, and the intended and reasonably foreseeable audience composition and their expectations. If the intended audience within a specific deployment context does not expect the content to be authentic or truthful, the AI-generated or manipulated content may not falsely appear to be authentic or truthful. For example, the AI-generation or manipulation of background scenes, special effects, or technical pre- and post-processing as part of standard movie production processes are not likely to make content falsely appear to the audience to be authentic or truthful.

Deployers must disclose deepfake content to a natural person upon first exposure at the latest, in a clear and distinguishable manner. It should be understandable and perceivable by natural persons (for example, with visible or audible labels), without need for any specific technical tools or performing dedicated actions. Deployers cannot simply rely on the machine-readable marking embedded in the content by the provider under Article 50(2) to fulfil their disclosure obligation.

For artistic, creative, satirical, fictional, or analogous works or programmes, the transparency obligation is limited to disclosure in an appropriate manner that does not hamper the display or enjoyment of the work (for example, in credits or accompanying notes rather than overlaid on the content). The Guidelines construe this narrowly: where content combines informative and creative elements, the informative character prevails, and the scope for reduced labelling in advertising is minimal.

AI-generated text on matters of public interest: Such text must be labelled unless it has undergone human editorial review and a natural or legal person holds editorial responsibility. For text to fall within this obligation, three criteria must be fulfilled: the text must be published, informative to the public, and on matters of public interest (such as politics and democratic processes, public administration and services, administration of justice and law enforcement, fundamental rights, public security, public health, environmental protection, consumer safety, and any economic, financial, political, scientific, or cultural developments that may be relevant subjects of public debate).

Human review refers to the deliberate examination of the substance of the content by one or more natural persons possessing relevant knowledge and professional judgement pertaining to the subject matter under scrutiny (for example, academic peer review or professional validation chains). Editorial control refers to the control exercised in practice by a responsible editorial entity (for example, an editor-in-chief) over the content, having the authority to approve, alter, or reject the substance of the text based on substantive grounds (including fact-checking of information and ensuring the trustworthiness of sources). Superficial, solely formal, or procedural checks (for example, spell-checking or grammatical correction) are not considered to be human review or editorial control. Editorial responsibility means that a person must hold the ultimate legal responsibility over the publication of the content, including the human review or editorial control.

If there is substantive AI intervention after editorial sign-off, the exception is lost.

Who must comply if they are outside the EU?

Providers established or located outside the EU are subject to Article 50 if the output of their AI system is used in the EU. The test is whether use in the EU is intended or foreseeable, not whether it is incidental or the result of unauthorised downstream use.

Deployers must comply where they foresee that outputs will be disseminated or used in the EU. Posting deepfake content on the globally accessible internet satisfies this test.

What are the penalties and how does Article 50 interact with other laws?

Penalties for non-compliance with Article 50 can reach €15 million or 3% of global annual turnover, whichever is higher.

Article 50 obligations apply alongside existing legal requirements. GDPR transparency obligations (Articles 13 and 14) and data protection impact assessments apply alongside Article 50(3). The Digital Services Act imposes separate (complementary but non-overlapping) AI content labelling obligations on very large online platforms. Failure to disclose AI interaction may also constitute a misleading practice under the Unfair Commercial Practices Directive.

Businesses should check applicable national law alongside their AI Act compliance, as some Member States have introduced additional transparency rules.

What should businesses do now?

Map AI systems. Identify all AI systems you provide or deploy, including third-party tools accessed via API or embedded in products.

Classify your role. Determine whether you are a provider, deployer, or both for each system.

Audit interaction points. For any AI system that interacts with individuals, assess whether the obviousness exception genuinely applies. If in doubt, disclose.

Assess content pipelines. Identify all points at which AI-generated content is created or published. Machine-readable marking may be implemented at different stages of the value chain, but the provider remains responsible for compliance.

Review vendor contracts. Ensure upstream providers are contractually committed to embedding appropriate markings and providing detection tools. Downstream distribution agreements should require preservation of metadata and labels.

Consider Code sign-up. Evaluate whether the streamlined compliance benefit justifies signing up to the Code of Practice on Transparency of AI-Generated Content, particularly if you generate or distribute AI content at scale. The initial sign-up window closed on 22 July 2026, but further windows are expected. Code signatories relying on watermarking must implement an interoperability solution for watermark detection by 2 February 2027.

Update governance and document exemptions. If you rely on any exception (for example, obviousness, editorial responsibility, artistic use), document the reasoning. Businesses deploying emotion recognition or biometric categorization systems should review privacy notices, records of processing activities, and data protection impact assessments alongside their Article 50(3) compliance work.