# What does Article 50 of the AI Act require of your agency from 2 August 2026? > Article 50 of the AI Act already applies: which content needs a label, who is responsible when the work is for a client and what fines AESIA imposes. *Source: · Kelp Labs, Madrid.* **[Berni Bouzas](https://www.linkedin.com/in/berni-bouzas)** 27 August 20269 min read [Kelp](https://kelp.work/en/)[Blog](https://kelp.work/en/blog/) ### In this piece In this piece - [Do I have to label everything I make with AI?](https://kelp.work/en/blog/ai-act-article-50-agencies#tengo-que-etiquetar-todo-lo-que-hago-con-ia) - [Who is responsible for a client's content, the agency or the client?](https://kelp.work/en/blog/ai-act-article-50-agencies#quien-responde-del-contenido-de-un-cliente-la-agencia-o-el-c) - [What is a deepfake under the regulation?](https://kelp.work/en/blog/ai-act-article-50-agencies#que-es-una-ultrafalsificacion-deepfake-segun-el-reglamento) - [What fines apply and who imposes them in Spain?](https://kelp.work/en/blog/ai-act-article-50-agencies#que-multas-hay-y-quien-las-pone-en-espana) - [What do I do this week?](https://kelp.work/en/blog/ai-act-article-50-agencies#que-hago-esta-semana) - [How does Kelp give you the audit trail Article 50 asks for?](https://kelp.work/en/blog/ai-act-article-50-agencies#como-te-deja-kelp-el-rastro-que-pide-el-articulo-50) - [Sources](https://kelp.work/en/blog/ai-act-article-50-agencies#fuentes) From 2 August 2026 your agency applies **two visible labels** : one on the deepfakes it produces (images, audio or video that resemble real people, objects, places or events) and another on AI-generated text it publishes to inform the public on matters of public interest. The invisible technical marking in the file is not your job: it falls on whoever sells you the model. You are the “deployer”, and you are responsible even when the work comes from a client. The date has passed and the instructions exist. On 20 July 2026 the European Commission published 51 pages of guidelines on how to apply Article 50, and on 10 June 2026 a code of practice with a set of icons you can use as they are. What is missing is the translation: what all of this means for a Spanish agency that produces content for clients. ## Do I have to label everything I make with AI? No. When the agency is the one using the tool, Article 50 **only covers two cases** : - deepfakes: images, audio or video generated or manipulated by AI that resemble something real and could pass as authentic (Article 50(4), first subparagraph) - text published to inform the public on matters of public interest (Article 50(4), second subparagraph) The third case, machine-readable marking, falls on the provider of the system: OpenAI, Google, Adobe or whoever sells it to you (Article 50(2)). Systems already on the market before 2 August 2026 have until 2 December 2026 for that marking, and that deadline is the provider's, not yours (Article 111(4), added by Regulation (EU) 2026/1744). You only become a provider if you modify a system and put it into service under your name or brand; generating content with a third-party tool **does not make you a provider** . The guidelines settle almost every question an agency has, with examples. Outside Article 50(4): - advertising copy and product descriptions, as long as they make no claims about health, consumer safety or sustainability - the report a consultancy gives its client on how to comply with a regulation - internal communications and anything posted on the intranet, because it is not “published” - fiction: novels, scripts, video games Inside: - an AI-generated summary of an article about a city council decision - an article on a lifestyle website, manipulated with AI, that compares diets and their effects on a disease - a corporate report with investor information published on a listed company's website - a storm warning on a meteorological institute's social media profile Two details that cost money. **A person has to be able to see the label** : you cannot rely on the invisible watermark the provider puts in the file, because it cannot be perceived without tools. And you do not have to label retroactively what has already been published, but text you generated in July and publish in September does need a label. ## Who is responsible for a client's content, the agency or the client? **The agency, by default.** The guidelines use this example: a company that simply commissions an advert from an agency, without deciding or controlling whether the agency uses AI in production, is not the deployer. The agency is, because it decides what the system is used for and how. Three practical consequences follow: - your employees and freelancers are not separately liable: the agency is liable as a legal entity, also when it subcontracts - if the client does decide and control the use of AI, the client is the deployer, and it is worth putting that in writing - the media outlet, platform or distributor that only disseminates the content is not the deployer, but it can strip your label when it recompresses or crops That third point is the one that goes into the contract. The guidelines expect the deployer to take proportionate measures so that the label reaches the public visibly at first contact, and they expressly mention contractual terms with distribution partners. In practice, the useful clause is not “the client assumes responsibility”, which does not release you; it is the one that obliges whoever publishes to **keep the label** . ## What is a deepfake under the regulation? Image, audio or video content generated or manipulated by AI that resembles real people, objects, places, entities or events and could falsely appear to someone to be authentic (Article 3(60)). The Spanish version of the regulation first said “ultrasuplantación” and a corrigendum changed it to “ultrafalsificación”; in everyday speech it is a deepfake. These are deepfakes, according to the Commission's examples: - a video with an AI-generated celebrity or influencer in an advert - a realistic synthetic avatar of the CEO congratulating staff - a product image in an advert or on packaging that makes the product look different, more attractive or better quality than it is These are not: - a real car on an AI-generated background, as long as the advert does not mislead about the product - colour correction, noise reduction, reframing or background replacement for aesthetic purposes - the impossible: dragons, elephants driving, mice arguing about cheese If the piece is part of an evidently creative, satirical, artistic or fictional work, the obligation is lighter: it is enough to disclose it in a way that does not spoil the work, for example in the credits, the information sheet or the post. ## What fines apply and who imposes them in Spain? Up to €15 million or 3% of worldwide turnover for the previous financial year, whichever is higher (Article 99(4)(g)). If you are an SME, the lower of the two applies (Article 99(6)): for an agency with a turnover of €2 million, **the ceiling is €60,000** , not €15 million. Anyone can file a complaint (Article 85), and having implemented the commitments of the code of practice can count as a mitigating factor when the amount is set. Who imposes fines: the market surveillance authority each Member State designates. In Spain it is the Spanish AI Supervisory Agency (AESIA), created by the seventh additional provision of Law 28/2022 (the Startups Act) with “administrative, inspection and sanctioning” powers, and with statutes approved by Royal Decree 729/2023. As of 27 August 2026, the Spanish law that sets out the penalty regime for the regulation has not been published in the BOE (Spain's Official State Gazette), so the applicable amounts are those of the European regulation. The Spanish Data Protection Agency (AEPD) stays in the picture: where personal data is involved, the GDPR continues to apply in parallel and Article 50 does not displace it. ## What do I do this week? - List what you produce with AI and sort it into three boxes: deepfakes, public-interest text and everything else. Only the first two need a label. - Download the Commission's “AI” icon and decide where it goes in each format. It must be visible at first contact, without anyone having to click. - Review the editorial calendar. Text generated before 2 August and published after it needs a label. - Write the internal process on one page: who decides whether something is a deepfake, who applies the label and who checks it. - If you rely on the human review exception, give it a name and a face. Require real fact-checking, not a style pass. - Publish on your website who holds editorial responsibility, with their contact details. Without that, the exception does not hold. - Change the contract clause: whoever publishes keeps the label. - Train the team and the freelancers. Ten minutes and three examples are enough to start. - Decide whether to sign the code of practice. By the end of July 2026 about 190 organisations had signed it. ## How does Kelp give you the audit trail Article 50 asks for? There is one piece the list above does not cover, and it is the first thing AESIA will ask for if it makes enquiries: **the audit trail** . The label is already visible; what AESIA will want to see is what lies behind it: what was generated with AI, with which system, who reviewed the output and which delivery it ended up in. That record almost never exists, because keeping it by hand is the kind of task no agency does in a delivery week. Kelp is the AI for agencies, consultancies and professional services firms, and it **keeps that trail by default** . AI work goes through Kelp, so the firm's memory records what was generated, with which instruction, who signed it off and which client it was delivered to. When the question comes, the record already exists, without anyone filling in a separate document. It also solves the step before, the one the internal process in point 4 does not fix on its own: today, in most firms, each person uses their own ChatGPT, and that use leaves no trail at all. With Kelp, AI works in the firm's official workspace: with permissions by role and by client, with each client's information kept separate and with your sign-off before anything important goes out. The internal process stops being a document that relies on everyone's memory: it is followed automatically, because it is built into the tool. Kelp operates in compliance with the EU AI Act and the GDPR and is certified to ISO 42001, the standard for responsible AI management that very few companies in Spain hold. How it works inside: [Memory and judgement](https://kelp.work/en/memory) and [Security](https://kelp.work/en/security). ## Sources - [Regulation (EU) 2024/1689, consolidated text as of 27 July 2026eur-lex.europa.eu](https://eur-lex.europa.eu/legal-content/ES/TXT/?uri=CELEX:02024R1689-20260727) - [Regulation (EU) 2026/1744, which amends itdata.europa.eu](http://data.europa.eu/eli/reg/2026/1744/oj) - [Commission guidelines on Article 50, C(2026) 5054digital-strategy.ec.europa.eu](https://digital-strategy.ec.europa.eu/en/library/guidelines-transparency-obligations-providers-and-deployers-ai-systems) - [code of practice and icon setdigital-strategy.ec.europa.eu](https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content) - [Law 28/2022, which creates AESIAboe.es](https://www.boe.es/eli/es/l/2022/12/21/28/con) - [Royal Decree 729/2023, AESIA statutesboe.es](https://www.boe.es/eli/es/rd/2023/08/22/729) This is general information about a regulation, not legal advice. Before changing contracts or processes, check with your lawyer. **[Berni Bouzas](https://www.linkedin.com/in/berni-bouzas)** Builds Kelp at Kelp Labs in Madrid, with Spanish professional services firms. Published on 27 August 2026 This blog may have been written, reviewed or edited with AI: ours, Kelp. ### Get the next one We write when we publish a new piece. No weekly newsletter or press round-ups. Only to tell you about new pieces. You can unsubscribe at any time. ## Shall we look at it with your case? Half an hour on your real operation: what you can automate, what you can't and what you still need to document. [Tailored demo →](mailto:hola@kelp.work?subject=Demo%20de%20Kelp)