Article 50 of the AI Act from 2 August 2026: what applies to a self-hosted LLM

Reading time: about 7 minutes

Contents

1. What actually started applying on 2 August
2. Provider or deployer when you self-host an LLM
3. The four Article 50 duties and who they fall on
4. Why the assumption "this is the SaaS vendor's problem" breaks down
5. FAQ
6. What this article does not cover
7. Disclosure and biases

Answer first

From 2 August 2026, Article 50 of the AI Act applies. These are the transparency duties: a system that talks to a person must disclose that it is AI, and generated content (text, image, audio, video) must carry a machine-readable mark that it was produced artificially. The Digital Omnibus pushed the duties for high-risk systems under Annex III to 2 December 2027, but it left Article 50 out of that deferral, so transparency started on the original date. If you host your own model on-prem, the key question is not "does this apply to us" but "in which role". When you self-host, you are very often provider and deployer at the same time under the AI Act, and those are two different sets of duties. The popular commentary on Article 50 assumes the reader is buying a ready SaaS product. For a self-hosted LLM that assumption does not hold.

What actually started applying on 2 August

The AI Act, as amended by the Digital Omnibus package, entered into force on 27 July 2026. The Omnibus deferred the heaviest part, the duties for high-risk systems under Annex III (new date 2 December 2027) and under Annex I (2 August 2028). Two things remained for 2 August 2026 and are worth separating: the Article 50 transparency duties, and the power of supervisory authorities to impose fines.

That distinction is a common source of error. "The AI Act was postponed" is shorthand about high-risk. The transparency layer was not postponed and, from 2 August, national market surveillance authorities can enforce it.

AI Act element	Date	Status on 3 Aug 2026
Entry into force after Omnibus	27.07.2026	in force
Article 50, transparency duties	2.08.2026	in force
Fines for breaches (incl. Article 50)	2.08.2026	enforceable
High-risk systems, Annex III	2.12.2027	deferred
High-risk systems, Annex I	2.08.2028	deferred

There is one buffer: generative systems already on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable content marking requirement under Article 50(2). That is a technical window to adjust marking, not an exemption from the remaining duties.

Provider or deployer when you self-host an LLM

The AI Act assigns duties by role. A provider is an entity that develops an AI system or model and places it on the market or puts it into service under its own name. A deployer is an entity that uses an AI system in the course of its professional activity.

In a SaaS model these roles are separated: the cloud vendor is the provider, you are the deployer. When you self-host, the line blurs. If you take an open-weight model, fine-tune it, build an application around it and make it available to users under your own brand, in many scenarios you step into the provider role for that specific system while remaining a deployer, because you also use it. This is not a lawyerly ornament. Provider and deployer carry different Article 50 duties, so a single organization can be responsible for both ends of the chain at once.

The practical takeaway: before you assess what you must do, establish the role per system, not per company. The same team can be the deployer of an internal assistant and the provider of a tool exposed to clients.

The four Article 50 duties and who they fall on

Article 50 describes four main situations. Below, in short, with a note on which side carries the duty.

Situation	Duty	Role
System interacts directly with a person (chatbot, assistant)	Inform the person that they are dealing with AI, unless it is obvious from context	Provider
Content generation (text, image, audio, video)	Mark the output machine-readably as artificially generated or manipulated	Provider
Deepfake, that is content closely resembling real people, places, events	Disclose that the content was artificially generated or manipulated	Deployer
Emotion recognition or biometric categorisation	Inform the affected persons that the system is operating	Deployer

For an on-prem deployment this gets concrete. If you expose an assistant that talks to a client, as the provider you are responsible for the "this is AI" notice and for marking generated content. If you use a model internally that produces material which may leave the building, you return to the deployer side with a disclosure duty. Content marking under Article 50(2) must be machine-readable, so a note in the interface footer is not enough, the marking has to sit at the level of the artifact itself.

Why the assumption "this is the SaaS vendor's problem" breaks down

Most Article 50 guidance is written from the perspective of a company that buys a finished product and asks what to require from the vendor. When you self-host, that perspective misleads for three reasons.

First, there is no external provider onto whom you can offload the marking duty. If you place the system into service under your own name, the provider duty is yours.

Second, fines are real from day one. For breaching provider and deployer duties, including Article 50, authorities can impose fines of up to EUR 15 million or 3 percent of total worldwide annual turnover, whichever is higher. Enforcement is possible from 2 August 2026, not only from the high-risk dates.

Third, the control over on-prem architecture that gets treated as an advantage turns, under Article 50, into responsibility. Since you hold the model weights and build the application layer, you are the one accountable for the marking and disclosure actually working in the product, not for the vendor having "handled it".

FAQ

Was Article 50 of the AI Act postponed by the Digital Omnibus? No. The Omnibus deferred duties for high-risk systems under Annex III to 2 December 2027 and under Annex I to 2 August 2028. Article 50 applies from 2 August 2026.

I host a model on-prem for internal use only. Does Article 50 apply to me? It depends on the use. If the system talks to people or generates content that leaves the organization, transparency duties can apply even with internal use. The role is set per system.

With my own LLM, am I a provider or a deployer? Often both at once. If you place the system into service under your own name, you enter the provider role, and by using it you remain a deployer. Those are two different sets of duties.

What is the maximum fine for breaching Article 50? Up to EUR 15 million or 3 percent of total worldwide annual turnover, whichever is higher.

By when must I have machine-readable content marking? Generative systems on the market before 2 August 2026 have until 2 December 2026 to meet the Article 50(2) requirement.

What this article does not cover

This text covers only the Article 50 transparency duties and the provider/deployer split in a self-hosting context. It does not discuss duties for high-risk systems under Annex III or requirements for general-purpose AI models (GPAI). It is not legal advice: classifying your specific system requires analysis with a lawyer who knows your case. Nor does it resolve the interpretive disputes that will emerge from the practice of national supervisory authorities in the coming months.

// disclosure & biasesDisclosure and biases

aionprem publishes about on-prem AI and compliance, so we have a built-in interest in self-hosting looking feasible. I try to balance that: I present Article 50 as a duty that is often heavier under self-hosting than under SaaS, not lighter. Dates and fine thresholds are cited from the regulation text and law firm publications, with links in the sources. Where the status is unsettled (for example classifying a specific system as high-risk), I flag it rather than simplify.

Next step

If you want to see how Article 50 interlocks with NIS2, GDPR and ISO 27001 without doing the same work three times, read Cross-mapping NIS2, AI Act, GDPR, ISO 27001 without duplication.

Related

• AI Act in manufacturing: high-risk classification and what it means for deployment
• Cross-mapping NIS2, AI Act, GDPR, ISO 27001 without duplication
• DPA for an AI vendor: 8 clauses whose absence sinks the audit
• NIS2 plus AI: mapping Article 21 to concrete controls, one cheat sheet

Sources

• The Article 50 text and guide at EU Artificial Intelligence Act confirm the scope of the transparency duties.
• The Sidley analysis "EU AI Act Transparency Obligations: Preparing for Compliance by 2 August 2026" covers the dates and scope.
• The Cloud Security Alliance note on Article 50 taking effect discusses enforcement and the Omnibus package.

Fryderyk Pryjma. Works on on-prem AI deployments for European manufacturing and writes at the intersection of architecture, compliance and regulation.