EU AI Act Article 50 content rules took effect August 2026 with fines up to 15 million euros. See when AI blog posts need a label, and when review exempts you.
August 2, 2026 already happened. That's when EU AI Act Article 50 content rules took effect, and if your SaaS blog reaches EU readers, they apply to you now, not on some future date, with a fine attached. This post answers the direct question: does a specific post need a label, and does your review process count as the exemption or not.
The short version: it depends on the topic and on whether a human actually reviewed the draft. We've covered the audit-trail mechanics of that review, what a record needs to capture and why a Git pull request already gives you most of one, in an earlier post. This one stays narrower and answers the yes/no question directly: which posts need a label, what "real review" means in the Commission's own words, and how that EU layer stacks on top of the US regulatory patchwork a fintech or healthtech blog already tracks.
Article 50 of Regulation (EU) 2024/1689, the AI Act, sets transparency obligations for AI systems, and one of those obligations reaches ordinary blog content: AI-generated text published to inform the public on matters of public interest has to be disclosed as such, unless a human reviewed it and someone holds editorial responsibility for publishing it. That single sentence is the whole compliance question for a content team, and the rest of this section unpacks each clause.
Article 50 contains two distinct duties that get flattened into one "AI labeling rule" in a lot of coverage, and the flattening causes real mistakes.
Article 50(2) requires providers of AI systems, meaning the companies building the generative tools, to mark synthetic output in a machine-readable format that's detectable as artificially generated. It's a technical, embedded-metadata duty aimed at the tool, not the publisher, and it only applies "as far as this is technically feasible."
Article 50(4) is the one that actually lands on a content team. It requires deployers, meaning whoever publishes the content, to disclose when AI-generated or manipulated text is published to inform the public on matters of public interest. And it carries the exemption everything below turns on: that disclosure duty "does not apply where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication," per the Act's own text on artificialintelligenceact.eu. Notice the shape of that exemption: it isn't a narrower disclosure requirement, it's a complete alternative path. Real review swaps out the label entirely.
The Act's territorial scope isn't limited to companies headquartered in the EU. Article 2(1)(c) of Regulation (EU) 2024/1689 covers "providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union," a general scope provision that isn't confined to high-risk systems, per the Act's own text. A US-based SaaS company with no EU office and no EU entity is still a "deployer" the moment an EU reader loads a post the company published. Company location doesn't matter. Reader location does.
Article 50's transparency obligations, disclosure included, became mandatory on August 2, 2026, per Cooley's summary of the effective date. Non-compliance carries fines of up to 15 million euros or 3% of a company's total worldwide annual turnover for the preceding financial year, whichever is higher, the same source confirms. For scale: that sits in the middle of the Act's penalty ladder, not its top. The harshest tier, reserved for prohibited practices like social scoring and real-time biometric surveillance in public spaces, reaches up to 35 million euros or 7% of worldwide turnover, per Holistic AI's breakdown of the Act's penalty tiers. Article 50 non-compliance is a real, enforceable exposure. It isn't the Act's existential fine.
There's a separate deferral worth naming precisely so it doesn't get mistaken for cover on the disclosure duty. Generative AI systems already on the market before August 2, 2026 get until December 2, 2026 to satisfy the Article 50(2) machine-readable marking requirement specifically, per reporting on the deadline. That extension belongs to AI system providers and one narrow technical duty. It does not touch Article 50(4)'s disclosure obligation, which has been live since August 2 with no grace period. And content that was both generated and published before that date doesn't need retroactive labeling; the duty applies going forward, not to your archive. The EU's Digital Omnibus agreement, which reached political agreement on May 6, 2026 and got final Council sign-off on June 29, 2026, deferred the heavier Annex III high-risk system obligations to December 2, 2027. That deferral is real, but it's a different part of the Act entirely: it does not touch Article 50's transparency duties, which stayed on the original 2026 timeline throughout.
That's the actual question underneath the compliance anxiety, and the Act's own guidance answers it more precisely than most coverage lets on. AI-assisted content with real editorial oversight is not the same thing as AI-generated content published unreviewed, and Article 50(4) draws that line explicitly rather than leaving it to interpretation.
The European Commission's guidelines on Article 50 spell out what "human review" and "editorial control" mean in practice, and the bar is more specific than "someone read it." Human review is "deliberate examination of the substance of the content by one or more natural persons possessing relevant knowledge," the kind of scrutiny academic peer review implies, not a skim. Editorial control means a responsible editorial entity has "authority to approve, alter or reject the substance of the text based on substantive grounds," including fact-checking and verifying the trustworthiness of sources, per the Commission's own FAQ on the transparency obligations. Editorial responsibility, the third leg, requires that a specific natural or legal person holds ultimate legal responsibility for the publication, including for the review that happened before it.
Read those three requirements together and the exemption is narrower than "we had someone look at it" but far short of requiring a compliance department. It requires a real check, someone qualified enough to run it, and a name attached to the decision to publish.
The Commission's guidance names the failure mode directly: "superficial, solely formal, or procedural checks (e.g. spell-checking or grammatical correction)" don't qualify. Three patterns fail in practice, and each maps to a real habit content teams fall into.
A rubber-stamped merge is the most common one: a pull request gets approved and merged without the reviewer reading the diff, because the team trusts the drafting process and treats the approval click as a formality. That's a procedural check, not a substantive one, and it's exactly what the guidance excludes.
A role instead of a name is the second failure. "Marketing reviewed it" or "the content team approved it" isn't editorial responsibility. The exemption requires a natural or legal person, meaning an actual accountable individual or entity, not an org-chart box.
A check with no record is the third, and it's the one that matters most if a regulator or a customer ever asks. Real review that leaves no trace is functionally indistinguishable, to anyone outside the room, from no review at all. What that record needs to capture, a named reviewer, a diff showing what changed, and a timestamped sign-off, is the difference between an exemption you can claim and one you can prove.
For a regulated-industry blog, Article 50 isn't the first compliance layer, it's an additional one stacked on rules that already govern the same content in the US. If your SaaS company sells into fintech or healthtech and any EU reader can see your blog, you're now running two overlapping compliance questions on every post: the US patchwork of FTC, FINRA, UDAAP, and state law, and the EU's public-interest disclosure test.
We've documented the US side in depth: the FTC's active AI-washing enforcement (13 cases since 2024, most of them against B2B marketing claims, not consumer ones), FINRA's pending Rule 2210 amendments treating AI drafts as ordinary regulated communications, the CFPB's UDAAP authority applying regardless of what tool produced a misleading claim, and California's AB 489 banning implied clinical authority in AI-generated healthtech content. The full breakdown is here if you haven't read it. Article 50 doesn't replace any of that. It sits on top of it for the subset of readers based in the EU.
Fintech and healthtech content is disproportionately likely to trip the "matters of public interest" test that triggers Article 50(4) in the first place. The Commission's guidance lists the categories explicitly: politics and democratic processes, public administration, fundamental rights, public security, public health, environmental protection, consumer safety, and "economic, financial, political, scientific or cultural developments" relevant to public debate, per the same FAQ. A post explaining how a lending algorithm assesses risk, or how a clinical AI tool supports a diagnosis, sits squarely inside that list. Ordinary product marketing generally doesn't: a pricing page or a feature announcement isn't political, financial, scientific, or public-safety content in the way that list defines those terms. The practical read: your pricing page and your feature announcements are probably fine. Your explainer on how your underwriting model works, or what your AI clinical-support tool actually does, is exactly the content this rule was written for.
That means a fintech or healthtech blog can't apply one review standard globally and call it done. A post that clears FTC and FINRA scrutiny in the US can still owe an EU disclosure if the review behind it wouldn't survive being described to a regulator, since the US rules and Article 50(4) are testing different things: US enforcement asks whether a claim is misleading, Article 50(4) asks whether a genuine human stood behind the content before it published. A post can pass the first test and fail the second. The reputational floor is already ahead of the legal one, too: in WordPress VIP's Future of the Web 2026 research, 85% of enterprise leaders already believe AI-generated content published without human review erodes brand trust, independent of any regulation. For a regulated-industry blog, the review bar the market already expects and the review bar Article 50(4) requires point at the same place.
Ranking risk is a separate question entirely, and it's worth naming so it doesn't get folded into this one: Google's own research shows no ranking penalty for AI-assisted content, full stop. Article 50 is a legal disclosure question. It has nothing to do with whether the post ranks.
The exemption is only worth as much as your ability to demonstrate it, which means the practical work here is building a review process that produces its own evidence as a byproduct, not one that requires a separate compliance write-up after the fact.
Four records make the difference between an exemption you can claim and one you can prove, and they map directly onto the Commission's three-part test above:
| Record | What it proves |
|---|---|
| A named author for the draft | Who wrote it and when |
| A named reviewer with relevant subject knowledge | The review was substantive, not procedural |
| A diff or changelog of what the reviewer altered | The review did something, not just approved on sight |
| A timestamped sign-off from a person or entity with editorial responsibility | Review happened before publication, and someone is accountable |
Miss any one of those and the exemption gets harder to defend. A published post with no visible edit history looks, from the outside, exactly like a draft nobody touched.
If your blog publishes through a Git-based pull request workflow instead of a CMS with no version history, three of those four rows already exist without extra tooling. Commit history names the author. The diff between the first commit and the merged version shows exactly what a reviewer changed, satisfying the "check did something" requirement. The merge event itself is a timestamped, named action, which is the closest thing to an automatic editorial sign-off a publishing pipeline produces on its own.
What a PR doesn't give you automatically is the substance check itself, someone with relevant knowledge actually reading the draft and verifying its claims, which is the fact-checking layer our editorial review process breakdown covers in detail. A PR gives you a place to attach that review and a permanent record that it happened. It doesn't run the review for you. That distinction is the whole gap between an audit trail that looks complete on GitHub and one that would actually hold up if a regulator asked to see it. Pairing the two automatically, a PR-based publish with a documented fact-check pass attached to every diff, is what Lyra is built to do by default; the plans page has the specifics if you want to see how it fits your own workflow.
A post either got a real review with a name attached, or it needs a label. Lyra opens every post as a pull request with fact-check notes attached to the diff, so the review, the reviewer, and the merge are on the record by default, not reconstructed after the fact.
FAQ
Only if two things are both true: the post informs the public on a matter of public interest as Article 50(4) defines it, and it did not undergo genuine human review with a named person holding editorial responsibility. Routine product marketing generally falls outside the public-interest test entirely. A post on compliance, health, finance, or safety is inside it, but a real review process exempts you from the disclosure duty regardless.
August 2, 2026. Article 50's transparency obligations, including the disclosure duty for AI-generated public-interest text, became mandatory on that date with no further grace period. A separate, narrower deferral to December 2, 2026 applies only to the machine-readable marking duty in Article 50(2), which sits with AI system providers, not to the disclosure duty in Article 50(4) that a blog actually has to worry about.
Yes, if EU readers see the output. The Act's territorial scope covers providers and deployers established outside the EU where the AI system's output is used in the EU. A US-headquartered SaaS company publishing a blog post that EU visitors read is inside that scope regardless of where the company is incorporated or where its servers sit.
The European Commission's guidance defines it as deliberate examination of the substance of the content by someone with relevant knowledge, paired with editorial control: the authority to approve, alter, or reject the content on substantive grounds, including fact-checking. The guidance is explicit that superficial, solely formal, or procedural checks, like a spell-check or a rubber-stamped merge, do not qualify.
Up to 15 million euros or 3% of a company's total worldwide annual turnover for the preceding financial year, whichever is higher. That sits in the middle of the Act's three-tier penalty structure: the top tier, for prohibited AI practices like social scoring or real-time biometric surveillance, reaches up to 35 million euros or 7% of turnover.
Built by the tool you're reading about
Lyra finds the topics worth ranking for, writes them in your repo's voice, fact-checks every claim, and opens a pull request scored and ready to merge. You review and hit merge. Want to see what she'd write for you? Start free with three posts, no card.
Keep reading
A concrete editorial review process for AI content: grounded sourcing, separated writer/checker roles, verified links, and a pre-publish check for E-E-A-T.
Does Google penalize AI content? Across 600k pages the correlation with rankings is 0.011. The real risk is scaled emptiness. 4 edits that de-risk your AI blog.
AI content fact-checking, explained. How to catch hallucinated stats and dead links before they ship, and how Lyra verifies every claim and link automatically.