TL;DR

Article 50 of the EU AI Act became applicable on 2 August 2026, and the Commission's own guidance confirms it reaches providers established outside the EU whenever their system's output is used inside it. India has had a labelling regime of its own since February. Most companies subject to both have read only one of them.

• The deep dive: why an Indian company with no EU entity is now inside Article 50 — and why "we already label our AI content" is usually an answer to the wrong statute.
• India desk: the SGI labelling and three-hour takedown regime that has been live since 20 February 2026, and the 13 November 2026 DPDP milestone now 88 days out.
• Global: the transitional carve-out that expires 2 December 2026, and the voluntary Code of Practice that buys a presumption of conformity.

THE DEEP DIVE — Article 50 applies to you even if you have never set foot in Europe

On 2 August 2026 the transparency obligations in Article 50 of the EU AI Act became applicable. That much has been widely reported. The part that matters for an Indian practice is a single sentence in the European Commission's own FAQ: "Providers of AI systems established or located outside the EU are also subject to the provisions of the AI Act if the output of their AI system is used in the EU."

No EU subsidiary. No EU establishment. No EU marketing. If the output lands in the Union, the obligation attaches.

Article 50 splits along a line worth holding onto, because clients routinely collapse it. Providers carry two duties: systems that interact directly with people must be built so the person knows they are dealing with a machine unless that is obvious to a reasonably well-informed person (Art 50(1)); and systems generating synthetic audio, image, video or text must mark their output in a machine-readable format, detectable as artificially generated or manipulated (Art 50(2)). Deployers carry two more: telling people they are subject to emotion-recognition or biometric-categorisation systems (Art 50(3)), and disclosing deepfakes and AI-generated text published to inform the public on matters of public interest (Art 50(4)). The information must be clear and distinguishable, given no later than the first interaction or exposure (Art 50(5)).

Now the trap. India has required labelling of synthetically generated information since the IT Amendment Rules came into force on 20 February 2026 — a prominent visible or audible label, plus embedded metadata identifying the resource that produced the content. A client who has done that work will tell you they are compliant. But India's obligation is aimed squarely at intermediaries and at content sitting on platforms. The EU's attaches to whoever builds the system and whoever uses it, wherever they are. An Indian AI product company is very often not an intermediary under the IT Rules at all — and is squarely a provider under the AI Act. The two regimes overlap in appearance and diverge in who they bind.

Exposure under Article 99(4) runs to €15 million or 3% of worldwide annual turnover, whichever is higher; for SMEs and start-ups Article 99(6) applies whichever is lower. Either way it is not a rounding error.

Running clock (verified for this issue): - DPDP Rules 2025 notified 13 November 2025. Consent-manager framework operational 13 November 2026. Full substantive compliance 13 May 2027. - EU AI Act Article 50 applicable 2 August 2026. Transitional relief for pre-existing systems expires 2 December 2026.

INDIA DESK

The SGI regime has been live since February, and it is not the same duty as the EU's. The 2026 amendments to the Intermediary Guidelines were notified on 10 February 2026 and came into force on 20 February 2026, creating a defined category of "synthetically generated information" — content created or altered algorithmically to appear real or indistinguishable from a real person or event. Non-prohibited SGI must be clearly and prominently labelled (visual label for visual content, audio disclosure for audio), intermediaries must embed permanent metadata or a unique identifier tracing the resource used to generate it, and certain categories of harmful synthetic content carry a three-hour takedown window. Source: MeitY — IT Rules · analysis: Freshfields · S.S. Rana & Co.

The 13 November 2026 DPDP milestone is 88 days away. Phase 2 of the DPDP framework brings the consent-manager regime into operation on 13 November 2026, twelve months from notification of the DPDP Rules 2025. Consent managers are entities registered with the Data Protection Board that act as a single point through which a data principal gives, manages, reviews and withdraws consent. Substantive compliance follows on 13 May 2027. The useful framing for a client this quarter is that the remainder of 2026 is build time, not grace time. Source: DPDP Rules 2025 notification, MeitY

GLOBAL — DATA PROTECTION & AI GOVERNANCE

The only Article 50 grace period is narrow, and it closes on 2 December 2026. The Commission's FAQ is specific: relief exists only for AI systems placed on the market before 2 August 2026, and only as regards the marking and detection obligation in Article 50(2). Providers of those systems must comply from 2 December 2026. Content generated before 2 August 2026 does not have to be labelled retroactively. Everything else in Article 50 has applied since 2 August, to in-scope systems, regardless of when they reached the market. Source: European Commission

A voluntary Code of Practice now carries a compliance benefit. The AI Office has published a Code of Practice on Transparency of AI-Generated Content, sitting alongside the Commission's guidelines on Article 50. It is voluntary, it standardises the icons used to mark AI-generated content, and adherence is treated as a way of demonstrating compliance. For a client weighing whether to adopt it, the argument is not virtue — it is that a documented, recognised marking method is easier to defend to a market-surveillance authority than a bespoke one. Source: European Commission — Code of Practice · Commission guidelines · Article 50 text

PRACTITIONER'S VERDICT

What to tell your clients this fortnight: ask one question before anything else — does the output of your AI system reach a user in the European Union? If the answer is yes, or is "we don't actually know", then Article 50 has applied to you since 2 August 2026 and no EU entity is required for it to bite. Then separate the two duties: machine-readable marking is a build task for whoever makes the system, and human-facing disclosure is an operational task for whoever deploys it. Finally, confirm which regime any existing labelling was built for. Compliance with India's SGI rules is not compliance with Article 50, and a client who has done the Indian work has done real work — for a different statute.

This publication is informational and educational only. It is not legal advice and creates no attorney-client relationship. Authored from India; readers in other jurisdictions should map terms to local law.

Found this useful? Forward it to one colleague who bills to data-protection or AI work. — wolfgang_rush · The India Data & AI Governance Desk