Limited-Risk AI Under the EU AI Act: Examples and What You Owe
Limited-risk AI means transparency duties under Article 50 — chatbots, synthetic content, deepfakes. Disclosure, not a heavy regime. Examples and dates.
Between minimal-risk AI (no obligations) and high-risk AI (the full stack) sits the limited-risk tier — systems that carry transparency duties under Article 50 of the EU AI Act, Regulation (EU) 2024/1689, but not the heavy regime. The duty is to tell people, not to run a conformity assessment. Here is what lands here, and what you owe.
What limited-risk means
A system is "limited-risk" when it is not prohibited and not high-risk, but it interacts with people or generates content in a way that could mislead — so the Act requires disclosure. The point is informed awareness: people should know when they are dealing with AI, or looking at AI-generated content.
The four Article 50 cases
1. AI you interact with (Article 50(1)). A chatbot or virtual agent must tell people they are interacting with an AI system, unless it is obvious. The duty is on the deployer.
2. Synthetic content (Article 50(2)). Providers of generative systems must mark synthetic image, audio, video and text in a machine-readable format.
3. Emotion recognition and biometric categorisation (Article 50(3)). Deployers must inform people exposed to an emotion-recognition or biometric-categorisation system that it is operating (where such use is itself lawful).
4. Deepfakes and public-interest text (Article 50(4)). Deployers must disclose deepfake content and AI-generated text published to inform the public on matters of public interest.
Examples that land here
- A customer-support chatbot → Article 50(1) disclosure.
- A marketing team's AI-generated images or video published externally → Article 50(2)/(4) marking and disclosure.
- A synthetic spokesperson or deepfake-style ad → Article 50(4) disclosure.
- A lawful emotion-analytics feature (outside the banned workplace/education context) → Article 50(3) notice.
The dates and the light touch
Most Article 50 duties apply from 2 August 2026; the content-marking and watermarking obligations from 2 December 2026. There is no technical documentation, conformity assessment, or registration for limited-risk systems — the burden is disclosure, designed into the product. Breaches sit in the Article 99(4) tier (up to €15 million or 3%), with the SME cap under 99(6).
Worked example: a retailer's AI stack
A retailer runs a support chatbot, AI-generated campaign images, and a lawful in-app style-recommendation feature. The chatbot carries the 50(1) "you're chatting with AI" label; the campaign images carry 50(2)/(4) marking and disclosure from 2 December 2026; the recommendation feature is minimal-risk with nothing to disclose. The whole limited-risk workload is three labels and a content-marking step — no high-risk programme.
How Confir helps
Confir identifies which of your systems are limited-risk, maps the specific Article 50 sub-duty to each (interaction, marking, emotion/biometric notice, deepfake disclosure) and the 2 December 2026 content-marking deadline, and separates them from minimal-risk systems that owe nothing. The engine is deterministic and rule-based.
Frequently asked questions
What is limited-risk AI under the EU AI Act?
It is the tier for AI that is neither prohibited nor high-risk but carries transparency duties under Article 50 — chatbots, synthetic content, deepfakes, and lawful emotion-recognition or biometric-categorisation systems. The obligation is disclosure, not a conformity assessment or registration.
What does Article 50 require?
Telling people they are interacting with an AI system (50(1)); marking synthetic content in machine-readable form (50(2)); informing people exposed to lawful emotion-recognition or biometric-categorisation systems (50(3)); and disclosing deepfakes and AI-generated public-interest text (50(4)).
What are examples of limited-risk AI?
Customer-support chatbots, externally published AI-generated images or video, synthetic spokespeople or deepfake-style ads, and lawful emotion-analytics features outside the banned workplace and education contexts. Each carries the relevant Article 50 disclosure.
When do the duties apply?
Most Article 50 transparency duties apply from 2 August 2026, and the content-marking and watermarking obligations from 2 December 2026. There is no high-risk stack for limited-risk systems — only the disclosure, designed into the product.
What is the penalty for a transparency breach?
Article 50 breaches fall in the Article 99(4) tier — up to €15 million or 3% of total worldwide annual turnover. SMEs and start-ups are capped at the lower of the percentage or fixed amount under Article 99(6).
Related guides
- Article 50 transparency obligations
- Minimal-risk AI
- Deepfake, defined
- How AI risk classification works
- How Article 6 classifies high-risk AI
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →