AI transparency needs an operating workflow, not a footer disclaimer

Final transparency guidance and a new regulation changed the deadline map

The European Commission published final guidelines on the scope of Article 50 transparency obligations on July 20, 2026. Regulation (EU) 2026/1744 then entered into force on July 27. Together they create a deadline map that HR teams must read by duty, role, and system history rather than as one postponement.

The regulation adds a specific transition for providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video, or text and were placed on the market before August 2, 2026. Those providers must take the necessary steps to comply with Article 50(2) by December 2, 2026. The text does not turn December 2 into a general Article 50 date. Candidate-facing interaction notices, deployer disclosures, privacy duties, employment protections, and other applicable rules need their own analysis.

Article 50 addresses several different transparency situations. Providers of systems intended to interact directly with people must design them so people are informed they are interacting with AI unless that is obvious to a reasonably informed, observant person in the circumstances. Providers of systems that generate synthetic audio, image, video, or text must support machine-readable marking and detection, subject to the regulation's conditions.

Deployers have different duties. The Commission summarizes these as informing people when they are exposed to emotion recognition or biometric categorisation, deepfakes, and certain AI-generated or manipulated text published to inform the public on matters of public interest without human review or editorial responsibility. These categories should not be collapsed into "label everything AI touched."

For HR, the useful response is a feature-level inventory. One talent platform may contain scheduling, candidate chat, interview transcription, video analysis, ranking, outreach drafting, and public careers content. Each feature has a different audience, data flow, legal role, and notice moment. Approving the vendor brand or adding one privacy-policy sentence does not answer those questions.

Do not confuse Article 50 with the high-risk employment-system timeline

Regulation (EU) 2026/1744 separates several dates. Most Article 50 transparency obligations continue to point to August 2, 2026. The regulation gives eligible pre-existing generative systems until December 2, 2026 for Article 50(2) marking. Chapter III high-risk requirements apply from December 2, 2027 for Annex III systems, including relevant employment uses, and from August 2, 2028 for Annex I product-related high-risk systems.

This distinction prevents two errors. The first is postponing every HR AI action until 2027, even when a 2026 transparency duty or an existing privacy, employment, accessibility, worker-consultation, discrimination, or local notice obligation applies. The second is claiming that a chatbot disclosure makes a high-risk recruiting system compliant. A transparency notice does not validate a ranking method, cure discriminatory impact, establish lawful processing, or replace meaningful human oversight.

The dates are current facts, not permanent assumptions. Assign an owner to monitor Commission guidance, Regulation 2026/1744, national enforcement materials, and changes to the deployed system. Record the legal source, access date, system first-market evidence, and any significant design change in the evidence register.

Map the provider and deployer before drafting the notice

HR teams often call the software vendor "the provider" and the employer "the customer." Legal roles can be more complicated. An organisation that develops, substantially modifies, rebrands, or places a system on the market may carry provider responsibilities. An organisation using a system under its authority may be a deployer. Integrations and feature customisation can change the analysis. Qualified counsel should decide the role; the operational team should supply accurate facts.

The table is a screening device, not legal advice. "AI-generated" is not enough to determine the row, and being outside Article 50 does not make a use low risk. Candidate ranking may create serious employment consequences even though it is not a deepfake or public-interest publication. Keep the recruiting pilot evidence gate and resume-screening controls active as separate workstreams.

Inventory the touchpoint, not just the contract

Start from the person's journey. Walk the careers site, application, scheduling flow, assessment, interview, offer, onboarding, employee portal, performance process, learning platform, communications channels, and HR service desk. Record where AI interacts, generates, transforms, infers, ranks, or labels.

Split products into enabled features. A vendor questionnaire that says "generative AI is used" is not enough. Record the model or service, version, configuration, input categories, output type, audience, purpose, decision influence, human reviewer, disclosure mechanism, logging, retention, and change-notice commitment.

touchpoint_id: HR-AI-017
system: "Candidate support assistant"
version: "vendor release 2026.07"
feature: "application-status chat"
audience: "external candidates in EU"
interaction: "direct text conversation"
organisation_role: "deployer; provider role unresolved"
data: ["candidate ID", "application stage", "message text"]
decision_effect: "none permitted"
notice:
  location: "before first message"
  text_owner: "HR + legal"
  tested: "pending"
vendor_evidence:
  provider_notice_design: "received"
  machine_marking: "not applicable or unresolved"
change_control:
  owner: "HRIS"
  recheck_on: ["feature enablement", "model change", "UI change"]

Capture screenshots or recordings from the real user path, including mobile layout, language variants, keyboard navigation, screen-reader output, error states, and embedded flows. Administrative-console screenshots are not proof of what the affected person saw.

Ask the vendor for feature-level evidence

Put the disclosure where the person can use it

A disclosure is useful when it reaches the right person before or at the relevant interaction, names the AI role accurately, remains visible enough to understand, and provides a route to human help where appropriate. A broad privacy notice linked from the footer may fail operationally even if it contains the words "artificial intelligence."

Draft from facts. For a candidate-support bot, a plain-language starting point might say that the person is chatting with an AI system, describe the limited purpose, identify what the system cannot decide, and provide a human contact. Whether that wording satisfies the law depends on the context and qualified review. Do not promise that the system cannot affect hiring unless the workflow and logs prove it.

Human review must be substantive if the workflow relies on it. An editor needs access to source material, authority to change or reject the output, sufficient time, and accountability for publication. A click on "approve all" after automatic distribution is not a meaningful editorial process.

Build an evidence register that survives product change

For each touchpoint, retain the system and feature, organisation role, possible trigger, legal owner, notice or label, interface location, affected audience, language, accessibility result, test date, product version, screenshot or artifact, issue, remediation, and next review date. Link the vendor evidence rather than copying a claim without provenance.

Use four operational statuses: READY FOR QUALIFIED REVIEW, NEEDS EVIDENCE, NEEDS REDESIGN, and STOP USE. Avoid a green "compliant" status produced by the project team or an AI assistant. Compliance is a qualified determination across facts and law, not a workflow output.

Teach the specific risk to the person operating the system

The European AI Office's AI literacy Q&A says organisations should consider their role, the risk of the system, staff knowledge, the use context, and the people affected. It also says simply relying on instructions may be ineffective or insufficient. That supports role-based training rather than one annual slide deck.

A recruiter using a candidate chatbot needs to know the notice and escalation path, prohibited decision uses, data restrictions, and how to report a mismatch. A communications editor needs to understand synthetic-media labels, public-interest publication, source verification, and editorial responsibility. HRIS administrators need versioning, configuration, logging, vendor changes, and evidence retention. Procurement needs contract commitments and audit rights. Hiring managers need to recognize when a convenience feature is becoming decision support.

Monitor the legislative status of AI literacy requirements because the AI Omnibus changed the broader implementation context. Regardless of the final legal allocation, role-specific operating knowledge remains a necessary control when people use AI on candidates or employees.

A 30-day implementation sequence

Days 1-5: freeze scope and owners

Name an executive sponsor, HR process owner, privacy lead, legal reviewer, security owner, accessibility reviewer, communications owner, and procurement owner. Freeze new candidate- or employee-facing AI features until the inventory is complete. Export the current vendor and application list, then ask process owners to disclose pilots and embedded features that may not appear in procurement records.

Days 6-12: map touchpoints and roles

Walk the real user journeys and split products into features. Record audiences, locations, inputs, outputs, decisions, notices, synthetic content, inference, and human review. Obtain a qualified provider/deployer determination and identify unresolved cases.

Days 13-18: test notices and labels

Use desktop and mobile, major languages, assistive technology, and failure states. Export synthetic content through the real publishing chain and verify whether markings and visible labels survive. Test human escalation. Record every result against the version.

Days 19-24: remediate and train

Rewrite vague notices, move them to the interaction, disable unsupported features, add an accessible escalation route, and contract for missing evidence. Train each operator on the specific system, affected people, controls, and stop rules.

Days 25-30: approve conditionally and monitor

Qualified reviewers decide per touchpoint. Attach any approval to the feature, configuration, audience, version, notice, owner, and re-test trigger. Add the evidence register to change management so a vendor release or feature toggle reopens review.

Failure modes that make transparency cosmetic

The last30days professional scan reinforces the need for real operating controls. In an r/humanresources discussion, a highly upvoted comment described how a dashboard promising time-to-fill reduction can overpower candidate-experience concerns. An r/projectmanagement discussion made the complementary point: agents can help with status rollups but struggle when the work depends on judgment and prioritisation. These comments are not legal evidence. They are useful reminders that interface convenience and executive enthusiasm can outpace governance.

FAQ

When do Article 50 transparency obligations apply?

The European Commission states that the Article 50 transparency obligations apply from August 2, 2026. The exact duty depends on the system, content, role, and use context.

Are high-risk employment-system rules also due in August 2026?

No. The Commission's current timeline says rules for systems in high-risk areas including employment apply from December 2, 2027. Article 50 transparency follows a separate August 2026 timeline.

What changes on December 2, 2026?

Regulation (EU) 2026/1744 gives providers of qualifying synthetic-content-generating systems placed on the market before August 2, 2026 until December 2, 2026 to take the necessary steps to comply with Article 50(2). Qualified reviewers should confirm the exact provider, system history, duty, and evidence. It is not a blanket delay for all transparency obligations.

Does every AI-assisted HR document need a label?

No. Article 50 has defined categories and role-specific duties. Assess direct AI interaction, machine-readable marking, emotion recognition or biometric categorisation, deepfakes, and certain public-interest text. Other HR risks and laws can still apply when Article 50 does not.

Is the vendor's notice enough?

Not automatically. Confirm the role allocation, system configuration, audience, timing, accessibility, version, and evidence. Test the real interface and obtain qualified review.

Can HR rely on a human-in-the-loop statement?

Only if the person has relevant skills, source access, time, authority to disagree, and accountability. Human review is a control design that must be tested, not a phrase that makes the workflow safe.