Content vs Mechanism: Why Article 50(1) Belongs in the Consent Layer

This article sets out a position we hold about product architecture. It is general information, not legal advice. Which Article 50 obligation applies to your organisation — and whether an exemption is available to you — depends on your specific AI system, how it is deployed, and regulatory guidance that is still developing. You should consult qualified legal counsel before relying on anything written here.

From 2 August 2026, Article 50 of the EU AI Act (Regulation (EU) 2024/1689) introduces a set of transparency obligations for AI systems that interact with people. As of July 2026, there is an open disagreement inside the consent tooling market about where these obligations belong in a website's stack. One position — a reasonable one, argued in good faith — is that AI transparency is a content problem, and therefore not the consent management layer's concern. We take a different view, and this page explains why. The short version: Article 50 is not one obligation, it is several, and they do not all have the same shape. Marking AI-generated content is a content-production problem. Disclosing that a visitor is talking to an AI system is a disclosure mechanism problem. Those are different engineering concerns with different natural homes, and conflating them is what makes the debate confusing. We think the second one belongs in the consent layer, and we have shipped it there.

Article 50 contains at least two different problems

The obligations bundled under Article 50 are not interchangeable, and the argument only makes sense once they are separated. Article 50(1) is an interaction disclosure duty: where an AI system is intended to interact directly with people, those people must be informed that they are interacting with an AI system, unless that fact is already obvious to a reasonably well-informed person. This is a duty that attaches to a moment — the moment of interaction — and it is discharged by showing a notice at that moment. Article 50(2) is something else entirely: it concerns marking AI-generated or manipulated synthetic content in a machine-readable format so that it can be detected as artificially generated. That duty attaches to an artefact — an image, an audio file, a block of text — and it is discharged at the point the artefact is produced, by the system that produced it. Article 50(4) adds further duties around deep fakes and AI-generated text published to inform the public on matters of public interest. These are distinct obligations with distinct triggers. A single sentence like “AI transparency belongs to the content team” can be true of one of them and false of another, which is precisely how two vendors can look at the same regulation and reach opposite conclusions.

The argument for keeping AI labelling out of the consent layer

One argument for keeping AI labelling out of the consent layer runs like this, and it deserves to be stated at its strongest rather than in caricature. AI-generated content is produced by the systems that generate it — a model endpoint, a content pipeline, a CMS plug-in, an editorial workflow. Only those systems know what was generated, when, by which model, and with how much human revision. A consent management platform sits at the edge of the page, loaded as a script tag; it has no visibility into provenance. If a CMP tried to label AI-generated content, it would be guessing, and a guess embedded in a compliance artefact is worse than no artefact at all. Worse still, the machine-readable marking contemplated by Article 50(2) is meant to travel with the content — surviving download, re-hosting, and syndication — which a page-level script fundamentally cannot deliver. Provenance metadata belongs in the file, written by the producer. On this reading, a CMP that claims to solve AI transparency is overreaching into a problem it is structurally unable to see. We think this argument is correct. We just think it is an argument about Article 50(2), and that it does not carry over to Article 50(1).

Interaction disclosure is a mechanism problem, not a content problem

Article 50(1) asks a different question. It does not ask what a piece of content is; it asks whether a person was told something, at the right moment, before they engaged. There is no provenance to trace and no artefact to mark. The obligation is discharged by presenting a notice to a visitor at a specific point in a session, in a language they can read, in a way that does not depend on the visitor going looking for it. That is a disclosure mechanism, and disclosure mechanisms are what a consent layer is. Consider what serving a 50(1) notice actually requires in engineering terms: detecting a visitor's first relevant interaction on a page; deciding whether this visitor has already been shown the notice in this session or a prior one; rendering a notice in the visitor's language; targeting only the paths where the AI system is present rather than the whole site; applying different behaviour inside and outside the EU; and recording that the notice was shown, with enough fidelity that the record is worth something later. Every one of those capabilities already exists in a consent management platform, because the same list describes serving a cookie banner. Session-scoped state, per-visitor suppression, localisation, path targeting, geographic rules, and an evidence log are not features you would build for AI disclosure specifically — they are the standing furniture of the consent layer. Building a second, parallel system to do the same six things, on the same page, loaded by a second script, is duplication rather than separation of concerns.

The consent layer is already the disclosure surface

There is a second reason beyond engineering economy, and it matters more. The consent layer is the surface that already greets the visitor before anything else happens. It is where a site makes its disclosures, and it is where a visitor has learned to look for them. Splitting the disclosure surface in two — a consent notice from one system, an AI notice from another, each with its own timing logic, its own storage, its own copy, and its own record — produces a worse experience for the visitor and a weaker evidence position for the operator. When a question is asked eighteen months later about what a particular visitor was shown, the answer should come from one log rather than being reconstructed from two systems that were never designed to agree with each other. This is the concern that keeps the disclosure in the consent layer even for teams who could, in principle, build it themselves elsewhere. Coherence of the disclosure surface is not a nice-to-have; it is the thing that makes the disclosure legible to the person receiving it, which is what the transparency obligation is ultimately about.

See how Article 50(1) works in practice.

What we shipped, and what the record contains

We have shipped Article 50(1) interaction disclosure as part of the consent SDK rather than as a separate product. When a visitor first engages with an AI system on a path you have designated, the same script that manages consent serves the disclosure notice, in one of two presentation modes: a passive notice, or an acknowledge mode that asks the visitor to dismiss it before continuing. The notice is authored by you, localised per language, and targeted to specific paths rather than the entire site, because most sites run an AI assistant on a handful of routes rather than everywhere. Each time the notice is rendered, an impression is recorded against the gate and the domain with a timestamp, and that log is exportable per domain. That export is the point of the exercise: a disclosure you cannot evidence is a disclosure you will struggle to rely on. There is no second SDK to install and no additional script tag — if the consent SDK is already on the page, the disclosure gate is a configuration change rather than an integration.

Full setup details are in the AI Disclosure Gate documentation.

What this does not cover, stated plainly

Our position is about Article 50(1), and it should not be read as a claim about the rest of Article 50. We do not implement the machine-readable marking of synthetic content contemplated by Article 50(2), and we do not implement the deep fake and public-interest text duties in Article 50(4). We are not planning to, because the argument above applies to us as much as to anyone: those obligations attach to artefacts at the point of production, and a page-level script is the wrong place to discharge them. As of July 2026, the precise timeline and scope of the content-marking obligations remain subject to ongoing EU legislative discussion, which is a further reason to treat them as a separate track rather than folding them into a consent roadmap. We also do not determine whether an exemption applies to your AI system. Article 50(1) does not require disclosure where the interaction is already obvious to a reasonably well-informed person, but whether your deployment meets that threshold is a legal judgement about your facts, and it is not a call a script tag can make for you. Nuvo Consent is a technical tool that renders a notice and records that it was shown. Using it supports your Article 50(1) disclosure workflow; it does not provide legal advice, and it does not by itself make your organisation compliant with the EU AI Act.

Content and mechanism, kept apart

The disagreement in this market is narrower than it appears, and most of it dissolves once the obligations are separated. Marking AI-generated content is a content-production concern, and vendors who say a consent platform has no business there are right. Disclosing that a person is speaking to an AI system is a disclosure mechanism concern, and the consent layer is already the mechanism that a site uses to make disclosures at the right moment, to the right visitor, with a record attached. Treating those two as a single undifferentiated “AI transparency” problem is what leads to the conclusion that the whole of Article 50 sits outside the consent layer. We think half of it sits squarely inside, and we have built accordingly. If you want the regulation itself rather than the argument about it — the dates, the paragraph-by-paragraph breakdown, the penalties, and an honest account of where our coverage stops — that lives on our EU AI Act Article 50 page.