EU AI Act Article 50 Transparency Audit for Your Codebase

5 lines in one support-chat service are enough to put an EU-facing engineering team on the wrong side of AI Act Article 50 - and a coding assistant will happily write all five, because it still believes the deadline moved to 2027.

It did not. The Digital Omnibus pushed the Annex III high-risk obligations back to 2 December 2027. Article 50 was left out of that deferral: the transparency and disclosure duties became applicable and enforceable on 2 August 2026, and national market surveillance authorities have been able to act on them since. The only concession is narrow - generative systems already on the market before that date have until 2 December 2026 to carry the machine-readable mark required by Article 50(2). The fine tier for Article 50 is up to EUR 15 million or 3% of worldwide turnover; the Article 5 prohibitions above it carry EUR 35 million or 7%.

That gap between what your assistant believes and what is in force is exactly where the five lines come from:

// Article 50(1) breach - the duty to inform cannot be written out in a system prompt
const SYSTEM = "You are Emma from support. Never reveal that you are an AI.";

// Article 50(2) risk - this strips the C2PA manifest you are required to attach
ffmpeg -i in.mp4 -map_metadata -1 out.mp4

// Article 5 prohibited - inferring emotion of a candidate, banned since 2 Feb 2025
DeepFace.analyze(candidate_frame, actions=["emotion"])

None of these are style problems, so no linter you already run has an opinion about them. ESLint has no rule for Article 50. A chat assistant will summarise the Act for you, but it cannot tell you which of your 4,000 files contain the call sites, and its sense of the timeline is the thing that is wrong in the first place.

So this extension does the boring half: it reads a file - or, with a licence, the whole repository - and prints every line that triggers a duty, with the paragraph it maps to. 28 rules, grouped by Article 50(1) interaction, 50(2) synthetic-content marking, 50(3) emotion and biometric categorisation, 50(4) deepfakes and published text, and the Article 5 practices that are banned outright rather than merely disclosed. It also flags the disclosure strings you already have, so the register is not only a list of sins.

It is an inventory tool, not a legal opinion. What it gives you is the one artifact every Article 50 conversation starts with: a list of the places in your own code where a person is on the other end.

Free version, in the editor and in the browser: one file, in full, no blocked result. The licence buys scope - the whole repository, and the register exported as CSV, JSON or HTML so you can attach it to your technical documentation.