Article 50 guidelines formally adopted: which reference to use in policy, DPIA and contracts

Picture this: you are the privacy officer at a Dutch municipality. The policy for the chatbot on the municipal website, the DPIA and the contract with the supplier all carry the same footnote: the Commission guidelines on Article 50, C(2026) 5054 final, of 20 July 2026, in English. Since 5 November 2026 there is a new document number and an official Dutch text. Do you have to rewrite everything?

No. But it pays to know what did and did not change, because the new text is the one you refer to from now on.

What happened on 5 November

The document of 20 July 2026 was, according to its own title page, an annex to a Communication to the Commission approving the content of the draft Communication. On 5 November 2026 the formal step followed: a Communication from the Commission, reference C(2026) 7702 final, dated "Brussels, 5.11.2026". Its English title reads: Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of Regulation (EU) 2024/1689 (the 'AI Act').

On 11 November 2026 the Commission publication page offered 23 language versions, including the English and the Dutch text. The page itself gives 5 November 2026 as its last update. The document carries no Official Journal reference, so cite it by document number and date.

What did not change

We compared the English text of 20 July and that of 5 November sentence by sentence. Both run from point (1) to point (155), with the same numbering. The differences are editorial. Point (24) now says "point 27" where it said "paragraph 27". In point (143), on when the information has to be given, the cross-reference now names points 36 and 40, where it carried no number before. The rest concerns a bracket, punctuation and a hyphenation.

That means three things. What we described earlier in what changed on 2 August 2026 still stands. The explanation per paragraph and per role under Article 50 AI Act still applies. And a reference in your documents to, say, "guidelines, point 49" points to the same passage in the adopted text.

The status is the same too. Point (5) states that the guidelines are non-binding and that any authoritative interpretation of the AI Act may ultimately only be given by the Court of Justice. So the guidelines are not law. They are, however, how the Commission reads Article 50, and therefore a weighty reference point for your reasoning.

Which reference to use now

Our advice is to name the adopted document in new documents, with the point number:

Communication from the Commission, Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of Regulation (EU) 2024/1689 (the 'AI Act'), C(2026) 7702 final, 5 November 2026, point 49.

Existing documents do not need urgent changes. A reference to a point of C(2026) 5054 final is not wrong, just no longer the latest edition. Replace it at the next review. If you want to show the link between the two, one sentence will do: "content approved on 20 July 2026 as C(2026) 5054 final".

For Dutch organisations the main gain of the Dutch text is in the wording. You can now use the terms the Commission itself uses in Dutch, such as aanbieder (provider) and gebruiksverantwoordelijke (deployer), instead of your own translation. That saves discussion with a board member, a supplier or a court about what was meant.

The municipality: five places where the reference lands

The AI policy and the register. Point (31) lists chatbots and voice assistants in contexts such as public service as examples of systems under Article 50(1). Who carries the duty depends on the role. Under point (11), a public authority that develops a chatbot in house and puts it into service under its own name is itself the provider. If the municipality buys a chatbot that a supplier offers under its own name, the supplier is the provider and the municipality is the deployer (points 10 and 12). Record that role per system, with the point number.

The reporting channel. An exception for law enforcement does not apply to a system that is available to the public and lets people report criminal offences (point 49). As an example, the Commission names AI-assisted hotlines or portals for reporting fraud, run by financial institutions or public authorities. If your municipality runs such a channel with AI in it, the person reporting must be informed that they are interacting with an AI system.

The DPIA. Two points are useful here. Point (52) states that the information duty of Article 50(1) serves a different objective from the information duties under data protection law and does not affect them. The notice "you are chatting with AI" therefore does not replace the privacy notice under Article 13 GDPR. And point (25) states that complying with Article 50 does not mean that the use of the system is lawful. A DPIA that only ticks off transparency is not finished.

The communications team. Point (131) gives, as an example of text that must be labelled, an AI-generated summary on a newspaper's website of an article about a recent decision by a town council. The label may be left out if the text has undergone human review or editorial control and someone holds editorial responsibility. That person or function must then be easy to find, for instance in the legal information on the website or in a colophon (point 138). If your municipality uses AI for news items, assess yourself whether the text informs the public on a matter of public interest. More on this in our explainer on labelling AI text on matters of public interest.

The contract. Our advice: name C(2026) 7702 final in new procurement terms, and set out which duties the supplier carries as provider, such as the notice for a chatbot (paragraph 1) and the machine-readable marking of generated content (paragraph 2). Reopening a running contract only for the new document number is not necessary, because the content stayed the same.

Bank and education, briefly

For a bank the same line applies. Point (31) lists chatbots in the context of finance, and the fraud reporting channel in point (49) is a banking example. In addition, point (50) states that consumer law continues to apply alongside Article 50: for an AI-driven service the AI functionality may be an essential characteristic that has to be disclosed before the consumer is bound by a contract, even where the interaction is "obvious" within the meaning of Article 50(1).

For an educational institution, point (31) lists chatbots in education. Point (25) recalls that a system covered by Article 50 may still be prohibited, with emotion recognition in the workplace or in educational institutions as the example. A transparency notice does not make such a system permissible. The same point states that the AI literacy requirements of Article 4 also apply to providers and deployers of systems under Article 50.

What remains open

• Interpretation by the Court. The guidelines are non-binding. The final word lies with the Court of Justice (point 5).
• Review. Point (155) calls the guidelines a first interpretation. The Commission may review them and, in doing so, withdraw or amend them, partly in light of enforcement experience. Always give the document number and date, so it is clear which edition you used.
• The transition period for paragraph 2. For systems already on the market before 2 August 2026, the period for machine-readable marking runs until 2 December 2026. After that this duty applies in full as well.
• What the guidelines do not decide. Whether your own chatbot, reporting channel or news item falls under Article 50 depends on the system and your role. The guidelines give examples, not a verdict on your case.

To check which duties under the AI Act and the GDPR apply to a concrete use, use the free case check. For Article 50 alone there is also the Article 50 decision tree.