What 2 December 2026 still requires of insurer GenAI
On 10 November 2026 there are three weeks left before 2 December. In insurer GenAI programmes that date has been treated as the start of the EU transparency rules for customer communications: the chatbot, the drafted claim note, the synthetic voice, the campaign image. I lead data and AI work in a large insurer's GCC, and the texts say something narrower. 2 December is the end of a short transition for one provider duty.
Read this as a steering brief. Counsel still owns the legal conclusion. The sources are Regulation (EU) 2024/1689 (the AI Act), Regulation (EU) 2026/1744 (the Digital Omnibus on AI), the Commission FAQ on Article 50, the Code of Practice on transparency of AI-generated content and the Commission guidelines on those obligations.
What does 2 December 2026 actually change?
Article 113 sets general application at 2 August 2026, and Article 50 is on that date. The guidelines page agrees.
The Omnibus, adopted on 8 July 2026, inserts Article 111(4). Providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text and were placed on the market before 2 August 2026 must comply with Article 50(2) by 2 December 2026. Recital 38 calls this a four-month transition. The FAQ states the same limit: only systems placed on the market before 2 August, and only the marking and detection duty.
Article 50(2) requires a machine-readable mark so the output is detectable as artificially generated or manipulated. The solution must be effective, interoperable, robust and reliable as far as technically feasible, given the content, the cost and the state of the art. The paragraph names no watermark product. Since 2 August, Article 50(1) has required providers of direct-interaction systems to design in a notice that the person is dealing with AI, unless that is obvious. Article 50(3) has required deployers to inform people exposed to emotion recognition or biometric categorisation. Article 50(4) has required deployers to disclose deep fakes and certain published text.
Article 3(9) defines placing on the market as the first making available on the Union market, so a system placed on or after 2 August had to meet Article 50(2) from placement. The FAQ says content generated before 2 August need not be labelled after the fact, and it encourages labelling older content where possible. That encouragement is guidance.
Article 111(4) uses "placed on the market". Putting into service, in Article 3(11), is supply for first use to the deployer or for own use in the Union. An insurer running a generative system it had built, never placed on the Union market, should take Article 111(4) and Article 3(11) to counsel before treating 2 December as its marking date. The FAQ draws the grace at placing on the market as well.
Keep the neighbouring dates separate. From 2 December 2026 the Omnibus also applies further Article 5 prohibitions on systems that generate non-consensual intimate material and on systems that generate child sexual abuse material. High-risk rules in Chapter III, Sections 1, 2 and 3 apply from 2 December 2027 for Annex III systems, including life and health risk assessment and pricing for natural persons, and from 2 August 2028 for Annex I systems. Article 2 covers providers placing or putting a system into service in the Union, deployers in the Union, and third-country providers and deployers whose output is used in the Union.
Who is the provider when the insurer sends the message?
Under Article 3(3), the provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark, paid or free. Under Article 3(4), the deployer uses a system under its authority, outside personal use. An insurer can be the provider of a system it had built, the deployer of a vendor system, and both on a tool it commissioned and operates.
On a vendor chatbot placed on the market by the vendor, Article 50(1) and Article 50(2) sit with that provider. The insurer's lever is the contract, the acceptance test and a written date. The insurer's own name on a system it had developed makes the insurer the provider. The FAQ treats staff, and contractors working under the company's control, as part of that deployer, not as separate ones.
The FAQ's answer on providers attributes the interaction notice to Article 50(2). The regulation, and a later answer on the same page, put that notice in Article 50(1). Article 50(2) is the mark. Follow the regulation.
Does a machine-readable mark replace a label a person can perceive?
The mark in Article 50(2) is for detection. A customer still needs a sentence or a voice they can perceive. The same paragraph exempts a system to the extent it only assists standard editing, or leaves the input and its semantics substantially unchanged. The FAQ, explaining the guidelines, also puts source code, short strings and machine-only output outside the duty, and describes a narrow exemption for some business-to-business or industrial outputs. Check those conditions before relying on them for a customer letter, a claim message or a campaign.
Article 50(4) gives the deployer a separate job. Article 3(60) defines a deep fake as AI-generated or manipulated image, audio or video that resembles existing persons, objects, places, entities or events and would falsely appear authentic or truthful. The deployer must disclose the artificial origin. The FAQ requires that disclosure at the latest on first exposure, in a form a person can perceive without a tool, and says the provider's mark does not discharge it. An artistic, satirical or fictional work has a lighter disclosure, which still has to exist. Routine insurance marketing rarely qualifies.
The other limb of Article 50(4) is text published to inform the public on matters of public interest. The FAQ's examples include politics, public administration, public health, consumer safety, and economic or financial developments that may be publicly debated. Human review or editorial control, plus a person with editorial responsibility, removes the duty. The reviewer needs relevant knowledge and the power to approve, alter or reject the substance. A spell-check fails that test.
A renewal letter, a claim update or a one-to-one chatbot reply is addressed to that customer, so record why it sits outside the publication limb. Labelling it is a customer-policy choice. Where the words can change cover or a payment, keep a person who owns the substance, the same control as in the pilot-to-production checklist. Article 50(5) requires every notice under paragraphs 1 to 4 to be clear and distinguishable at the first interaction or exposure, and to meet accessibility rules.
The Code of Practice is voluntary. The Commission page dates the final text to the closing plenary on 10 June 2026: marking and detection for providers, labelling of deep fakes and certain text for deployers. The Commission and the AI Board have called it adequate for demonstrating compliance with Article 50(2), (4) and (5). Recital 41 of the Omnibus says the codes grant no presumption of conformity. The FAQ says signatories rely on an assessed method, and that others may receive more information requests. Icons are optional. About 190 companies and organisations had signed by the end of July 2026. Still ask each provider for the technique, the standard-editing position and the Article 50(2) date.
What should be on one page before 2 December?
Hand this inventory to one owner.
- Name every generative system whose text, audio, image or video can reach a person in the Union. Record placed-on-the-market or put-into-service, the date, and whether the insurer is provider, deployer, or both.
- Tag the duty: Article 50(1) direct interaction, Article 50(2) machine-readable mark, Article 50(4) deep fake a person can perceive, Article 50(4) public-interest text. Leave Annex III life-and-health pricing and risk assessment on the 2 December 2027 clock.
- If the system was placed on the market before 2 August 2026, Article 111(4) leaves Article 50(2) until 2 December. If it was placed later, that duty was already due. If it was only put into service for own use, leave the December box blank until counsel has compared Article 111(4) with Article 3(11).
- For chatbots, voice agents and avatars, test a clear, distinguishable, accessible notice at the first interaction, unless the interaction is obvious to a reasonably well-informed person. The FAQ treats that exception as narrow. A hidden mark is not the notice.
- For synthetic voice, video or images that resemble a real person, object, place or event and could pass as authentic, add a disclosure a person can perceive on first exposure.
- For public text, decide if it informs the public on a matter of public interest. If it does, disclose the artificial origin or show substantive review and a named editorial owner.
- For one-to-one policy, claims and servicing text, record why the publication limb does not apply, and keep a human owner where the words affect cover or payment, as in the pilot-to-production checklist.
- Get each vendor's technique, standard-editing position and 2 December commitment in writing, and file it on the row.
- Choose the Code of Practice or another method you can show is adequate, then test your own outputs. The code does not replace the Act.
- Keep this file separate from the high-risk programme.
The people who run the system should keep this inventory beside it, which is the operating habit in a GCC that leads on data and AI.
Who enforces Article 50, and what can a fine reach?
Article 99(4)(g) places Article 50 in the band of administrative fines up to EUR 15 million or, for an undertaking, 3% of worldwide annual turnover for the preceding year, whichever is higher. Article 99(6) caps SME fines, including start-ups, at the lower of the two. Article 99(6a), added by the Omnibus, does the same for small mid-caps on the fines in paragraphs 4 and 5. Article 99(7) requires the individual case to be weighed, and Member States write the penalty rules.
The FAQ gives day-to-day Article 50 enforcement to national market surveillance authorities, with a limited AI Office role, including where one provider supplies both the system and the general-purpose model. The European Data Protection Supervisor covers EU institutions. Article 74(6) names the financial supervisor as market-surveillance authority for high-risk systems that regulated financial institutions place, put into service or use in direct connection with the financial service. Communications outside that high-risk lane depend on the authority the Member State has designated.
If you are drawing the same provider and deployer line on GenAI communications, write to me at contactme@mukherjeesuman.com.
Views are my own and do not represent any employer.
How this post was made: drafted with AI assistance from public sources and checked against the primary sources linked above.
If this was useful, connect with me on LinkedIn, email contactme@mukherjeesuman.com, or read more articles.