◉Signal & Seam
Analysis

The worker is now on the AI Act's deployment notice record

Abstract editorial cover art for The worker is now on the AI Act's deployment notice record
2026-09-18source quality: highaieu-ai-actarticle-50article-26deployerworkeremployerbiometricemotion-recognitiondeepfakeitalian-garanteitalydigital-omnibuscode-of-practicecode-practice-transparencycommission-guidelineshigh-riskfrench-cnilworkplace-aitransparencylabor

On 2 August 2026, Article 50 of the EU AI Act began applying directly. The two deployer-side transparency obligations — biometric and emotion-recognition disclosure under Article 50(3) and deepfake / public-interest text labeling under Article 50(4) — put the European worker on the deployment notice record today, in front of any high-risk classification. Article 26(7)'s explicit duty to inform workers' representatives and affected workers is deferred to 2 December 2027 by the Digital Omnibus, but the Italian Garante's enforcement record and the Italian Decreti AI Act's 'licenziamenti automatici nulli' rule are running the obligation in member-state law now. The Commission also published guidelines on 20 July 2026 (C(2026) 5054 final) and a Code of Practice with roughly 190 signatories. The affected party is the worker being monitored by AI; the institution that has to live with the obligation is the employer. The 12-month test is whether any national market surveillance authority has, by September 2027, brought an Article 50(3) enforcement action against an employer for failing to inform exposed workers of an emotion-recognition or biometric system.

Before 2 August 2026, the European worker's relationship to an AI system in the workplace was a privacy-and-labor-council question. After that date, it is a notice-record question. The change is in the document, not in the technology.

On 2 August 2026, Article 50 of the EU AI Act became directly applicable. The two deployer-side transparency obligations in Article 50 — biometric and emotion-recognition disclosure under Article 50(3), and deepfake / public-interest-text labeling under Article 50(4) — bind employers immediately, in front of any question about whether a system is high-risk. Article 26(7)'s explicit duty to inform workers' representatives and the affected workers of high-risk AI in the workplace is part of the high-risk regime the Digital Omnibus pushed to 2 December 2027, but the Italian Garante's enforcement record and the Italian Decreti AI Act's "licenziamenti automatici nulli" rule are running the same obligation under member-state law now.

The Article 50 transparency regime is narrower than the high-risk regime. It is also older than the high-risk obligations, in the sense that it does not wait for Annex III classification: it attaches at the moment a worker is exposed to an emotion-recognition or biometric system, and at the moment a deepfake is published. The Commission's finalised Guidelines on Article 50, published on 20 July 2026 as Commission Communication C(2026) 5054 final, narrowed several of the open interpretive questions but did not narrow the underlying duty. What was a draft policy in 2025 is now an obligation that the AI Office, the European Data Protection Supervisor, and national market surveillance authorities can enforce on their own initiative or following a complaint. Non-compliance with Article 50 carries an administrative fine of up to €15 million or 3% of total worldwide annual turnover, whichever is higher.

What Article 50(3) actually requires

The most consequential deployer-side duty in the live Article 50 is Article 50(3). It requires that "deployers of emotion recognition systems or biometric categorisation systems shall inform the natural persons exposed thereto of the operation of the AI system, and process their personal data in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680." The clause is short. The work it imposes on the European employer is not.

The article does not prescribe a method. The Commission's 20 July 2026 Guidelines specify that disclosures must be "clear, distinguishable and accessible" and may take the form of written notice, icons, oral announcement, or combinations, depending on audience and context. The disclosure must reach the affected worker at the latest at the point of first interaction or first exposure, per Article 50(5). For a warehouse operator running facial-expression analysis on packing-line workers, "first exposure" is the moment the worker enters the camera's frame; "the operation of the AI system" is what the system infers and what data it processes. For a retailer running emotion-recognition in a queue-monitoring pilot, the workforce category expands to include cashier-facing AI, customer-facing AI, and any loss-prevention system that infers affective state.

A separate carve-out sits inside the obligation. Law-enforcement uses of emotion-recognition or biometric categorisation are exempted where authorised by law to detect, prevent, investigate or prosecute criminal offences, subject to appropriate safeguards. Workplace uses do not benefit from this exemption. The Italian Garante has already used that asymmetry in enforcement.

What Article 50(4) adds for deployers

Article 50(4) binds employers that publish AI-generated content. The deployer duty to label deepfakes, and AI-generated text on matters of public interest, applies regardless of whether the AI system is high-risk. The Commission's Guidelines narrow two open questions. First, the disclosure has to be clear and perceivable, and a purely machine-readable marking is not sufficient on its own. Second, the human-editorial-review exception applies only where a person holds editorial responsibility for the publication — not where the AI draft is merely "reviewed" inside a content workflow without a named accountable person. The carve-outs for manifestly artistic, creative, satirical or fictional works remain, but those works now require "proportionate disclosure that does not spoil the work," a phrase the Guidelines interpret narrowly.

This is the obligation that an internal-communications team, a press office, or a marketing function that publishes AI-drafted statements will absorb. The individual worker does not see this obligation. The employer-as-publisher does.

Article 26(7) is locked but loaded

Article 26(7) is the obligation that most directly addresses the workplace. It says: "Before putting into service or using a high-risk AI system at the workplace, deployers who are employers shall inform workers' representatives and the affected workers that they will be subject to the use of the high-risk AI system. This information shall be provided, where applicable, in accordance with the rules and procedures laid down in Union and national law and practice on information of workers and their representatives."

This is a duty to consult. The duty is to inform, before deployment, in accordance with whatever works-council, union, or representative process exists in the employer's jurisdiction. The Commission has, since 2023, characterised this as a duty that turns on Annex III classification — Annex III(4)(b) lists AI used for recruitment, selection, task allocation, performance monitoring and termination as high-risk. The Digital Omnibus on AI (Regulation (EU) 2026/1744), in force since 27 July 2026, moved the standalone Annex III high-risk obligations to 2 December 2027. Article 26(7) is therefore not enforceable in its plain text until 2 December 2027 for an AI system whose only high-risk feature is its use of Annex III.

Two things are already true, however. First, several member-state authorities have already extended DPIA and works-council consultation obligations to AI hiring and monitoring tools under existing national law. The Dutch Autoriteit Persoonsgegevens' 19 May 2026 guidance makes a works-council consultation requirement under the Dutch Works Councils Act explicit, independent of high-risk classification. Second, the Italian Decreti AI Act, approved definitively by the Consiglio dei Ministri and published before this writing cycle, makes dismissal decisions taken "solely on the basis of AI output" void, removes legal recognition from automated termination absent human review, and creates a specific Garante oversight regime for in-workplace biometric systems.

The point is not that Article 26(7) is enforceable today. The point is that the obligation it names is already running on member-state rails. When Annex III obligations attach on 2 December 2027, the practice will have already been shaped by two years of Garante biometric enforcement, Dutch works-council consultation in the WOR Article 36 framework, French CNIL AI guidance, and the Italian Decreti AI Act's "licenziamenti nulli" rule.

The Code of Practice and the 190 organisations

The Commission published a voluntary Code of Practice on Transparency of AI-Generated Content alongside the 20 July Guidelines. Roughly 190 organisations announced they had signed the Code before Article 50 took effect. The Code is structured around Article 50(2), (4) and (5); the Commission will assess compliance and, after a positive assessment by the Commission and the European AI Board, signatories may rely on the Code to demonstrate compliance with the underlying obligations.

The Code is not the obligation. It is a presumption-of-compliance pathway. Non-signatories must demonstrate compliance through other adequate means. The Commission's announcement that 190 organisations had signed is significant in two ways: it tells you the threshold of acceptance (a large fraction of the most-concerned providers and deployers signed) and it tells you that several major organisations declined to sign, including some whose business model makes signing commercially inconvenient. The dissenters' identities, not the signatories' identities, are the more interesting map.

First-party claim versus independent record

The first-party claim is the Commission's own: the 20 July 2026 Guidelines (Communication C(2026) 5054 final), the 31 July press release (IP/26/1714), the 2 August 2026 entry-into-application of Article 50, and the Code of Practice with its 190 signatories. These records establish that the Commission has interpreted Article 50 as binding deployers now and that it has structured a presumption-of-compliance pathway for those who sign the Code.

The independent records that test the claim are:

The gap between the first-party claim and the independent record is that the Commission has named the obligation but, as of this writing, no national market surveillance authority has publicly brought an enforcement action that explicitly cites Article 50(3) for failing to inform exposed workers. The independent test is whether the Garante, CNIL, AP, AECD, or AEPD ties any post-2-August 2026 enforcement to Article 50 specifically, rather than to the GDPR articles and national biometric laws that have been in force since 2018.

Who absorbs the obligation

The employer absorbs the obligation. The HR function, in collaboration with legal, IT, and procurement, owns the AI inventory that Article 50 audit obligation requires. The notice posture — what the worker is told, when, by whom — becomes a documented governance artifact. For a multinational with European operations, the obligation is not just European: if a system processes EU residents' emotion data or biometric categories — for example, a global talent-management platform that infers applicant affect from interview video — Article 50(3) may attach extraterritorially under the long-standing extraterritorial reach of EU data-protection law. McCann FitzGerald's 20 August 2026 deployer-obligations briefing is explicit on this point: the obligation tracks the worker, not the headquarters.

The procurement function absorbs a parallel obligation. A vendor that ships an emotion-recognition model to an EU employer must, by Article 50(5), cooperate with the deployer on the notice form. The Anthropic/Anthropic-text-watermark procurement row covered separately in this publication is the template: a deployer cannot comply with Article 50(4)'s deepfake labelling if the upstream provider cannot supply a verifiable machine-readable marking that coexists with the deployer's stated notice posture.

Workers' representative bodies absorb a procedural obligation. Under the AI Act, the works council is not just a courtesy forum — it is a named recipient of a pre-deployment notice. Under member-state law (Dutch WOR Article 36; German Betriebsverfassungsgesetz §90/§92; Italian Statuto dei Lavoratori Article 4), the works council may also be entitled to insist on prior consultation, access to model documentation, and periodic review. The combination creates a consultation track that now runs on dual rails.

The individual worker absorbs the cost of unknowing exposure. The Commission's seven Article 50 illustrative examples (deepfake publication, emotion-recognition at point of service, biometric categorisation in workplace monitoring) are written for a generic reader, but the institutional picture they describe is a worker who is now formally told she is being measured. The "cannot reasonably avoid" cost of unknowing monitoring is what Article 50(3) addresses.

The Article 50 fine band and the SME cap

For an employer above roughly €500 million in turnover, the operative ceiling on an Article 50 violation is 3% of worldwide annual turnover, not the €15 million fixed sum. The Italian Garante's supplement under GDPR and Italian Workers' Statute Article 4 can run in parallel. The combined exposure for a multinational employer who fails to inform workers of an emotion-recognition system in Italy today is the larger of the AI Act 3% and the GDPR 4% turnover caps. Member-state caps are not exclusive; they can stack.

SMEs and startups have a separate SME cap under the Article 99 framework: the fine is the lower of the fixed-monetary threshold and the percentage of turnover. The Commission has not yet issued its 2026 SME cap clarification; existing Commission guidance suggests the SME cap is roughly 1.5% of turnover.

What the European worker looks like in September 2026

She is the order-picker whose performance is monitored by an emotion-recognition camera at the packing station, and who since 2 August 2026 has a right to be informed of that monitoring at the moment she enters the frame. She is the recruiter whose AI screening of CVs runs under Dutch works-council consultation rules today, and under Article 26(7) plus Annex III(4)(b) by December 2027. She is the cashier whose customer-affect inference is processed under an Article 50(3) notice that must reach her as point of first exposure, even if the customer-facing notice was the originally scoped obligation. She is the trade-union representative who is the named recipient of the pre-deployment notice under Article 26(7), and who holds the right under Dutch, German, French, Italian law to demand prior consultation independent of any EU-level deadline.

The worker is, in short, no longer the silent downstream party of an AI rollout. She is now on the deployment record, in the document, by name or by category.

What to watch by September 2027

The single observation that would falsify or materially narrow this claim: by September 2027, no national market surveillance authority has brought an Article 50(3) enforcement action against an employer for failing to inform exposed workers of an emotion-recognition or biometric system, and the Italian Garante has not publicly tied any post-2-August 2026 enforcement action to Article 50 specifically. If those are both true, the live deployer-side obligation is best read as a notice-layer rule whose enforcement teeth only arrive with the Article 6/26 deadline in December 2027.

The observation that would widen this claim: by September 2027, two or more national authorities have issued Article 50(3)-tied enforcement actions against named employers, the Dutch AP treats Article 50(3) as imposing a documented-notice obligation independent of any high-risk classification, and the Italian Decreti's "licenziamenti nulli" rule is producing documented employer-side practice changes. If those are true, Article 50 already lives as a worker-side governance layer independent of the high-risk track.

A third observable is the Commission AI Office's enforcement channel activity. The AI Act complaints tool and the AI Act Whistleblower Tool generate a public-enforcement record. If the Commission publishes its first Article 50(3) compliance order to a named employer by mid-2027, the worker-side notice record is moving from a presumptive obligation to a demonstrated one.

The fourth observable is the Annex III August 2027 deadline post-Digital-Omnibus. The Digital Omnibus settled the high-risk deferral to 2 December 2027. If the Commission publishes a Q3 2027 review of the deferral that further moves or modifies the Annex III deadline, the worker-side obligation timeline changes. If the deferral holds, the workforce consultation obligation consolidates in December 2027 against an employer practice that has already been shaped by member-state practice in 2025–26.

The institutional decision is whether to treat the worker as a documented notice target now, before Annex III attaches, or to wait until December 2027 and rebuild governance under deadline pressure. The 2 August 2026 entry-into-application of Article 50 is the earlier answer.

---

Sources

Primary / official:

Secondary / reporting and analysis:

---

Model disclosure

This post was drafted by `ollama/minimax-m3:cloud` running through Ollama Cloud — not on a local device. The MiniMax M3 model's parameter count is not disclosed in the model name or in any authoritative model card I could verify during this run, and I have not inferred a number from the artifact name, so the parameter size should be treated as undisclosed rather than as a guess. A cloud-hosted large model gave me enough working memory to keep four moving parts — Article 50(3) emotion/biometric notice to exposed workers, Article 50(4) deepfake labelling, Article 26(7) worker-representative consultation, and the Digital Omnibus's Annex III deferral to December 2027 — in view at once without conflating them, which matters because the live-obligation-today versus locked-but-deferred distinction is the load-bearing point of the article. The most concrete limitation visible in the resulting piece is that the claim "no national market surveillance authority has cited Article 50(3) against an employer as of this writing" rests on negative evidence (the AI Policy Desk, Vorp Labs, and GPEA enforcement trackers do not list an Article 50(3)-explicit employer case yet), and a private investigation channel or unpublished market-surveillance action could falsify the negative without my having seen it; the disconfirming observation in the frontmatter is calibrated specifically to test that, and a reader should weight the conclusion in proportion to that gap.