AI Act Article 50: transparency per output ​
Status: Template — to be reviewed by the controller's DPO / counsel. Draft of 2026-10-13; not reviewed yet.
Regulation (EU) 2024/1689 (AI Act), Article 50, applies since 2 August 2026. Under the Digital Omnibus on AI (Regulation (EU) 2026/1744), providers of systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with the marking duty of Art. 50(2) (taken from secondary sources; counsel to confirm against the Official Journal text). CodeLotse has not been placed on the market yet; the transitional period is therefore probably irrelevant.
Art. 50 is not a single "label everything" duty. The relevant paragraphs for CodeLotse:
| Paragraph | Who | Duty | Exceptions |
|---|---|---|---|
| 50(1) | Provider | Systems intended to interact directly with natural persons are designed so that people are informed they are interacting with an AI system | Obvious to a reasonably well-informed, observant and circumspect person |
| 50(2) | Provider | Synthetic audio, image, video or text output is marked in a machine-readable format and detectable as artificially generated or manipulated | Assistive function for standard editing; output that does not substantially alter the input data |
| 50(3) | Deployer | Emotion recognition and biometric categorisation | Not used by CodeLotse |
| 50(4) | Deployer | Deep fakes; text published to inform the public on matters of public interest | Text that underwent human review or editorial control with editorial responsibility |
| 50(5) | Provider and deployer | Information given clearly and distinguishably at the latest at the first interaction or exposure, meeting accessibility requirements | — |
Quavon UG (haftungsbeschränkt) is the provider of CodeLotse in both editions (roles.md); the customer is the deployer.
Current product behaviour ​
Every text CodeLotse publishes to a Git host:
- is posted by the CodeLotse app's own bot account (the Git host marks such accounts as bots in its API and user interface);
- carries a visible notice in the first or last line (texts below);
- carries a hidden machine-readable marker
<!-- quavon:<id> -->(and<!-- quavon-finding:<fingerprint> -->per review finding), added byembedMarkerinpackages/shared-types/src/publish.ts. The marker exists for idempotent publishing; it identifies the text as CodeLotse output but does not state "AI-generated" by itself.
| Output | Visible notice (current text) | Source |
|---|---|---|
| Review summary and inline review comments | "Automated review by CodeLotse" (configurable per repository policy, label, ≤ 200 characters) | packages/shared-types/src/review.ts, packages/publisher/src/render.ts |
| Triage comment | "Automated triage by CodeLotse" | packages/publisher/src/render.ts |
| Reply to an issue or comment | "Automated reply by CodeLotse" | packages/publisher/src/render.ts |
| Chat answer (command in a comment) | "Automated answer by CodeLotse" | packages/publisher/src/render.ts |
| Draft fix pull request | "Draft fix by CodeLotse. Review it like any other change before marking it ready." | packages/publisher/src/fix-pr.ts |
| Assignment suggestion comment | "Automated assignment suggestion by CodeLotse" / "Automatischer Zuweisungsvorschlag von CodeLotse" | packages/publisher/src/assignment.ts |
| Triage labels | None (a label from the repository's own allowlist, set by the bot account) | — |
Review requests and assignees (apply mode) | None on the request itself; the Git host shows the bot account as the actor | — |
| Check run "CodeLotse" | Name of the check; counts of findings | packages/publisher/src/publish.ts |
Visible notices are covered by publisher tests (render.test.ts, outputs.int.test.ts, assignment.int.test.ts, fix-pr.int.test.ts).
Mapping per output ​
| Output | 50(1) direct interaction | 50(2) machine-readable marking | 50(4) public-interest text | Proposed position |
|---|---|---|---|---|
| Review comments and summary | Probably not direct interaction (comments are delivered to the PR, not a conversation) | Likely applies: generated text. Not "standard editing" | Not applicable: code review is not information to the public on matters of public interest | Keep visible notice; add an explicit machine-readable AI marker (see recommendation) |
| Triage comment | As above | Likely applies | Not applicable | As above |
| Labels | No | Probably not "content" in the sense of 50(2) (selection from a fixed list) | No | No duty; bot account is the actor |
| Reply to issue or comment | Likely applies: answers a person's question in a conversation | Likely applies | Usually no; a reply on a public open-source issue tracker might be argued to inform the public — counsel | Visible notice in the first line meets 50(1)/(5); add machine-readable marker |
| Chat answer | Applies: a person addresses the bot and gets an answer | Likely applies | No | As above |
| Draft fix PR (description, commits, code) | No | Description: likely applies. Code changes: open — code is text, but the PR is a draft that a human must review; counsel | No | Visible notice in the PR body; commits authored by the Fixer bot; consider a commit trailer as marker (counsel) |
| Assignment suggestion comment | No | Applies to the explanation text if generated; the text comes from fixed templates and typed facts, so it may not be "synthetic" content — counsel | No | Keep notice; counsel (assessment Q13) |
| Review requests / assignees | No | No content | No | No duty under Art. 50; Annex III assessment is separate (annex-iii-assignment.md) |
| Dashboard texts (previews, approvals) | Users know they are looking at CodeLotse output | Previews are not published | No | No duty |
Recommendation (product change requests) ​
- Add an explicit machine-readable marker to every published body, for example
<!-- codelotse:ai-generated v=1 -->, next to the existing idempotency marker, and document it. Effort is small and removes the main uncertainty under 50(2). - For draft fix PRs, add a commit trailer such as
AI-Generated: CodeLotseto Fixer commits, if counsel considers code output to be covered. (A commit trailer in customer repositories is the product's own output marker, not authorship attribution of this repository.) - Keep the visible notices non-removable: the review
labelis configurable, so a tenant could set a text that no longer says "automated". Proposal: validate that the label is not empty and keep the fixed suffix "by CodeLotse", or make the notice fixed and the label additional.
Questions for counsel ​
- Do review comments delivered to a pull request count as "interacting directly with natural persons" (50(1))?
- Is the existing hidden idempotency marker plus the bot account sufficient as "machine-readable marking", or is an explicit AI marker required (50(2))? Are there Commission guidelines or a code of practice on marking text that should be followed?
- Is generated source code (draft fix PRs) "synthetic text" under 50(2), and does the human review before merging matter?
- Can template-based assignment explanations fall under the exception for output that does not substantially alter the input data?
- Are replies on public open-source issue trackers ever "text published with the purpose of informing the public on matters of public interest" (50(4))?
- Does a configurable notice text meet 50(5), or must part of it be fixed?