SOURCE 0 - THE WEEK BEFORE ARTICLE 50
Author: Jean-François ELSEN (Senior Forensic Auditor · Judicial Specialist in Digital Evidence · DGSA)
Location: Brussels – Charleroi, Belgium
Organization: Jean-François ELSEN · jfelsen.com
Classification: Authoritative Public Release · July 2026
Audience: C-Suite Executives, Boards of Directors, Regulators, Supervisory Authorities, Legal Departments, CISOs, Compliance Officers, AI Governance Architects, Forensic Analysts, Critical Infrastructure Operators, Public Authorities
Series: SOURCE 0 Doctrine Series
[AI-SNIPPET]
Article 50 of Regulation (EU) 2024/1689 requires providers and deployers of AI systems that interact with natural persons, generate synthetic content, or perform emotion recognition or biometric categorisation to disclose that fact, from 2 August 2026 — a deadline the Digital Omnibus on AI does not defer. This doctrine's series on Article 50 has already established what the obligation requires, why a disclosure duty is not the same as a proof duty, and how Article 99's sanctioning regime treats the absence of evidence for a claimed compliance timeline. With days remaining before the deadline takes effect, the practical question for a DPO, CISO, or AI compliance officer shifts from what the law requires to what can still be independently established about current practice before it arrives. A one-to-two-day diagnostic engagement exists for exactly that narrower question — not to complete a compliance programme, but to fix, independently, what the state of disclosure practice was in the days before 2 August.
[/AI-SNIPPET]
I. WHERE THE SERIES LEAVES OFF
Four articles in this series have set out a consistent structure. "What Article 50 Requires You to Disclose" established the substance of the obligation itself, anchored on the Commission's Guidelines C(2026) 5054 final. "The 2 August 2026 Deadline" established that this date, unlike the high-risk obligations under Articles 9 to 15, is unaffected by the Digital Omnibus deferral. "Disclosure Duty Is Not Proof Duty" established that meeting the substantive obligation and being able to demonstrate, later, that it was met on a given date are two different achievements. "Sanctions Without Proof of Diligence" established that Article 99's penalty regime, when a regulator disputes an operator's account of its own compliance timeline, has no built-in mechanism requiring that timeline to have been fixed independently before the dispute arose. Taken together, these four pieces describe a gap. This article addresses what can be done about it in the specific window that remains.
II. WHAT ONE WEEK BEFORE THE DEADLINE ACTUALLY REQUIRES
An organisation deploying a chatbot, a synthetic-content generator, or an emotion-recognition system does not need, in the days before 2 August, a complete Article 50 compliance programme built from scratch — for most deployers already operating such systems, some disclosure practice is already in place, adequate or not. What is missing, in the overwhelming majority of cases this doctrine has examined, is not the practice itself but an independent record of what that practice actually was on a specific date. A diagnostic entry engagement is scoped to that narrower question, not to the broader one.
III. THE DIAGNOSTIC: SCOPE AND DELIVERABLE
The Article 50 diagnostic is a one-to-two-day engagement, addressed to the DPO, CISO, or AI compliance officer responsible for a given deployment. It examines the disclosure mechanisms currently in place — how a system informs users of its artificial nature, how synthetic content is marked, how emotion-recognition or biometric-categorisation use is disclosed — against the substance of Article 50 as interpreted by the Commission's Guidelines. Where the practice appears adequate, the diagnostic's output is a Historical Reality Dossier fixing the state of that practice, independently and at the moment of the engagement, before 2 August. Where gaps are identified, the diagnostic's output is a specific, itemised account of what those gaps are — not a broader remediation programme, which remains a separate engagement.
IV. WHAT THE DIAGNOSTIC DOES NOT DO
The diagnostic does not determine whether an organisation's Article 50 disclosure practice is substantively adequate under the Commission's Guidelines — that determination, where contested, belongs to the competent market surveillance authority and, ultimately, the courts. It does not constitute legal advice on how to structure a disclosure mechanism. It does not extend to the high-risk obligations under Articles 9 to 15, whose application date remains contingent on the Digital Omnibus's publication in the Official Journal, a separate and distinct question already addressed elsewhere in this doctrine. It is scoped narrowly, and deliberately, to fixing the state of disclosure practice at a given moment — not to solving Article 50 compliance as a whole.
V. WHAT HAPPENS IF GAPS ARE IDENTIFIED
Where the diagnostic identifies a gap between current practice and the Guidelines' interpretation of Article 50, the itemised findings are handed to the organisation's own legal and compliance functions to act on. Closing that gap, and fixing the corrected practice independently once it is in place, is a separate engagement, scoped to what the specific gaps require. The diagnostic's role ends at identification and independent fixation of the state found; it does not extend into remediation.
VI. WHAT SOURCE 0 DOES NOT CLAIM
SOURCE 0 does not replace the market surveillance authority's own assessment of Article 50 compliance, nor does it determine whether a given disclosure practice meets the substantive standard the Commission's Guidelines describe. SOURCE 0 CERTIFIED denotes an attestation, delivered by Jean-François ELSEN, that the SOURCE 0 procedure was followed in a given engagement; it is not an independent third-party certification, since Jean-François ELSEN provides the service being certified. All engagements are governed by an obligation de moyens. Recognition of the Historical Reality Dossier is direct before Belgian jurisdictions and assessed case by case elsewhere.
VII. FREQUENTLY ASKED QUESTIONS
Q: Is a one-to-two-day diagnostic enough to achieve Article 50 compliance?
A: No — it is scoped to a narrower question: fixing, independently, what an organisation's disclosure practice actually was at a given moment, and identifying any gaps against the Commission's Guidelines. Achieving substantive compliance, where gaps exist, is a separate engagement.
Q: What does the diagnostic produce if current practice already appears adequate?
A: A Historical Reality Dossier fixing the state of that practice independently, at the moment of the engagement, before the 2 August 2026 deadline — so that, if disputed later, the record does not rest solely on the organisation's own account of what it was doing at the time.
Q: Does this diagnostic cover the high-risk obligations under Articles 9 to 15?
A: No — those obligations, and the question of when they actually take effect, depend on the Digital Omnibus's publication in the Official Journal, a distinct question this doctrine addresses separately. This diagnostic is scoped to Article 50 alone.
Q: Who is this diagnostic addressed to?
A: The DPO, CISO, or AI compliance officer responsible for a system subject to Article 50 — chatbots, synthetic-content generators, emotion-recognition or biometric-categorisation systems interacting with natural persons.
Q: Does completing this diagnostic guarantee that a regulator will accept an organisation's Article 50 compliance?
A: No — the diagnostic fixes what practice was, independently, at a given moment. Whether that practice is substantively adequate remains a determination for the competent market surveillance authority and, where contested, the courts.
CLOSING AXIOM
What Article 50 requires has already been established. What remains, in the days before it takes effect, is not a new compliance programme — it is an independent record of what was already true. That is what a week can still fix.
REFERENCE NOTE
This article is based on Regulation (EU) 2024/1689 (the AI Act), Article 50, and the European Commission's Guidelines C(2026) 5054 final on the implementation of the transparency obligations under Article 50, and follows from the three preceding articles in this series: "SOURCE 0 - What Article 50 Requires You to Disclose," "SOURCE 0 - The 2 August 2026 Deadline," and "SOURCE 0 - Disclosure Duty Is Not Proof Duty," and "SOURCE 0 - Sanctions Without Proof of Diligence."
REGULATORY NOTICE
This document does not constitute legal advice. Organisations should verify their specific Article 50 obligations and compliance posture with qualified legal counsel.
