Article 50 vs. GDPR: does one cover the other?

No, and the confusion is understandable, because both regimes use the word "transparency." They're aimed at different things, and compliance with one does nothing for the other.

GDPR transparency is about personal data: telling people what data you process, why, on what legal basis, and what rights they have. It applies whenever you process personal data, AI or no AI. Article 50 transparency is about the artificial nature of an interaction or of content: telling people they're talking to a machine, or that media is synthetic. It applies whether or not any personal data is involved.

So a chatbot on your site typically owes users both: a privacy notice covering the conversation data (GDPR: the chat transcript, any account linkage, processors like your model vendor) and an AI disclosure at first interaction (Article 50(1)). Your privacy policy mentioning "we use AI" does not satisfy Article 50; the draft guidelines expressly reject disclosures buried in linked legal documents. And a perfect "I'm an AI assistant" badge does nothing for your GDPR duties.

The regimes also don't share enforcement plumbing. GDPR runs through data-protection authorities, the AI Act through national market surveillance authorities with their own penalty scale (for SMEs, capped at the lower of €15M or 3% of turnover under Article 99(6)). One incident can, in principle, interest both.

Where they genuinely intersect, escalate rather than improvise: emotion recognition and biometric categorisation (Article 50(3)) sit at the junction of AI Act notice duties and GDPR's special-category data rules. If you're anywhere near those, that's a question for counsel, not a template. For the ordinary SME chatbot-and-content setup, the practical takeaway is a checklist item, not a project: two notices, two purposes, each in its proper place. The AI Act explicitly supplements rather than replaces data-protection law.