EU AI Act transparency rules for chatbots and AI content
Hephaestus Technology8 min read
The EU AI Act transparency rules for chatbots and AI content, set out in Article 50, have applied since 2 August 2026. If you run a chatbot or voice agent, people must be told they are dealing with AI at the latest at the first interaction, unless it is obvious; if you provide generative AI, its output must be machine-readably marked; and if you publish deepfakes or AI-written public-interest text, you must label them. The Digital Omnibus did not delay these rules.
Key takeaways
- Article 50 of the EU AI Act has applied since 2 August 2026: people must be told when they interact with an AI system, unless it is obvious, at the latest at the first interaction.
- Providers of generative AI must mark output in a machine-readable, detectable format; systems already on the market before 2 August 2026 have until 2 December 2026.
- Deployers must label deepfakes and AI-generated text published to inform the public on matters of public interest, unless a human reviewed it and someone holds editorial responsibility.
- The Commission's July 2026 guidelines say a helpdesk chatbot that users may perceive as human does not qualify for the "obvious" exception.
- Breaches fall under the €15 million or 3% fine tier, with SMEs capped at whichever amount is lower.
What is Article 50 of the AI Act?
Article 50 is the set of transparency obligations for AI systems that interact with people or generate content, applying regardless of whether the system is high-risk. It sits in the AI Act as amended by the Digital Omnibus on AI, and the Commission confirms it applies from 2 August 2026. The Commission adopted guidelines on implementing Article 50 on 20 July 2026 (C(2026) 5054).
Which duties apply to whom?
Article 50 splits obligations between providers (who build and brand AI systems) and deployers (who use them).
| Paragraph | Who | What you must do |
|---|---|---|
| 50(1) | Provider | Design systems that interact directly with people so those people are informed they are interacting with AI, unless obvious |
| 50(2) | Provider | Mark synthetic audio, image, video and text output in a machine-readable format, detectable as AI-generated or manipulated |
| 50(3) | Deployer | Inform people exposed to emotion recognition or biometric categorisation |
| 50(4) | Deployer | Disclose deepfakes; disclose AI-generated text published to inform the public on matters of public interest, unless human-reviewed with editorial responsibility |
| 50(5) | Both | Give the information clearly and distinguishably, at the latest at the first interaction or exposure, meeting accessibility requirements |
Am I the provider of my chatbot?
Often, yes. The Commission's guidelines (paragraph 11) give the example of a company that develops an interactive AI system such as a chatbot in-house and puts it into service in the EU for its own use under its own name: that company is a provider. A company that modifies an existing generative system, for example with new training data, and puts it into service under its own name also becomes a provider. Our guide to AI provider vs deployer covers the wider test.
Providers outside the EU are covered when their system is placed on the EU market or its output is used in the EU, although the guidelines say incidental, unforeseeable downstream use should not alone trigger the obligations.
How should a chatbot disclose that it is AI?
Clearly, early and in a form suited to the channel. The guidelines suggest:
- Text: a first-turn greeting such as "You are interacting with an AI system", or a prominent banner, optionally with a persistent badge near the input field.
- Voice and telephony: a spoken statement at the start ("This is an AI-powered assistant"), with periodic reminders in longer calls. Audio tones alone are not considered sufficient.
- AI agents sending messages: an AI label at the top of an email the agent sends.
The guidelines recommend combining techniques where proportionate, and explicitly take into account the resources of SMEs. A single, prominent notice before the first interaction is the baseline.
When is it "obvious" that the user is talking to AI?
Less often than product teams assume. The test is whether the AI nature is obvious to a reasonably well-informed, observant and circumspect person in the target audience; awareness that chatbots exist in general is not enough. The guidelines give these examples:
| Exception applies (no notice needed) | Exception does not apply (notice needed) |
|---|---|
| Code-review assistants used only by professional developers | Helpdesk chatbots on online platforms whose replies users may perceive as human |
| Internal assistants for trained, AI-literate staff (HR, IT, legal support) | Realistic avatars or voices in VR or AR, especially for children or older users |
| Diagnostic support tools used only by trained health professionals | Robotic companion pets designed to mimic real animals |
For a customer-facing chatbot on an SME website, assume you need a notice.
What does the marking rule mean for generative AI features?
Providers of systems generating synthetic audio, images, video or text must ensure outputs are marked in a machine-readable format and detectable as AI-generated, using solutions that are, per the consolidated Article 50, "effective, interoperable, robust and reliable" as far as technically feasible. Assistive editing functions that do not substantially alter the input are exempt.
Systems placed on the market before 2 August 2026 have a transition until 2 December 2026. New systems had none.
The Commission published a voluntary Code of Practice on transparency of AI-generated content on 10 June 2026, with a provider section on marking and detection and a deployer section on labelling. About 190 organisations had signed by the end of July 2026. If you build on a third-party model, check what marking the model provider already applies and whether your pipeline preserves it.
When must AI-generated text be labelled?
Only when it is published to inform the public on matters of public interest and has not undergone genuine human review or editorial control with a named person or entity holding editorial responsibility. The guidelines set a high bar: an editorial policy alone, automated review or a cursory grammatical check does not count.
They also give useful boundaries. Outside the rule: AI-assisted advertisements and product descriptions (unless they make health, safety or sustainability claims), fantasy novels, and a chatbot news summary shown only to the user who asked. Inside it: AI-edited lifestyle articles on diet and disease, investor information on a listed company's site, and public weather warnings, unless properly reviewed.
What else applies besides the AI Act?
Consumer law. The guidelines point out that under the Unfair Commercial Practices Directive and the Consumer Rights Directive, the AI nature of a paid service such as a subscription chatbot may be a main characteristic that must be disclosed before contract, whether or not the interaction is "obvious". GDPR also applies to any personal data in chats.
What does non-compliance cost?
Breaches of Article 50 are in the middle fine tier of Article 99: up to €15 million or 3% of worldwide annual turnover, whichever is higher, but for SMEs and start-ups whichever is lower. The practical cost of compliance is small by comparison: a disclosure line, a label and a review step.
Common pitfalls
- Hiding the disclosure in terms and conditions instead of at the first interaction.
- Giving a bot a human name and photo with no AI notice.
- Stripping provenance metadata from generated images during processing.
- Treating a quick proofread as "human review" of AI articles.
- Forgetting voice agents and outbound AI emails.
For the wider design choice between chatbots, agents and automations, see AI agent vs chatbot vs workflow automation, and for the dates around these rules, our EU AI Act timeline.
Frequently asked questions
Do I need to disclose that my website chatbot is AI?
Yes, in almost all cases. Article 50(1) requires users to be informed that they are interacting with an AI system unless that is obvious to a reasonably well-informed person. The Commission's guidelines list helpdesk chatbots embedded in online platforms as an example where the obvious exception does not apply.
Who is responsible for the chatbot disclosure, me or the AI model vendor?
Article 50(1) is a provider obligation, and the Commission's guidelines say a company that develops a chatbot in-house and puts it into service under its own name is the provider. If you modify an existing generative system and put it into service under your own name, you become the provider of the new system. A pure deployer using a vendor's finished chatbot should check the vendor has built the disclosure in.
Do I have to label marketing copy written with AI?
Generally not under Article 50(4). The Commission's guidelines list AI-assisted advertisements and product descriptions as falling outside the public-interest text rule, unless they contain claims about matters such as health, consumer safety or sustainability. Consumer protection law still prohibits misleading practices.
Is a watermark enough to meet the marking rule?
Article 50(2) requires machine-readable marking that is effective, interoperable, robust and reliable as far as technically feasible. The voluntary Code of Practice on transparency of AI-generated content sets out how providers can do that; signing it, subject to a positive assessment, is a recognised way to demonstrate compliance.
Does Article 50 apply to internal staff assistants?
Often not the disclosure duty. The Commission's guidelines give an internal assistant used by trained, AI-literate staff for purposes such as HR or IT support as an example where the AI nature is obvious. The AI literacy obligation under Article 4 still applies.
If you are adding a chatbot or generative feature and want the disclosures designed in from the start, book a free 30-minute call.
Cover photo by MART PRODUCTION on Pexels.