EU AI Act Article 50: What Your Website Chatbot Must Disclose
Since August 2, 2026, people in the EU must be told when they are talking to an AI. Here is what Article 50 says, who it applies to, what the July 2026 Omnibus changed, and what we would ship. Not legal advice.
This is not legal advice. We build chatbots. We are not lawyers, and Webeons holds no legal or compliance certification. This article quotes the regulation and the European Commission's guidance so you can see what they say, and it flags what we could not confirm. For your own setup, talk to a lawyer who works on EU technology law.
The core rule for a website chatbot is short, and most of the work is product design.
What Article 50 Says, Word for Word
Article 50 of Regulation (EU) 2024/1689 sets transparency duties for certain AI systems, whether or not they are high-risk. For a chatbot, paragraph 1 is the one that matters:
"Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use."
Paragraph 5 sets the form. The information must be given "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure", and it "shall conform to the applicable accessibility requirements".
The other paragraphs cover content rather than conversation:
- 50(2): providers of systems that generate synthetic audio, image, video or text must mark outputs "in a machine-readable format and detectable as artificially generated or manipulated".
- 50(3): deployers of emotion recognition or biometric categorisation systems must inform the people exposed to them.
- 50(4): deployers must disclose deep fakes, and AI text "published with the purpose of informing the public on matters of public interest", unless that text has had human review or editorial control and someone holds editorial responsibility.
What the Digital Omnibus Changed, and What It Did Not
Regulation (EU) 2026/1744, the Digital Omnibus on AI, was signed on July 8, 2026 and published in the Official Journal on July 24, 2026. It entered into force on the third day after publication, which is July 27, 2026. We read the Official Journal text itself.
| Date | What applies | Where it comes from |
|---|---|---|
| 1 Aug 2024 | AI Act enters into force | Regulation (EU) 2024/1689, published 12 July 2024 |
| 2 Feb 2025 | Chapters I and II apply, including AI literacy (Art. 4) and banned practices (Art. 5) | Art. 113(a) |
| 27 Jul 2026 | Digital Omnibus on AI enters into force | Regulation (EU) 2026/1744, published 24 July 2026 |
| 2 Aug 2026 | Article 50 applies, including chatbot disclosure | Art. 113, unchanged by the Omnibus |
| 2 Dec 2026 | Deadline for Art. 50(2) marking on generative systems already on the market before 2 Aug 2026 | New Art. 111(4), added by the Omnibus |
| 2 Dec 2027 | High-risk rules apply to Annex III systems | Art. 113(c)(i) as amended |
| 2 Aug 2028 | High-risk rules apply to Annex I products | Art. 113(c)(ii) as amended |
High-risk duties moved to December 2, 2027 for Annex III systems and August 2, 2028 for Annex I products. A support chatbot is not normally high-risk, but if yours makes decisions about credit, jobs or public services, take advice on that separately.
Chatbot disclosure did not move. The Omnibus left Article 113's general date of August 2, 2026 in place for Article 50. In Article 50 it replaced only paragraph 7, which concerns codes of practice.
The grace period is narrow. Our topic notes said one source mentioned a grace period we could not pin down. The Official Journal text settles it. New Article 111(4) says providers of generative systems "placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026". That covers machine-readable marking only. The Commission's guidelines say systems that are partly interactive and partly generative get the extra time only for marking, "while compliance with the disclosure obligation for AI systems directly interacting with natural persons must be ensured as of 2 August 2026".
AI literacy was softened. Article 4 now asks providers and deployers to "take measures to support the development of AI literacy" of their staff, and adds that this "does not require providers or deployers to guarantee any specific level of AI literacy of any individual".
Who Article 50 Applies To: Providers, Deployers and Non-EU Businesses
The Act separates the provider, who develops a system or has it developed and puts it on the market or into service "under its own name or trademark", from the deployer, who uses a system "under its authority". Article 50(1) and (2) are addressed to providers. Paragraphs 3 and 4 are addressed to deployers.
The Commission's guidelines, adopted on July 20, 2026, give examples that map onto common website setups:
- You use a vendor's chatbot as supplied. A company that offers a chatbot on the EU market under its own name, which customers use "without the need for modifications or additional components", is the provider. You are a deployer, so the 50(1) duty sits mainly with the vendor.
- You had a chatbot built for your own site. The guidelines name an organization that "has developed an interactive AI system (e.g. chatbot) in-house and puts it into service in the Union for its own use and under its name or trademark" as a provider. The definition includes having a system developed, so an agency build counts. Building on another company's model makes you what the Act calls a "downstream provider", which is still a provider.
- You modify someone else's system. A company that modifies an existing generative system, for example with new training data, and puts it into service under its own name, becomes the provider of the new system.
Where you sit between these, such as a heavily configured vendor widget under your own brand, the guidelines do not give a direct example that we found. That is a question for your lawyer.
Outside the EU. Article 2(1) covers providers placing systems on the EU market "irrespective of whether those providers are established or located within the Union or in a third country", and providers and deployers in third countries "where the output produced by the AI system is used in the Union". The guidelines add that "incidental, unforeseeable or unauthorised downstream use" should not alone trigger the obligations for third-country providers whose systems are not placed on the EU market. If you sell to EU customers, assume you are in.
Check Which Article 50 Duties Apply to You
Answer for the chatbot or AI feature on your site. The result shows each duty, who the Act points at, and a short checklist. It is a reading aid built from the text above.
What Disclosure Means for a Website Chatbot
Article 50(1) does not prescribe a technique. The guidelines say providers can choose any appropriate one, as long as the notice is clear, distinguishable, given by the first interaction and accessible, and takes account of children, older people and people with disabilities where they are likely users.
The "obvious" exception will not save a public chatbot. The guidelines say it "should be interpreted restrictively", and list "AI chatbots embedded in online platforms or assistance support tools (helpdesks)" among the cases where the duty applies. The obvious examples they give are narrow, such as a code assistant used only by professional developers.
Two details are easy to miss. First, the system must disclose "in all situations where the AI system is being asked questions relating to its nature". A bot that dodges "are you human?" fails that. Second, products that blend AI replies with human-written ones need disclosure for the AI outputs, unless those outputs "have been properly reviewed and sent by humans as the main interlocutors". So if your chat hands off to a person, the visitor should be able to tell which messages came from which.
Generated Content and Deep Fakes, at Website Level
Machine-readable marking, Article 50(2). This is the provider's job, and it covers generated text as well as media. The guidelines exclude short outputs such as alt text and UI labels, and source code, and describe a narrow exemption for real-time content that is never stored, such as in video games. We found no example that says how this applies to a website chatbot's replies. If you are the provider, ask your model vendor what marking it applies, and get advice on whether you need more.
Deep fakes, Article 50(4). A deep fake is AI image, audio or video that "resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful". The guidelines give website-relevant examples: an AI image of a product that misleads about how it really looks is one, and a real car shown against an AI-generated background is not, as long as the ad does not mislead about the product.
Public-interest text, Article 50(4). AI-written text that informs the public on matters of public interest must be labeled, unless a person reviews it and someone holds editorial responsibility. The guidelines list ordinary advertising and product descriptions as outside this, unless they make health, consumer safety or sustainability claims. An AI-edited article on diet and disease on a lifestyle site is inside it. If you publish with AI help, the simplest course is a named human editor.
Penalties, as Written
Article 99(4)(g) puts "transparency obligations for providers and deployers pursuant to Article 50" in the band of fines up to €15,000,000 or, for an undertaking, up to 3% of total worldwide annual turnover for the preceding financial year, "whichever is higher". Article 99(6) reverses that for SMEs, including start-ups: up to the percentage or the amount, "whichever thereof is lower". The Omnibus added paragraph 6a, which does the same for small mid-cap enterprises.
These are ceilings. Member States lay down the penalty rules, and Article 99(7) lists factors such as the nature, gravity and duration of the breach and the size of the business. Enforcement is by national market surveillance authorities, the AI Office for systems built on a general-purpose model by the same provider, and on complaint from anyone with grounds. We did not check how each Member State has written its national rules, or how active its authority is.
What We Would Ship on a Chatbot With EU Visitors
On AskOrac, our AI support platform, the design question was never only whether the bot is labeled. It was whether the visitor can trust what they are reading, and what happens when the system is unsure. A score on every answer decides whether the bot replies, falls back or brings in a person. In strict mode, below the confidence gate, the project's fallback message goes out in place of an improvised answer. Handoff runs in a live inbox, and outside office hours the bot keeps answering while logging the questions it was unsure about for the team.
That maps onto Article 50 better than a banner alone does. For any chatbot that EU visitors can reach, we would ship:
- A label and a first message. A short AI label beside the input, plus a first message that says it is AI before the visitor types. Plain words, in every language the site serves.
- A rule for "are you human?" Do not leave this to the model alone. Detect the question in code and reply truthfully.
- No human disguise. No stock photo of a person as the bot's avatar, and no human first name without "AI" beside it.
- A visible switch at handoff. When a person takes over, say so in the thread, so it is clear which messages came from the AI.
- An accessible notice. The label must be real text that a screen reader announces, not color or an icon alone.
- A written record. Note who the provider is, what the notice says, when it shipped, and your vendor's answer on Article 50(2). Regulators ask for evidence, and this costs an afternoon.
<header className="chat-header">
<h2 id="chat-title">Support</h2>
<span className="badge">AI assistant</span>
</header>
<div role="log" aria-live="polite" aria-labelledby="chat-title">
<p className="msg from-ai">
You are chatting with an AI assistant. It can make
mistakes. Type "person" to reach our team.
</p>
</div>If you are comparing tools, ask each vendor three things in writing: whether it is the provider under Article 50, what its default notice says and whether you can switch it off, and how it handles Article 50(2). Our comparison of AI chatbot prices for websites covers the vendors. If you are still deciding what you need, start with chatbot vs AI agent. Agents carry more duties here, as the next section shows.
Where This Is Heading
- AI agents will need to say who they act for. The July 2026 guidelines say agents covered by Article 50(1) must disclose "both their artificial nature and the person on whose behalf they are acting". If your bot books, buys or sends email, plan for that now.
- The guidance will change with enforcement. The guidelines call themselves "a first interpretation", say they are non-binding, and note that only the Court of Justice of the EU gives an authoritative reading. The Commission says it will review them in light of enforcement and court rulings.
- The marking code is the practical route for content. The Commission published a voluntary Code of Practice on marking and labelling AI-generated content on June 10, 2026. Its guidelines say non-signatories should expect more requests for information. If your product generates images or video, read it.
- New bans arrive in December. The Omnibus adds prohibitions on systems that generate sexual images of identifiable people without consent, and on child sexual abuse material, applying from December 2, 2026. Few business chatbots are affected, but any product that generates images should check its safeguards.
If You Have a Chatbot With EU Users
Confirm whether you are the provider, make sure a clear AI notice appears before the first message, answer "are you a bot?" truthfully, and keep a note of what you did. Then take legal advice on the parts flagged here as unsettled.
If the chatbot is ours to build or fix, our AI chatbot solution covers disclosure, confidence routing and handoff, and our AI integration service covers AI features inside your own product. Or send us your checker result, and we will tell you what we would change in the widget. We will not tell you that you comply. That is your lawyer's call.
Sources (8)
Common questions
Does the EU AI Act apply to my website chatbot?
If people in the EU can use it, probably. Article 50(1) has applied since August 2, 2026 to AI systems that interact directly with people, and Article 2(1) reaches providers outside the EU who place systems on the EU market or whose output is used there. This is not legal advice.
What does Article 50 require a chatbot to disclose?
That the person is interacting with an AI system, in a clear and distinguishable way, at the latest at the first interaction, and in an accessible form. The Commission's guidelines say a line in the terms, hidden metadata or a generic "assistant" name is not enough on its own.
Who is responsible, the chatbot vendor or the website owner?
Article 50(1) is addressed to providers. A vendor selling a chatbot under its own name is the provider. A business that builds or commissions its own chatbot and puts it into service under its own name is also a provider. Mixed setups are unsettled, so take legal advice.
Did the Digital Omnibus delay chatbot disclosure?
No. Regulation (EU) 2026/1744 entered into force on July 27, 2026. It moved high-risk duties to December 2027 and August 2028, and gave existing generative systems until December 2, 2026 for Article 50(2) marking only. Chatbot disclosure still applies from August 2, 2026.
What are the fines for breaking Article 50?
Up to €15 million or 3% of total worldwide annual turnover, whichever is higher, under Article 99(4). For SMEs and small mid-cap enterprises it is whichever is lower. Member States set the penalty rules and authorities weigh factors such as gravity and size.
Get a second look at your chatbot's AI disclosure
Send us a link to your chatbot and your checker result. We'll tell you what we would change in the widget, and what to ask your vendor and your lawyer.
