Under EU AI Act Article 50, a chatbot or AI agent that talks directly with people must tell them they're dealing with an AI system, at the latest at the first interaction, unless that's obvious. Systems that generate images, audio, video or text must mark their output in a machine-readable way, and companies that publish deepfakes or AI-written text on matters of public interest must label it visibly. These duties have applied since 2 August 2026, with a grace period for output marking that ends on 2 December 2026.
This is general information, not legal advice. Have counsel confirm how the rules apply to your products.
What EU AI Act Article 50 requires
Article 50 contains four separate duties, each tied to a role:
| Duty | Who carries it | Applies to | In practice |
|---|---|---|---|
| Disclose AI interaction, 50(1) | Provider | Chatbots, voice agents, avatars | A notice at the start |
| Mark generated output, 50(2) | Provider | Systems generating audio, images, video or text | Machine-readable marks |
| Inform about emotion recognition or biometric categorization, 50(3) | Deployer | Using those systems on people | A notice to those exposed |
| Label deepfakes and public-interest text, 50(4) | Deployer | Publishing realistic synthetic media or AI-written public-interest text | A visible or audible label |
Article 50(5) sets the delivery rules for all four: clear and distinguishable, at the latest at first interaction or exposure, and accessible. Providers outside the EU are covered when their system's output is used in the EU, so a US company with EU users is in scope.
Are you the provider or the deployer of your chatbot?
A provider develops an AI system, or has one developed, and offers it under its own name or trademark. A deployer uses an AI system under its own authority in a professional context.
If you build a support assistant on a model API and ship it under your brand, you're likely its provider, even though the model belongs to someone else. If you embed a vendor's chatbot on your site, the vendor is the provider and you're the deployer. Then check that the vendor's AI notice is switched on and that your custom persona or welcome message doesn't hide it.
Map roles per system. Our guide to finding the AI tools your team already uses covers the inventory, and the EU AI Act guide for SMBs covers the rest of the Act.
When must a chatbot tell users it's an AI?
The Commission's questions and answers on Article 50, which summarize its guidelines, set four cumulative conditions for the 50(1) duty:
- It's an AI system.
- It's designed for a genuine two-way exchange, not only collecting data or returning automated responses.
- The AI communicates directly with the person, without a human intermediary.
- The other party is a natural person, consumer or professional.
A support chat widget and a phone voice agent qualify. A model that drafts replies for support staff to review and send doesn't interact directly with the customer.
The exception for interactions that are "obvious" is narrow. The test is a reasonably well-informed, observant and circumspect person, and the Commission says to read the exception restrictively. A product called "AI Assistant" may pass. A chat window with a human first name and a stock photo almost certainly won't.
How to add AI disclosure to a chatbot
Treat disclosure as a product requirement with acceptance criteria:
- Put the notice in the interface. Label the widget header or first message, for example "You're chatting with an AI assistant."
- Cover every channel. Voice agents need a spoken notice at the start of the call. Email agents need it in the message body, not a collapsed signature.
- Label any persona. A name and avatar are fine with an AI label next to them.
- Meet accessibility requirements. Use real text that screen readers announce, with sufficient contrast.
- Handle handoffs. Say when a human takes over, and when the AI returns.
- Test it. Add an automated check that the first rendered message or spoken turn contains the notice.
Keep the notice outside the model's control. If it lives in the system prompt, a prompt edit or a jailbreak can make the assistant claim to be human. Render it from your own code.
How to mark AI-generated images, audio, video and text
The 50(2) marking duty applies to the provider of the generating system. The Code of Practice on Transparency of AI-generated Content, which the Commission and the AI Board assessed as adequate for demonstrating compliance, has signatories commit to:
- Digitally signed, time-stamped metadata stating that content is AI-generated or manipulated, wherever the format supports metadata.
- An imperceptible watermark in the content, except for very short text.
- For free-form text, which can't carry metadata, the watermark alone, expected on text longer than 200 tokens.
- Optional fingerprinting or logging as a supplement, never the only measure.
Signing is voluntary, but providers that don't sign must show their own measures are adequate.
Marking can happen upstream at the model provider, but the code keeps responsibility with the provider of the system people use. If you build image generation on a vendor's model, ask which marks its output carries, then check they survive your pipeline. The sharp image library, for example, removes all metadata from output images unless you call keepMetadata(), and resizing, re-encoding or CDN optimization can drop a signed manifest. Download a published file and inspect it.
The FAQ lists output outside the marking duty: source code, short sequences of numbers, symbols or letters, machine-to-machine output no person sees, and assistive functions for standard editing. Some business-to-business and industrial uses have a narrow exemption.
How to label deepfakes and AI-written public-interest text
The 50(4) duties sit with the deployer that publishes the content. A deepfake is image, audio or video that resembles real people, objects, places or events and would falsely appear authentic. As an example, a product video with an AI-generated presenter who looks like a real person needs a label. An obviously stylized illustration usually doesn't.
The label must be perceivable without tools: the FAQ says the provider's machine-readable mark doesn't satisfy the deployer's duty. Code signatories use the EU "AI" icon or an equivalent label, placed where overlays won't cover it, and an audible disclaimer at the start of audio-only content.
For text, the duty covers AI-generated text published to inform the public on matters of public interest, such as public health, consumer safety or economic developments. It doesn't apply when a person with relevant knowledge reviewed the substance and someone holds editorial responsibility. A spell check or grammar pass doesn't count.
Article 50 deadlines and the December 2026 grace period
Article 50 has applied since 2 August 2026. The Digital Omnibus amendments added one grace period, in Article 111(4): generative systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the 50(2) marking duty. Chatbot disclosure and the deployer labels apply now.
Content generated before 2 August 2026 doesn't need retroactive labels. Article 50 breaches fall in the middle fine tier of Article 99(4), and for SMEs the cap is whichever of the two limits is lower. National market surveillance authorities do most of the enforcement.
Common Article 50 mistakes
- Putting the AI notice in the terms of service, where nobody sees it at first interaction.
- Generating the notice from the system prompt, so the model can drop or contradict it.
- Assuming the model vendor handles 50(2) when your product is the system people use.
- Stripping provenance metadata in image optimization and never checking the published file.
- Disclosing in the web widget but forgetting the voice line or email agent.
If you're unsure which systems carry which duties, our AI Readiness & Governance Assessment includes an inventory of AI tools in use, EU AI Act risk classification, and governance and policy recommendations. Your counsel confirms the legal position.
Frequently asked questions
Does Article 50 apply to internal AI tools for employees?
The 50(1) duty covers direct interaction with natural persons, and the Commission's FAQ includes professionals. An internal tool clearly named as an AI assistant may fall under the "obvious" exception, but a label takes little effort and removes the question.
Do we have to label AI-generated marketing images?
Only when the image is a deepfake under 50(4), meaning it would falsely appear authentic to its audience. Photorealistic images of people, places or products can meet that definition, depending on context. The 50(2) marking is the generating tool provider's duty either way.
Does an AI-drafted blog post need an AI label?
Only if it's published to inform the public on a matter of public interest and nobody with editorial responsibility reviewed its substance. A product how-to article is unlikely to meet that test. A news-style piece on a consumer safety issue could.