EU AI Act 2026: What It Means for Your Chatbot
From August 2026, AI chatbots and generated content must be disclosed under Article 50 of the EU AI Act. Here is what your business actually has to do.
If your website has a support chatbot, an AI assistant, or any feature that writes text or generates images for visitors, a hard deadline is now on your calendar. From 2 August 2026, Article 50 of the EU AI Act requires you to tell people when they are talking to a machine or looking at AI-generated content. It is the first part of the Act that touches ordinary businesses rather than just labs building frontier models, and it applies the way GDPR does: not by where your company is based, but by whether people in the EU use your product.
The good news is that Article 50 is mostly about transparency, not heavy engineering. You are not being asked to prove your model is safe or file a conformity assessment. You are being asked to be honest about what is human and what is not. The catch is that "be honest" has specific rules, the fines are large enough to matter (up to 35 million euros or 7% of global turnover for the worst breaches), and a surprising number of teams discover they are a "provider" of an AI system when they assumed they were just a user of one.
Here is what Article 50 actually requires, how to tell which obligations land on you, and the short list of changes most businesses need to ship before August.
What Article 50 actually requires
Article 50 covers four situations, and each one has its own disclosure rule.
- Chatbots and conversational AI must tell users they are interacting with an AI system, unless that is already obvious to a reasonable person.
- AI-generated or manipulated media (synthetic images, audio, and video, including deepfakes) must be labelled as artificially generated.
- AI-generated text published to inform the public on matters of public interest must be disclosed as such.
- Emotion recognition and biometric categorization systems must inform the people exposed to them.
Most businesses are touched by the first two. If you run a chatbot, the disclosure has to be clear and come at the right moment, which in practice means before or at the start of the conversation, not buried in a privacy policy nobody opens. If you use AI to generate marketing images or product copy at scale, the labelling rule starts to apply.
In plain terms
If a visitor could mistake your AI for a person, or mistake AI output for something a human made or photographed, the Act says you have to clear up the confusion. The test is whether a reasonable person would already know.
Are you a provider or a deployer?
The Act splits responsibilities between two roles, and the difference decides what you owe.
A provider places an AI system on the market under its own name. A deployer uses an AI system under its own authority. The same company can be both: you are a deployer of OpenAI's model when you call its API, and a provider of the branded assistant you built on top of it and put your logo on. That second hat is the one teams forget. If you ship a customer-facing AI feature as part of your own product, you are very likely a provider for that feature, and the transparency duties sit with you, not with the model vendor underneath.
For ordinary SaaS and marketing-site features, most of this falls under Article 50 transparency rather than the much heavier "high-risk" regime in Annex III. High-risk uses, AI for hiring decisions, credit scoring, education, or healthcare, carry far more obligations, and the EU has pushed several of those deadlines out to 2027 and 2028. But Article 50 is the one live in August 2026, and it is the one with your chatbot's name on it.
What compliance looks like in practice
The work is smaller than the legal text suggests. For most businesses it comes down to a handful of concrete changes.
- Add a clear AI disclosure to every conversational surface. A short line at the start of the chat ("You're chatting with an AI assistant") satisfies the chatbot rule. Keep it visible, not hidden in a tooltip.
- Label AI-generated media. Where you publish synthetic images or video, mark them as AI-generated in a way a normal viewer will notice.
- Keep a simple inventory. Write down each AI feature you ship, whether you are provider or deployer for it, and which Article 50 case it falls under. This is the document a regulator or a cautious enterprise customer will ask for first.
- Brief the humans. Support and marketing should know which features are AI and what they are allowed to claim about them.
Disclosure is a UX decision, not a legal footnote
The most common mistake is treating the AI disclosure as terms-and-conditions text. The Act asks for clarity at the moment of interaction. A line your users actually see beats a paragraph your lawyer is proud of.
A short timeline and what to do now
Article 50 applies from 2 August 2026. The high-risk obligations under Annex III were pushed to December 2027, with some sector-specific rules running to August 2028, so there is no need to over-build today. The realistic plan for the next few weeks is narrow: inventory your AI features, decide provider or deployer for each, add the disclosures to your chatbot and any AI-generated content, and write the one-page summary that proves you did it.
If you are building or already running AI features like a RAG support assistant or AI agents inside your business, the disclosure work is a small addition that is far cheaper to design in now than to retrofit under deadline pressure. If you want a candid read on which obligations actually apply to your product and the shortest path to clearing them, talk to us and we will map it with you, including the parts you can safely ignore.
