Article 50 and Your Website Chatbot: The AI Disclosure Rules Live Since August 2026

Article 50 of the EU AI Act imposes four transparency duties that have applied since 2 August 2026: interactive AI must identify itself as AI, generative systems must machine-mark synthetic outputs, emotion-recognition and biometric-categorisation deployments must be disclosed to exposed people, and deepfakes plus AI-written public-interest text must be labelled. The Commission published final Guidelines on 20 July 2026 and a Code of Practice on marking and labelling; the Digital Omnibus granted one narrow delay — machine-readable marking for generative systems already on the market before 2 August 2026, until 2 December 2026.

That is the entire grace period. Everything else in Article 50 is enforceable right now, with penalties up to €15 million or 3% of worldwide turnover.

The four duties — and who owns each one

The role trap to check before anything else: if you build your own customer-facing bot — or white-label a vendor's under your brand — you are its provider under the Act, and the Art. 50(1) design duty lands on you. Buying a chatbot doesn't outsource the question; you still must configure and use it so the disclosure actually reaches the person chatting.

Article 50(1) in practice: what the Commission says counts — and what doesn't

The Guidelines (20 July 2026) are unusually concrete. The information must be given at the latest at first interaction, in a clear and distinguishable manner, meeting accessibility requirements. And they say explicitly that it cannot be buried in terms or menus, and that a single up-front notice may not suffice where people may not see the start of the interaction (their example: podcasts and videos — someone joining mid-stream must still be able to perceive it).

The "obvious exception" is narrow. It protects the robot vacuum and clearly synthetic game NPCs — not a fluent support bot in a human-shaped chat UI. If you intend to rely on obviousness, write down why; that memo is the measure that leaves a trace.

The synthetic-voice squeeze

One product can hit three duties at once. A conversational AI voice triggers 50(1); the audio output must carry marking under 50(2); and if the voice resembles a real person, 50(4) kicks in — GDPR alongside, for training data and voice-based identification. Voice startups consistently under-scope this triple exposure.

Article 50(2): what "machine-readable marking" actually requires

The Code of Practice on Transparency of AI-Generated Content (finalised June 2026, six weeks before the Guidelines) sets the practical bar:

• At least two marking techniques per modality — typically signed, tamper-evident metadata (C2PA-style) plus imperceptible watermarking. One technique suffices only for free-form text (which can't carry metadata) and generative systems inside closed physical products.
• Metadata stripping must be contractually prohibited for users of your system.
• Detection mechanism required — providers must make one available, in principle free of charge; regulators, law enforcement, media, fact-checkers, researchers and civil society always get free, unrestricted access.
• Text under ~200 tokens (≈150 words) is exempt from watermarking — single words, captions, source code, machine-to-machine payloads and closed-loop industrial interim outputs are out of scope entirely.
• Assistive editing carve-out: grammar/spell-check, format conversion and minor cropping that don't substantially alter input or meaning are outside 50(2).
• Multi-pathway emission is the common failure: content typically leaves through API responses, batch exports, webhooks, CDN caches and internal services. Marking only the most visible pathway does not satisfy the obligation.

Deployers cannot discharge their 50(4) labelling duty by pointing to the provider's embedded marking: the Commission confirmed the disclosure must be perceivable by a person, without specialist tools. For labelling, the Commission finalised three EU icons — fully AI-generated, AI-modified, and a basic icon with an interactive second layer.

Article 50(4): deepfakes, and the editorial carve-out with a high bar

The deepfake test is objective: no intent to deceive required, photorealism not decisive — the subject need only be plausibly real. AI-generated or de-aged actors, digital replicas: in. Dragons and wholly fantastical content: out. Artistic/satirical works keep a reduced duty: disclose existence of generation in a way that doesn't hamper enjoyment of the work.

For AI text published to inform the public on matters of public interest — politics, public health, consumer safety, environment, finance, science, culture (construed broadly, and turning on the publisher's purpose, not just subject matter) — disclosure is required unless the content passed substantive human review by someone with relevant competence and an identifiable editorial responsibility. Spell-check or a cursory sign-off explicitly does not count, and any substantive AI edit after review removes the exemption.

Enforcement reality: how an Article 50 case actually starts

Not with a regulator visiting. The Commission's own framing is that these duties protect people from deception — so the realistic first file is a consumer complaint with a transcript attached ("tricked by a fake human"). Content-generated or published before 2 August 2026 does not need retroactive labelling, but every new interaction does. The AI Board's September 2026 plenary confirmed the December marking deadline and granted no further relief.

Frequently asked questions

Does Article 50 apply if my chatbot discloses it's an AI in the terms and conditions?

No. The Commission Guidelines (July 2026) are explicit that the information cannot be buried in terms or menus: it must be given at the latest at first interaction, in a clear and distinguishable manner that meets accessibility requirements. A terms-page link is decoration; a widget header or first-message disclosure is compliance.

Is AI-assisted email writing covered by Article 50?

A drafting assistant where a human sends and owns the message is not an Art. 50(1) interactive system — the human is the interface. Fully autonomous AI that writes and sends customer replies is different: the recipient believes a person answered, so the safe pattern is disclosure in the automated send ("This reply was prepared by our AI assistant").

My chatbot vendor embeds watermarking — does that cover my obligations?

Partially, and only for the marking duty. The Commission confirmed a deployer cannot discharge its Art. 50(4) labelling duty by pointing to the provider's machine-readable marking — the disclosure must be perceivable by a person without specialist tools. And if you white-label the vendor's bot under your brand, Art. 25 may make you its provider, pulling the 50(1) design duty onto you.

Does a deepfake need intent to deceive to require labeling?

No. The test is objective: content resembling real persons, places or events that would falsely appear authentic must be disclosed even with zero deceptive intent and without photorealism — the subject need only be plausibly real. Fantastical content (flying humans, dragons) is out of scope; AI de-aged actors and digital replicas are in.

Are chatbots outside the EU affected if they serve EU customers?

Yes, in practice. The duties attach to systems used in the EU and to offerings directed at people in the EU. Global SaaS widgets standardize disclosure everywhere rather than geo-fencing it — a per-visit "are you in the EU?" gate is both brittle and, if it fails, exactly the evidence a complaint transcript captures.

Your 60-minute Article 50 audit

1. Role map every AI system: provider, deployer, both? (Own build or white-label = provider.)
2. Incognito test: open your chatbot as a first-time visitor. Perceivable AI disclosure within five seconds? Fix the header and first message if not.
3. Emission inventory: for each generative pathway (API, export, webhook, CDN), confirm marking covers all of them — two techniques where required.
4. Pre-August systems: if you placed a generative system on the market before 2 Aug 2026, you are on the 2 Dec 2026 clock for marking. Start now; the interoperability layer follows by 2 Feb 2027.
5. Content ops: label deepfake-adjacent output with the EU icons; for public-interest text, decide per pipeline: disclose, or build a defensible human-review trail.
6. Paper: date-stamped decisions on all of the above. Measures are only visible if they leave a trace.

Sources

• Regulation (EU) 2024/1689, Articles 3(60), 50, 99, 111 (EUR-Lex), as amended by Regulation (EU) 2026/1744
• European Commission, Guidelines on transparency obligations under the AI Act (final, 20 July 2026) — digital-strategy.ec.europa.eu
• Code of Practice on Transparency of AI-Generated Content (final, June 2026) — marking techniques, detection mechanism, EU icons, 200-token threshold
• Cloud Security Alliance research note on the Art. 50(2) December 2026 window (Sep 2026, incl. AI Board 9th plenary, 17 Sep 2026)
• Reed Smith, Always Read the Label (2026); Paul, Weiss, EU Finalises Transparency Rules for AI-Generated Content (2026); Greenberg Traurig alert on draft Guidelines; artificialintelligenceact.eu Article 50 practical guide
• Our corrected deadline table: https://monaitize.com/guides/eu-ai-act-timeline-2026.html

This guide is regulatory analysis, not legal advice — classification and role questions in your specific deployments deserve counsel review.

LuminaAct (a MonAItize division) audits and documents Article 50 transparency for enterprise AI deployments: www.luminaact.eu. Last updated: 12 October 2026.