What must an AI chatbot disclose under the EU AI Act? A practical Art. 50 guide

Since 2 August 2026, Article 50 of the EU AI Act (Regulation (EU) 2024/1689) applies, and with it the transparency duties for chatbots and AI-generated content. This guide answers the questions companies actually ask, in the order they ask them.

Does my chatbot have to tell users it is an AI?

Yes. An AI system intended to interact directly with people must be designed so that those people are informed they are dealing with AI, unless that is obvious to a reasonably well-informed, observant and circumspect person, given the circumstances and context of use. The Commission's Guidelines on Article 50 (C(2026) 7702 final, 5 November 2026, non-binding) read this exception restrictively: the provider has to assess and be able to demonstrate it, and where the audience includes vulnerable users for whom the interaction is less obvious, it cannot be relied on. In practice, a prominent line at the start of the conversation is likely to suffice in most cases; a robot icon alone is not enough. The Guidelines say periodic reminders are likely to be necessary in riskier contexts, such as vulnerable users, health, legal or financial advice, or complaints handling (para 40).

This duty has applied since 2 August 2026. The July 2026 omnibus package (Regulation (EU) 2026/1744) did not defer it. What moved to 2027 and 2028 were high-risk obligations, not transparency.

Who carries the duty: the provider or the company using the bot?

The chatbot disclosure duty in Art. 50(1) sits with the provider, the party that develops the system or has it developed and places it on the market or puts it into service under its own name or trademark. If you run a vendor's chatbot on your site, the design duty to inform users is your vendor's. Your first practical step is asking the vendor to show you where the disclosure happens. If you developed the chatbot, or had it developed, and put it into service under your own name or trademark, even for your own use, you are the provider. The Guidelines say the same of a company that modifies a vendor's system, for example with new training data, and puts it into service under its own name (para 11).

Deployers, the companies using AI systems in a professional context, carry their own Art. 50 duties in specific cases: disclosing deepfakes, and disclosing AI-generated text that is published to inform the public on matters of public interest. Running a support chatbot does not put you in those categories. Publishing photorealistic AI imagery of real people, places or products that could pass for a genuine photograph can. So can publishing AI-written text on matters of public interest, unless the text has gone through human review or editorial control and a natural or legal person holds editorial responsibility for the publication. The Guidelines read both conditions strictly: review means a substantive check of the content by someone with relevant knowledge, with fact-checking as a minimum, not a spell-check or a cursory sign-off, and editorial responsibility means ultimate legal responsibility for the publication, which can sit with an individual, an editorial board or the publishing company (paras 134 to 138). The Guidelines list advertising copy and product descriptions as outside the text duty, unless they include claims on matters such as health, consumer safety or sustainability (para 131).

What about AI-generated images, audio and video?

Providers of systems that generate synthetic audio, images, video or text must ensure the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. That is the technical marking layer, and it belongs to the tool.

Separately from the technical marking, deployers who publish deepfakes must disclose that the content has been artificially generated or manipulated. That duty belongs to the publisher.

What does the 2 December 2026 grace period cover, and what does it not?

The grace period to 2 December 2026 covers one thing: the machine-readable marking, and only for systems placed on the market before 2 August 2026.

It does not cover the chatbot disclosure. It does not cover deepfake disclosure. A chatbot with no disclosure is not "in a grace period". It is out of line with a duty that already applies.

What happens if we do nothing?

Enforcement is national, and it has been live alongside Art. 50 since 2 August 2026. The practical risk profile is the one you know from other product regulation: these duties are checkable from the outside. A chatbot that never introduces itself is visible to anyone who opens it, including an authority, a competitor, or a journalist.

We do not attach fine figures to Art. 50. Serious numbers require citing the exact penalty tier for the exact conduct, and most figures circulating online mix the tiers. The defensible statement is shorter: the duties apply, enforcement exists, and the fix costs an afternoon.

The 10-minute self-check

1. Open your chatbot as a first-time visitor. Is there a clear statement that it is an AI, before or at the start of the interaction?
2. List where your company publishes AI-generated images, audio, video or text. Is generated content labelled, and does your generation tool mark outputs machine-readably?
3. Can you say, in one sentence per system, whether you are the provider or the deployer?

Three yes answers: you are ahead of most companies we talk to. Anything else: klariq.eu runs a free five-question risk check, and the 249 EUR pack turns the answers into the six documents you want on file.

Definitions

• Provider: develops an AI system, or has it developed, and places it on the market or puts it into service under its own name.
• Deployer: uses an AI system under its own authority in a professional context.
• Synthetic content: audio, images, video or text generated or manipulated by AI.