What Article 50(1) requires
The rule for chatbots is the first paragraph of Article 50 of the AI Act, Regulation (EU) 2024/1689. It is addressed to the companies that build such systems:
Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use.
Article 50(5) adds that the information must be given "in a clear and distinguishable manner at the latest at the time of the first interaction", and that it "shall conform to the applicable accessibility requirements".
The Act prescribes no sentence, icon, colour or font size. The European Commission's guidelines on Article 50 confirm that Article 50(1) "does not specify any particular disclosure technique" (point 34). The wording is yours, which is why every text below is an example rather than a formula.
Since when it applies, and what the Digital Omnibus changed
Article 113 makes the AI Act apply from 2 August 2026, and Article 50, in Chapter IV, has no earlier date. The Digital Omnibus on AI, Regulation (EU) 2026/1744 of 8 July 2026, was published on 24 July 2026 and entered into force three days later. It moved the deadlines for high-risk systems but left the chatbot notice alone: it rewrote Article 50(7), on codes of practice, and added a transition in a new Article 111(4) for the machine-readable marking of Article 50(2) only. The Commission's guidelines are explicit about a chatbot that both talks and writes text: the transition applies "only with regard to the marking obligation", and the disclosure "must be ensured as of 2 August 2026" (point 153).
| Status on 25 October 2026 | Answer | Source |
|---|---|---|
| Must a chatbot tell people it is an AI? | Yes, since 2 August 2026 | AI Act, Articles 50(1) and 113 |
| Did the Digital Omnibus postpone that? | No | Regulation (EU) 2026/1744, Article 1 |
| Machine-readable marking of AI-generated text | From 2 August 2026, or 2 December 2026 for generative systems on the market before that date | New Article 111(4) of the AI Act |
| The Commission's guidelines on Article 50 | Published in English on 20 July 2026 with their content approved; they apply once formally adopted, when all language versions exist, which had not happened by 25 October 2026; not binding | Communication C(2026) 5054 |
| The Code of Practice on AI-generated content | Final text of 10 June 2026, judged adequate by the Commission on 8 July and the AI Board on 9 July 2026; about marking and labelling, not the chatbot notice | Commission pages on the code |
| Who enforces it in each country | Partly open: several countries, the Netherlands among them, have not designated their authority yet; Germany did so by law from 29 July 2026 | Commission list of 7 September 2026; German KI-MIG |
The guidelines call themselves "a first interpretation" and are not binding: only the Court of Justice of the European Union can interpret the Act with authority. What is quoted from them here is the Commission's view.
Who has to do it: the provider and the site owner
Article 50(1) puts the duty on the provider: whoever develops the chat system, or has it developed, and places it on the market or puts it into service under its own name or trademark (Article 3(3)). The provider has to build the notice in, so that everyone using the system is informed "irrespective of who the deployers or other users of the system are" (guidelines, point 11). A business that embeds a vendor's widget and uses it under its own authority fits the definition of a deployer (Article 3(4)).
That split is less comforting than it sounds. The site owner writes the welcome message, names the bot, gives it a face and decides what on the page might cover the chat, and each of those choices can undo a notice. So choose a tool that discloses by itself and do not work against it. If you built the chat yourself, or put a model behind your own chat window through an API, you are the provider and the whole duty is yours. When rebranding or customisation turns a deployer into a provider is covered in provider or deployer under the AI Act.
When the notice can be left out
No notice is needed where the AI nature is "obvious" to a reasonably well-informed, observant and circumspect person. The Commission reads this narrowly: the exception should be "interpreted restrictively", knowing that chatbots exist "does not imply that they recognise them in interactions", and it is meant for cases with "almost no doubt left" (point 45). A public website is open to children, older people and people new to AI, and for such an audience the exception "cannot be relied upon".
| Situation | Notice needed? | What the guidelines say |
|---|---|---|
| AI chat on a public website, answering customers | Yes | Helpdesk chatbots whose replies users "may perceive as human-generated" are their example of where the exception fails |
| The same chat with a human first name and a photo | Yes, and it matters more | A chatbot's profile picture showing a human is one of the factors they name as affecting whether the AI is obvious |
| A coding assistant for professional developers, or an internal assistant for trained staff who know it is AI | Usually not | Both are listed as obvious cases |
| Buttons with fixed, rule-based answers | No: Article 50(1) does not apply | Not an AI system: "rule-based quick message answers" are excluded |
| AI drafts replies, a colleague checks and sends them | Not under Article 50(1) | No direct interaction: the visitor deals with your colleague |
| AI replies and human replies mixed in one chat | Yes, for the AI replies | AI outputs need disclosure unless a person "properly reviewed and sent" them |
A persona is allowed; leaving it unexplained is the problem. The guidelines point to "the general anonymity of interactions online" and to AI that can "write and interact in a human-like manner", and a bot called Emma with a smiling photo is close to the opposite of obvious.
Which parts of Article 50 apply to a website chat
Article 50 holds four duties and one rule on how the information is given. A normal website chat touches two of the duties.
| Paragraph | What it requires | Addressed to | For a normal website chat |
|---|---|---|---|
| 50(1) | Tell people they are interacting with an AI | Provider | Applies: this is the notice. |
| 50(2) | Mark generated audio, images, video and text in a machine-readable way, and make it detectable | Provider | Applies to the provider of a chatbot that writes its own answers. Nothing for the site owner to write. |
| 50(3) | Tell people exposed to emotion recognition or biometric categorisation | Deployer | Only if the chat infers emotions or categories from biometric data, such as a face or a voice (Article 3(39) and (40)). A text chat that answers questions does not. |
| 50(4) | Disclose deep fakes, and AI text published to inform the public on matters of public interest | Deployer | Not the chat: the guidelines' example of text that is not published is a chatbot's news summary that only the user who asked can see. AI-written articles on public-interest topics that you publish without human review are another matter. |
| 50(5) | Give the information clearly, distinguishably, at the latest at the first interaction, and accessibly | Both | Applies to the notice under 50(1). |
Do not confuse the notice with the Code of Practice on Transparency of AI-generated Content: the code covers marking, detection and labelling under paragraphs 2, 4 and 5, and the EU's icons for AI-generated content belong with it. For the chatbot notice, the Commission's FAQ says providers and deployers "can determine adequate compliance measures themselves".
Ten AI disclosure messages to copy
Each text is an example to adapt, not a formula the Act requires. Replace what is in square brackets, keep the word "AI", and keep it short enough to take in at a glance. Where the context is sensitive, have your own adviser read the final version.
1. A minimal first message
Hello. You're chatting with an AI assistant. I answer questions about [Company] using our own website.
2. A friendlier first message
Hi, I'm the AI assistant of [Company]. I'm not a person, but I know our website and help pages well. What would you like to know?
3. With a way to reach a person
You're chatting with our AI assistant. Would you rather ask a person? Just say so and I'll pass your question to our team, who answer by e-mail within one working day.
Promise only what your team really does. If a colleague can take over in the same window, announce the switch both ways:
You're now chatting with Sam from our customer service team.
You're back with the AI assistant.
4. A chatbot with a persona name
Hi, I'm Robin, the AI assistant of [Company]. Robin is a name, not a person: I'm a computer program that answers from our own pages.
5. A clinic or another sensitive setting
You're chatting with an AI assistant, not a doctor or a nurse. I can help with opening hours, appointments and practical questions. I can't assess symptoms or give medical advice. If it's urgent, call us on [Phone]. In an emergency, call 112.
With a reminder the agent can repeat in longer conversations, since the guidelines expect more than one notice where people are easily misled, naming health advice, legal assistance, financial advice, insurance and complaints handling (point 40):
A reminder: I'm an AI assistant. For anything about your health, please speak to one of our staff.
6. A shop
Hello, I'm the AI shopping assistant of [Shop]. Ask me about sizes, delivery or returns: I answer from our product pages and policies.
7. A short header strip or banner
AI assistant: answers are generated automatically and can contain mistakes.
8. The input placeholder, which vanishes as soon as the visitor types, so it supports a notice and never replaces one
Ask our AI assistant a question
9. A notice that also asks visitors to hold back personal data
You're chatting with an AI assistant. Please don't share health details, passwords or card numbers here. Our privacy notice explains how we handle chats.
10. The answer to "Am I talking to a real person?", which a chatbot must give whenever it is asked (point 40): put it in the bot's instructions, or check that your platform does it already
No, I'm an AI assistant, a computer program. If you'd like to talk to a person, I can pass your question to our team.
A site in several languages needs the notice in each of them. For reference, these are the lines the ChatterLab widget shows:
| Language | Notice |
|---|---|
| English | You're chatting with an AI assistant |
| Dutch | Je chat met een AI-assistent |
| French | Vous discutez avec un assistant IA |
| German | Sie chatten mit einem KI-Assistenten |
| Spanish | Estás chateando con un asistente de IA |
Mistakes the Commission's guidelines rule out
The guidelines list techniques that are not enough on their own (points 37, 38 and 142). On a website chat, that rules out:
- A persona without a notice. "Hi, I'm Anna from support" with a photo and nothing more. "Human-like representations that may mislead users" are on the list.
- "Assistant" as the only signal. Plenty of assistants are people. Say "AI assistant".
- Only in the privacy notice, the terms or a footer link. Disclosure "contained only in terms and conditions, URLs, or documentation" can complement a notice in the chat, not replace it.
- An icon or a badge alone. Visual cues are there "to complement textual disclosures". The Commission's own AI icons tested better with a text label beside them.
- One sentence for the whole site. "Services on this website use AI" is the guidelines' example of a disclosure too general to count.
- Naming the technology. "This system uses LLMs" describes the engine, not the fact that the visitor is talking to a machine.
- Easy to miss. Information that "can be easily overlooked or missed" under normal conditions is not given clearly.
- The wrong language. Clear means easy to understand for the person concerned. An English line on a Dutch site informs few.
- As a picture. Article 50(5) and recital 132 ask for accessible information. A screen reader reads text, not words drawn into an image.
- A bot that denies it. An instruction such as "never admit you are a bot" goes against the guidelines, which expect a chatbot to disclose its nature whenever it is asked.
Where to put the notice: a six-point checklist
A notice works in four places: the first message, a label in the chat's header, a line next to the input field, and the launcher button before the chat opens. The guidelines recommend combining techniques, and their own examples are a chatbot that opens by saying it is based on AI and a label near the "input/output field". Telling people before they open the chat is fine: Article 50(5) sets the latest moment, not the earliest.
- The chat says it is an AI before or in its first message. The guidelines want the notice at least once at the start of every conversation (point 143).
- The notice uses the word AI. A first name or "assistant" on its own is an unclear signal.
- It is text inside the chat window. Not an image, a link or a clause in the terms, so the visitor sees it where the conversation happens and a screen reader can read it.
- It is in the visitor's language, on every language version of the site. A notice nobody can read informs nobody.
- The bot admits it is an AI whenever asked, and a human takeover is announced. AI replies and replies sent by a person are treated apart (points 30 and 40).
- Nothing on your page covers it, on a phone too. A notice hidden by a cookie banner, a sticky bar or your own styling has not been given.
What happens if you leave it out
Breaching Article 50 can be fined under Article 99(4): up to €15 million or, for a company, up to 3% of its total worldwide annual turnover for the preceding financial year, whichever is higher. For SMEs, including start-ups, Article 99(6) turns that around: whichever is lower. Since the Digital Omnibus, small mid-cap companies get the same lower-of rule for these fines (Article 99(6a)).
A worked example: an online shop with €2 million in annual turnover. If it is an SME, 3% of that turnover, €60,000, is lower than €15 million, so €60,000 is its ceiling. A ceiling, not a tariff: Article 99(7) makes the authority weigh how serious and how long the breach was, how many people it affected, whether it was intentional or negligent, the size of the business and how it cooperated. Each Member State sets the penalty rules, which may include warnings and non-monetary measures (Article 99(1)).
The rules "will mainly be enforced by national competent market surveillance authorities", says the Commission's FAQ. Anyone who thinks the Act is breached may complain to that authority (Article 85). The Commission's list of single points of contact, last updated on 7 September 2026, still marks several national designations as pending. It lags behind national law, though: Germany's implementing act, in force since 29 July 2026, makes the Bundesnetzagentur the market surveillance authority (unless the act names another one) and the single point of contact (KI-MIG, sections 2 and 6).
| Country | Single point of contact on the Commission's list |
|---|---|
| Ireland | AI Office of Ireland |
| Netherlands | Rijksinspectie Digitale Infrastructuur (RDI), designation pending |
| Belgium | None listed |
| Germany | Bundesnetzagentur, marked pending, though German law has designated it since 29 July 2026 |
| France | DGCCRF, designation pending |
| Spain | Spanish Artificial Intelligence Surveillance Agency, designation pending |
The contact point is not always the authority that will judge a chatbot notice. In the Netherlands, the draft implementation act put to consultation on 20 April 2026 would make the RDI the contact point, but the Dutch Data Protection Authority (AP) the supervisor of the transparency duties, "such as the recognisability of chatbots and deepfakes" (our translation). On 9 October 2026 the AP wrote that it had not yet been designated and would get its powers once that act is in force.
The duty itself does not wait for this: the AI Act is "binding in its entirety and directly applicable in all Member States" (Article 113). Nor is it the only law in play. Consumer law and the information duties of data-protection law, the GDPR among them, apply alongside it (guidelines, points 50 and 52), so the chat still belongs in your privacy notice: see what a chatbot privacy notice must say and whether a chatbot needs EU hosting.
How ChatterLab handles the notice
In the ChatterLab widget, every conversation opens with a line saying the visitor is talking to an AI: "You're chatting with an AI assistant", or the same in Dutch, French, German or Spanish, following the widget's language. No plan, add-on or setting removes it, the badge removal add-on included, and the free plan shows it like every other plan. It sits inside the chat, where the page around it cannot hide or restyle it, and the Deploy page lists it as AI disclosure: Always shown. It is one short line in small type under the chat's header, and it stays in view while the conversation scrolls.
The platform's rules also tell the agent that it is an AI assistant whatever name your instructions give it, that it must never claim to be human, and that it must say it is an AI when asked. Each answer in the widget is marked as AI-generated in the page's code, for software that looks for that. We do not claim that this mark alone meets Article 50(2): the output must also be detectable, and the guidelines expect a means of detection to be available (points 69 and 70).
What is left to you:
- Say it again in your own voice. Write a Welcome message that names the AI, such as example 2 or 4, so that the first message the visitor reads says it too. Each line becomes its own message. A label plus a first-turn greeting is the combination the guidelines describe.
- Use the other fields for the rest. The Input placeholder can carry example 8. The Notice, a short banner above the conversation, suits example 9, but a visitor can close it, so it complements the AI notice rather than being it.
- Get the language right. The built-in line follows the widget's language: the
data-localeon the tag, otherwise the visitor's browser if you switched that language on, otherwise the agent's Language. It does not look at the language of the page, so on a Dutch site set the agent's language to Dutch. The welcome message and placeholder can have a version per language; the Notice has one. - Word the handover honestly. On paid plans, a visitor who wants a person can open a ticket, which your team answers by e-mail. It is not a live chat, so phrase example 3 that way.
If you build your own chat on the API, none of this is drawn for you, and telling your users they are talking to an AI becomes your job. More in Languages and the AI notice, the EU AI Act in our documentation and the guide to the AI Act for website chatbots.
Questions about AI chatbot disclosure
Do I need the AI notice on every page of my website?
No. The duty attaches to the conversation, not the page. The notice has to reach the visitor at the latest when a conversation starts, and the Commission's guidelines ask for it at least once at the start of each conversation. A page without a chat needs nothing, and a general line such as "Services on this website use AI" does not count anyway.
Is a "powered by AI" badge enough?
Probably not on its own. The Commission's guidelines treat icons and badges as a complement to a text notice, and statements that only name the technology, such as "this system uses LLMs", as insufficient when used alone. A small badge in a corner is also easily overlooked. Keep it if you like it, and add a plain sentence in the chat: "You're chatting with an AI assistant".
Do I still need a notice if the chatbot is called "Assistant"?
Yes. The guidelines name generic references to "assistant" as an unclear signal that is not enough by itself, because many assistants are people. The same goes for a first name such as Emma or Robin. Keep the name and add the word AI: "I'm Robin, the AI assistant of our shop" tells the visitor what they need to know.
In which language must the AI notice be?
In the language the visitor is reading and chatting in. The AI Act names no language, but the notice has to be clear, which the Commission's guidelines explain as noticeable and easy to understand for the person concerned. On a site in Dutch and French, that means a Dutch notice on the Dutch pages and a French one on the French pages.
Does the disclosure rule also apply to chatbots on WhatsApp or e-mail?
Yes. The rule does not depend on the channel: the Commission's guidelines describe interaction with an AI system as happening through "online interfaces, phone or e-mail", among other means. An AI that answers people directly in a messaging app or by e-mail has to say it is an AI too. ChatterLab offers the chat widget for your website, the case this article covers.
What if a visitor says they don't care whether it is an AI?
Nothing changes. The notice is not something a visitor opts into: the provider has to build it in, and it belongs at the start of every conversation whatever the visitor thinks. After that, a single notice is "likely to suffice in most instances", in the guidelines' words, except in sensitive settings where they expect reminders, and the bot still has to answer truthfully whenever someone asks whether they are talking to a person.
Sources
- Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), Official Journal of the European Union, read on 25 October 2026.
- Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI), Official Journal of the European Union, read on 25 October 2026.
- Guidelines on transparency obligations for providers and deployers of AI systems, European Commission, read on 25 October 2026.
- Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of the AI Act (PDF), European Commission, read on 25 October 2026.
- Transparency obligations under Article 50 of the AI Act, European Commission, read on 25 October 2026.
- Code of Practice on Transparency of AI-generated Content, European Commission, read on 25 October 2026.
- Commission opinion on the assessment of the Code of Practice on Transparency of AI-generated Content, European Commission, read on 25 October 2026.
- EU Icons for labelling AI-generated content, European Commission, read on 25 October 2026.
- Market Surveillance Authorities under the AI Act, European Commission, read on 25 October 2026.
- Gesetz zur Durchführung der Verordnung über künstliche Intelligenz (BGBl. 2026 I Nr. 223), Article 1: KI-MIG, Bundesgesetzblatt, read on 25 October 2026.
- Toezicht op AI wordt concreet: sleutelrol voor de AP en de RDI, Autoriteit Persoonsgegevens, read on 25 October 2026.
- AP zet volgende stap in toezicht op AI, Autoriteit Persoonsgegevens, read on 25 October 2026.
- Toezicht op AI: balans tussen veiligheid en innovatie, Rijksinspectie Digitale Infrastructuur, read on 25 October 2026.
- 112 - the EU's emergency phone number, European Commission, read on 25 October 2026.
How this was made: drafted with AI, then checked against how ChatterLab actually works and against the sources listed in the article. Spotted an error? Write to management@sri-group.eu.