EU AI Act Article 50: 3 Things Your Chatbot Must Do by 2026
By Konstantinos Karamatzianis · Co-Founder, Dabster Labs
Published 7 July 2026 · Updated 17 July 2026 · Reflects the EU AI Act timeline as it stands at time of writing
Watch the short on YouTube (in Greek). The full write-up, in English, is below.
The EU AI Act stopped being a future problem some time ago. Its transparency rules, set out in Article 50, start applying on 2 August 2026, and they reach a great deal further than most business owners assume. You do not have to be building anything high-risk to be caught by them. If there’s a chatbot on your website, Article 50 is talking to you.
That’s the part that surprises people. This isn’t a rule aimed at AI labs and big tech. It lands on the ordinary business with a customer-support bot, a booking assistant, an automated FAQ widget in the corner of the page. If a visitor can type a message and get an AI-generated reply, you’re in scope. There is no exemption for small businesses, and the duties are concrete.
The stakes. The obligations become enforceable on 2 August 2026, there is no general exemption for SMEs, and breaches can bring fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher.
First, are you a “provider” or a “deployer”?
The Act splits responsibility between providers, who build an AI system, and deployers, who use one. The distinction matters, because most small businesses are deployers. If you added a ready-made chatbot to your site, or you use an AI assistant to answer customers on WhatsApp, you are a deployer, and you carry your own Article 50 obligations even though you never built the underlying model.
What Article 50 asks of your chatbot
1. It has to admit it’s an AI
The headline duty is the simplest to state and the easiest to fumble: anyone talking to your chatbot has to be told, clearly, that they are talking to a machine. The disclosure comes at the start of the interaction, not tucked into your terms and conditions, not findable only if someone goes digging. A short, visible line as the conversation opens (“You’re chatting with an AI assistant”) is all it takes, and it has to be accessible, including to screen readers.
It sounds trivial, and it catches a lot of people out, because so many business chatbots were deliberately designed to feel as human as possible. Under Article 50 that instinct is now the wrong one. Passing for human isn’t clever UX any more; it’s non-compliance.
2. AI-generated content has to be labelled
If your tools generate synthetic images, audio, video or text, that output has to be marked in a machine-readable way and be detectable as artificially generated. Deepfakes carry an explicit duty to disclose that the content was artificially created or manipulated, and AI-written text published to inform the public on matters of public interest has to be flagged as AI-generated unless a person took genuine editorial responsibility for it.
3. Personal data still has to be handled properly
The moment your chatbot takes a name, an email, or a question about someone’s account, it’s processing personal data, and GDPR applies in full right alongside the AI Act. The two stack. The AI Act’s transparency duty doesn’t replace your data-protection obligations; it sits on top of them. In practice that means a lawful basis for what the bot collects, honesty about how that data is used, and not quietly hoarding every conversation forever. A chatbot that logs everything indefinitely isn’t a feature, it’s a liability waiting for someone to find it.
4. Someone has to actually check
This is the one that gets skipped. Is the disclosure present and correct? Is the data handling lawful? Is retention sensible? None of that should be assumed, it should be verified, ideally before a regulator or a complaint verifies it for you. For a small business the point isn’t the headline maximum fine, it’s that this is now a real, enforceable obligation, not a best-practice suggestion you can get to later.
When you don’t need to disclose
Article 50 leaves room for common sense. You are not required to spell out that AI is involved when:
- It is already obvious to a reasonably well-informed, observant and circumspect person, given the context.
- AI-generated text went through genuine human editorial review, with someone holding editorial responsibility.
- The AI is doing a purely assistive editing job that doesn’t substantially change the content.
- The system is authorised by law to detect or prevent criminal offences, with appropriate safeguards.
Your 2 August 2026 checklist
For most small businesses this is a quick fix rather than a rebuild, provided you know what you’re looking for:
- ☐ Inventory every AI touchpoint: website chatbot, WhatsApp bot, voice agent, AI-drafted emails, AI-generated images or copy.
- ☐ Add a first-interaction disclosure that says the visitor is talking to an AI, and keep it visible and accessible.
- ☐ Label the AI-generated media you publish, including deepfakes and public-interest text.
- ☐ Get your data handling in order: lawful basis, clear usage, sensible retention.
- ☐ Confirm your vendor marks AI output machine-readably, in writing.
- ☐ Have someone verify all of it before the deadline, and keep a short record.
Frequently asked questions
Does the EU AI Act apply to small businesses?
Yes. Article 50’s transparency obligations contain no general exemption for small businesses. If you deploy a chatbot or publish AI content that reaches people, you must comply, regardless of size.
Do I have to tell users my website chatbot is AI?
Yes, at the latest at the time of the first interaction, in a clear, distinguishable and accessible way, unless it is already obvious from the context.
I use a third-party chatbot I didn’t build. Am I still responsible?
Yes. As a deployer of a ready-made AI tool you carry your own Article 50 obligations, even though you did not build the underlying model.
What are the penalties?
Fines can reach up to €15 million or 3% of total worldwide annual turnover, whichever is higher.
Sources
- EU AI Act, Article 50 (full text)
- Transparency rules: a practical guide to Article 50
- European Commission, AI Act Service Desk, Article 50
This is general guidance for small businesses, not legal advice. For a definitive assessment of your obligations, consult a qualified legal professional.
Want to know whether your bot is compliant? Run our free 2-minute EU AI Act check, or get in touch and we’ll take a look.
