Someone types into the chat on your site, gets a brisk reply in two seconds, and carries on in the firm belief that they are talking to a member of staff. From 2 August 2026 that is no longer allowed: Article 50 of the EU AI Act requires the bot to identify itself. There is no size threshold — the rule is the same for a corporation and for a one-person business that installed a widget.
What Article 50 actually requires
The article sets out four obligations. For an ordinary small-business website, the first two are usually the ones that bite.
Disclosing the AI you are talking to. A system that interacts directly with a person — site chat, voice assistant, messenger bot — must make clear that it is a system and not a human. No later than the first interaction.
Marking generated content. Audio, images, video and text created by AI must be marked in machine-readable form, so it can be detected automatically. This is not a visible caption under a picture; it is a marker inside the file.
Two further obligations sit with whoever deploys the system: informing people about emotion recognition and biometric categorisation, and disclosing deepfakes — images, audio and video depicting real people or events.
The information must be given clearly and distinguishably, no later than the first interaction. Article 50(5) of Regulation (EU) 2024/1689, applicable from 2 August 2026.
The rule has exceptions
The regulation does not ask you to label the obvious. Disclosure under 50(1) is unnecessary where it is apparent to a “reasonably well-informed, observant and circumspect” person that they are dealing with a machine. The wording is vague, and the European Commission’s guidance of 20 July 2026 reads it narrowly: do not rely on “everyone can tell anyway”.
Generated text gets its own carve-out: where the material has been through human editorial review and someone holds editorial responsibility for the publication, marking under 50(4) is not required. For artistic, satirical and fictional works, disclosure remains but in a form that does not spoil the work.
Separately: marking under 50(2) for systems already on the market before 2 August 2026 applies from 2 December 2026 — the Digital Omnibus granted four months. The duty to disclose an AI interlocutor got no such reprieve.
If the bot comes from a third-party service
Roles matter here. The regulation addresses the disclosure duty under 50(1) to the provider of the system — whoever developed it and put it on the market. A site owner who installed a ready-made widget and left it alone is in a different role.
In practice that means three things.
- Check that the widget discloses anything at all, and that it is visible before the conversation starts rather than buried in the footer or the privacy policy.
- Check that it is in the language of the site. An English label on a German site does not do the job.
- If you renamed the bot, gave it your company’s name and present it as your own service, discuss with a lawyer what role that puts you in. The regulation contemplates situations where the role shifts.
What good disclosure looks like
The law prescribes no wording — it prescribes an outcome: the person has to understand. Short phrases in the interface work; documents do not.
- A badge in the chat window header: “Answered by an AI assistant”.
- The bot’s first message: “Hello. I’m an AI assistant. I can answer questions about pricing and timelines, and I’ll pass anything complex to Sergey.”
- A caption under the launcher button if the chat is collapsed: “AI assistant”.
- In a messenger bot, the same in the welcome message and the profile description.
What to avoid: giving the bot a human name and photograph with no hint that it is software. That is not formally prohibited, but it is precisely the scenario the regulation has in mind when it talks about misleading people.
A quick test: open your own site in a private window, as if you were a customer. If it is not clear within the first five seconds of chatting that you are talking to software, the disclosure is not enough.
The penalties, and who they hit
Article 99 puts a breach of Article 50 in the middle tier: up to €15 million or up to 3% of annual worldwide turnover — whichever is higher.
For small and medium businesses the rule is inverted. Article 99(6) states plainly that for SMEs and start-ups, whichever is lower applies. So for a company turning over €500,000, the ceiling under this article is 3% of turnover, not €15 million. On top of that, the authority must take the operator’s size into account when setting the fine.
That is no reason to relax, but it is also no reason to panic: the €15 million figure doing the rounds in headlines does not apply to small businesses in that form.
What to do before 2 August
- Make a list of where AI appears on your site and in your messengers. Chat, autoresponder, product-description generator, voice menu.
- For each one, check whether the system announces itself before its first reply, and in the user’s language.
- Where there is no disclosure, add it to the interface. One line in the welcome message covers most of the requirement.
- If you publish AI-made images or text, find out whether your tool applies a machine-readable marker. Many do by default; not all.
- Record what you did and when. A dated screenshot is not court evidence, but it is a useful part of your internal documentation.
If you have no bot yet and are thinking about one, have a look at the Automation & AI service: disclosure and marking are part of the build, with nothing to add afterwards. And if you would rather first understand what else on your site could attract attention, start with the seven small things that get you a letter in Germany.
This is technical preparation of a website, not legal advice. For how the rules apply to your particular case, talk to a lawyer.
Sources
- Regulation (EU) 2024/1689, Article 50 — transparency obligations
- European Commission: guidelines on transparency obligations, 20 July 2026
- European Commission: FAQ on Article 50
- Regulation (EU) 2024/1689, Article 99 — penalties
- Regulation (EU) 2026/1744 — Digital Omnibus, published in the Official Journal
Checked on 26 July 2026.