In short

Since 2 August 2026, an AI system that talks to people in the EU has to tell them they are dealing with AI, unless that is obvious. The rule is Article 50(1) of the AI Act, and the July 2026 Digital Omnibus did not postpone it. The disclosure must be clear and distinguishable and come no later than the first interaction.

Where your company is registered does not matter. A support bot run from Kazakhstan, Georgia or Israel that answers customers in the EU is covered, because the Act applies to non-EU providers and deployers whenever the system's output is used in the Union. Breaching Article 50 can cost up to €15 million or 3% of worldwide annual turnover, whichever is higher; for SMEs and small mid-caps it is whichever is lower.

This article sets out what Article 50 asks, who carries each duty when an agency builds a bot on GPT or Claude for a brand, and what we put into every bot by default.

The timeline after the Digital Omnibus

The AI Act (Regulation (EU) 2024/1689) applies in stages. Prohibitions and the AI literacy duty in Article 4 have applied since 2 February 2025; Article 50 since 2 August 2026.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published on 24 July 2026 and entered into force three days later. For a chatbot owner it changed four things:

  • High-risk obligations moved: to 2 December 2027 for Annex III systems (hiring, credit scoring, access to essential services) and 2 August 2028 for Annex I products.
  • Article 50(2) marking got a short grace period: providers of systems placed on the market before 2 August 2026 have until 2 December 2026 to add machine-readable marking.
  • Article 4 was softened: providers and deployers must take measures to support AI literacy, without guaranteeing any particular level for each employee.
  • Codes of practice under Article 50(7) are now facilitated and assessed by the Commission, which can adopt an implementing act if a code falls short.

The disclosure duty in Article 50(1) was left alone. A bot that went live in September without saying it is AI is already out of line.

What Article 50 requires

Paragraph Who Obligation
50(1) Provider Systems that interact directly with people inform them they are interacting with AI, unless obvious to a reasonably well-informed, observant person
50(2) Provider Synthetic audio, image, video and text outputs are marked in a machine-readable format and detectable as AI-generated
50(3) Deployer People exposed to emotion recognition or biometric categorisation are informed
50(4) Deployer Deepfakes are disclosed; AI-generated text published to inform the public on matters of public interest is disclosed unless it went through human editorial review
50(5) Both Information is clear and distinguishable, given at the latest at first interaction or exposure, and accessible

Recital 132 adds that the disclosure should take into account people who may find it harder to tell, because of age or disability. The Commission's guidelines on transparency obligations, published on 20 July 2026, explain how the article applies to directly interactive systems such as chatbots.

We do not lean on the "obvious" exception. A bot with a human first name, a natural tone and a WhatsApp number shared with real sales staff is not obviously a machine to the person messaging it.

Provider or deployer: who owns the disclosure

Article 3 defines the roles:

  • A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, paid or free.
  • A deployer uses an AI system under its authority in a professional context.

Three common set-ups:

A brand commissions a bot from a developer. An online retailer has us build a support agent that runs on its website under its brand for customers in Poland. The retailer has had the system developed and puts it into service under its own name, so it is normally the provider, and also the deployer. We are the contractor and owe the retailer a system that technically meets the requirements; that belongs in the statement of work.

A vendor sells an AI product. If we shipped a ready-made support product under our own brand and retailers plugged it in, we would be the provider and the retailers deployers.

The model makers. OpenAI, Anthropic and Google are providers of general-purpose AI models with their own duties under Chapter V. They are not responsible for whether your bot introduces itself; the model has no idea where or under what name you deployed it.

One frequent mistake: citing Article 25, under which a deployer who puts its name on a system becomes its provider. Article 25 applies to high-risk systems only. For an ordinary support bot, provider status follows from the Article 3 definition itself.

How to disclose, channel by channel

  • Website chat and messengers. The first bot message says it is an AI assistant, in the user's language, and the chat header carries a persistent "AI assistant" label. A user returning a week later starts a new interaction and should see it again.
  • Outbound WhatsApp templates. When the bot writes first (appointment reminder, order status), the disclosure goes into that first message, not after the customer replies.
  • Voice agents. Say it in the first seconds of the call. Synthetic voice is also synthetic audio under 50(2), so it needs machine-readable marking.
  • Human handoff. When a staff member takes over, the conversation shows it, and the label returns if the conversation goes back to the bot.
  • Every language the bot speaks. A bot for Romanian customers needs Romanian and English disclosure; for Latvia, Latvian, Russian and English.

The mechanics of such agents are covered in how AI answers customers in WhatsApp and AI agent vs chatbot vs workflow.

Machine-readable marking and chatbot text

Article 50(2) covers synthetic text as well as images, audio and video, with an exception for assistive standard editing that does not substantially change the input. On 10 June 2026 the Commission published the final Code of Practice on marking and labelling of AI-generated content, and the Commission and the AI Board have since confirmed it as an adequate voluntary tool.

How the code maps onto a support bot's short text replies is still settling in practice. Our default: generated images and voice come from models and services that apply marking, and our pipeline never strips it; text outputs carry an AI-generated flag in API responses and logs; the final format for each project follows the code.

What we build into every bot

For any project with users in the EU, these come as standard, not as an add-on:

  1. Disclosure in the first message in every supported language, plus a persistent label in the interface.
  2. Human handoff on request and by rule: complaints, refunds, health and legal questions. The switch is visible to the user.
  3. Logs of every conversation with prompt and model versions, so the answer to "what did the bot tell this customer on 12 September" exists.
  4. No decisions on people's rights without a human. The bot can collect a refund request; a person approves it.
  5. A high-risk screen before we start. Candidate screening, credit scoring and access to services fall under Annex III, with obligations from December 2027; better to design for them now.
  6. System documentation: what the bot does, which data it uses, who is provider and who is deployer.
  7. Disclosure evals: "Are you a robot?", "Get me a human", first contact in each language, all in the eval set.

What stays with the client: deciding whose name the system runs under, AI literacy for staff, labelling AI-written content it publishes to the public, and answering regulators.

For a working example of an agent with clean handoff, see the Almaty Marathon support agent, which resolves nine of ten conversations and passes the rest to staff. If you are planning a bot for EU customers, start with AI agents or AI support automation. The other half of compliance, sending customer conversations to OpenAI or Anthropic, is covered in sending customer personal data to ChatGPT and Claude.

FAQ

Yes, when the output of the AI system is used in the EU. A chatbot answering customers in the Union falls under Article 50 wherever the company is registered and wherever its servers are. A bot that serves only customers outside the EU is not covered.

No. Article 50(5) requires the information to be clear and distinguishable and given no later than the first interaction. A clause nobody reads does not meet that; a bot message or a visible label in the chat window does.

The 50(1) duty sits with the provider, the party under whose name the system is put into service. For a bot running under the client's brand that is usually the client. The developer answers to the client under contract, so the requirement belongs in the specification.

Not for disclosure: it applies to every bot from 2 August 2026. The only transition is for machine-readable marking under 50(2), which systems already on the market must add by 2 December 2026.

Up to €15 million or 3% of total worldwide annual turnover, whichever is higher. SMEs, and since the Omnibus also small mid-caps, pay whichever is lower. National market surveillance authorities enforce it.

Sources