Article 50 of the EU AI Act requires certain AI providers and deployers to help people recognise when they are interacting with AI or viewing AI-generated content. Most obligations apply from 2 August 2026. For an SMB chatbot, the practical starting point is a clear, timely AI notice, an escalation path to a person, and documented tests showing that the notice remains visible in every supported channel.
AI
Article 50 of the EU AI Act requires certain AI providers and deployers to help people recognise when they are interacting with AI or viewing AI-generated content. Most obligations apply from 2 August 2026. For an SMB chatbot, the practical starting point is a clear, timely AI notice, an escalation path to a person, and documented tests showing that the notice remains visible in every supported channel.
Scope and Effective Date
This article is educational information, not legal advice. Article 50 depends on where and how a system is used, the business’s role, its outputs, and applicable exceptions. Obtain legal advice for the specific deployment.
The European Commission’s Article 50 guidance states that the transparency obligations apply from 2 August 2026. The original AI Act text separates several cases:
1. Providers of systems intended to interact directly with natural persons must design them so people are informed they are interacting with AI, unless that is obvious to a reasonably well-informed, observant, and circumspect person in the circumstances.
2. Providers of systems that generate synthetic audio, image, video, or text content must support machine-readable marking and detection, subject to the Act’s scope and exceptions.
3. Deployers of emotion-recognition or biometric-categorisation systems have specific notice duties.
4. Deployers publishing deepfakes or certain AI-generated public-interest text have labelling duties, with qualifications for artistic, satirical, editorial, and human-reviewed material.
The 2026 AI Omnibus did not create a general delay for Article 50. It added a limited transition: providers of generative systems placed on the market before 2 August 2026 have until 2 December 2026 to take the necessary steps to comply with Article 50(2). That exception concerns the marking and detection obligation, not every Article 50 duty. The controlling source is Regulation (EU) 2026/1744.
Decide Which Article 50 Role You Have
Do not begin with the wording of a banner. Begin with the business’s role.
Case 1: You provide the chatbot
A company may be a provider when it develops an AI system, has one developed, and places it on the market or puts it into service under its name or trademark. Buying an API does not automatically make the buyer only a deployer.
For a customer-facing chatbot, the central control is that the interface informs the user that it is AI. The notice should appear before or at the start of the interaction, not after the user has already disclosed information.
Case 2: You deploy a third-party chatbot
A deployer uses an AI system under its authority, except for personal non-professional use. If the vendor controls the underlying design while the SMB configures and operates the assistant, the SMB will often have deployer responsibilities and contractual dependencies on the provider.
Ask the vendor for evidence that the system supports required notices and provenance features. The SMB remains responsible for its presentation and use of generated material.
Case 3: You publish generated content
Generated-content duties depend on format and use. The Commission’s transparency quick facts distinguish provider-side machine-readable marking from deployer-side visible labelling.
Create a content matrix instead of applying an indiscriminate “made with AI” label to everything. Record:
• Content format: text, audio, image, or video.
• Whether a real person, object, place, entity, or event is represented as authentic.
• Whether the subject is a matter of public interest.
• Whether a person performed substantive editorial review.
• Whether the underlying system supplies a machine-readable provenance signal.
• Which exception or qualification the business relies on.
A Practical Disclosure Control Framework
Use four controls: identify, inform, preserve, and verify.
1. Identify the AI touchpoint
Inventory every place a person may interact with the assistant: website widget, support portal, WhatsApp, email responder, voice line, in-product assistant, or embedded partner channel. Screenshots of the main website are not enough if the same workflow appears without disclosure in another channel.
2. Inform at the right moment
Recommended practice is to disclose before the person provides substantive information. Use direct language such as:
You are chatting with an AI assistant. It can answer routine questions and create a request for our team.
Avoid vague labels such as “digital experience” or a robot icon without text. The exact legal standard depends on whether AI interaction would already be obvious, but explicit wording is easier to test and defend.
The disclosure should remain understandable on mobile, in a screen reader, and after the chat is reopened. If the assistant transfers a conversation to a person, identify that transition as well.
3. Preserve provenance and editorial records
Where generated content may fall within Article 50, retain available provenance metadata. Do not strip a provider’s machine-readable marking during compression, export, or CMS processing without understanding the consequence.
For public-interest text, retain evidence of human review: reviewer identity, date, source checks, material edits, and final approval. A name attached to an article is not evidence of meaningful review by itself.
4. Verify the complete experience
Test the disclosure as a control:
• New visitor and returning visitor.
• Desktop and mobile.
• All supported languages.
• Keyboard and screen-reader navigation.
• Embedded and pop-out chatbot states.
• Logged-in and logged-out states.
• Every acquisition source that opens the chat directly.
Re-run the tests after widget, consent-manager, CMS, or model-provider changes.
Implementation Steps for an SMB
Step 1: Assign an owner
Name one business owner and one technical owner. Marketing or customer success may own the language; the website or automation owner controls implementation.
Step 2: Create an Article 50 inventory
For each system, document the provider, deployer, intended users, countries served, output formats, content use, and disclosure location. Add the contract and provider documentation.
Step 3: Approve standard language
Prepare separate language for:
• Direct chatbot interaction.
• AI-assisted voice interaction.
• Deepfake or synthetic-media labelling.
• Public-interest text where a label is required.
• Human handoff.
Legal review should address the actual system and audience, not only the generic copy.
Step 4: Configure technical controls
Make the notice part of the workflow’s required state, not removable marketing text. Preserve provenance metadata where available. Block publication if a required label or review record is absent.
Step 5: Test and capture evidence
Record the test date, environment, device, result, screenshots, accessibility checks, and reviewer. Open defects for missing or late notices.
Step 6: Monitor changes
Review Article 50 controls when the business changes its provider, model, channels, output type, or intended audience. Subscribe to Commission and national authority updates rather than relying on an old launch memo.
Evidence and Artifacts to Retain
An SMB evidence pack can be compact:
• AI-system and channel inventory.
• Role assessment: provider, deployer, importer, or distributor where relevant.
• Approved disclosure and label library.
• Screenshots and accessibility test results.
• Provider documentation for machine-readable marking.
• Content review and approval records.
• Change log for chatbot and publishing workflows.
• Training record for staff who configure or publish through the system.
• Incident log covering missed notices or removed provenance.
These are recommended operational artifacts. Article 50 defines outcomes and duties; it does not prescribe this exact folder structure.
Common Failure Modes
Disclosure appears only in terms and conditions. A buried legal notice does not inform a person at the interaction point.
The icon disappears on mobile. A desktop review misses the channel where most users interact.
The business assumes the vendor handles everything. Provider-side capabilities do not determine how the deployer presents the experience.
All AI-assisted text is treated as unreviewed. This creates unnecessary labels and obscures the distinction between AI assistance and publication without human editorial control.
A reviewer clicks approve without checking sources. The evidence should show substantive human review where the business relies on that fact.
Image optimisation removes provenance. CMS and social-media processing can change or remove embedded metadata.
The business quotes the December date as a universal extension. The 2 December 2026 transition is limited to Article 50(2) systems already placed on the market before 2 August 2026.
SMB Article 50 Checklist
• [ ] Inventory every customer-facing AI interaction.
• [ ] Record whether the company is provider, deployer, or both.
• [ ] Confirm which Article 50 paragraph is relevant.
• [ ] Display an understandable notice at the start of AI interaction.
• [ ] Provide a practical route to human assistance.
• [ ] Test notices on mobile, desktop, and assistive technology.
• [ ] Classify generated content by format and intended use.
• [ ] Preserve machine-readable marking where required and available.
• [ ] Record substantive editorial review of relevant public-interest text.
• [ ] Add disclosure checks to release acceptance criteria.
• [ ] Review provider contracts and technical documentation.
• [ ] Reassess after model, channel, audience, or workflow changes.
For the broader permissions, approval, and rollback layer, use the AI agent governance guide.
FAQs
Does every chatbot need an AI disclosure?
Article 50 covers systems intended to interact directly with natural persons, but includes an exception where the AI interaction is obvious to a reasonably well-informed, observant, and circumspect person in context. Explicit notice is generally the easier control to operate, but applicability should be reviewed for the specific system.
When do Article 50 chatbot rules apply?
The Commission states that Article 50 transparency obligations apply from 2 August 2026. The Omnibus transition to 2 December 2026 is limited to Article 50(2) marking requirements for certain systems placed on the market before 2 August.
Is a robot icon enough?
Do not assume so. A short text notice is easier to understand, translate, test, and preserve across channels. Accessibility and the timing of the notice also matter.
Must every AI-assisted article be labelled?
No universal rule says every AI-assisted article must carry the same label. Article 50 distinguishes generated or manipulated content, public-interest text, human editorial review, deepfakes, provider marking, and deployer labelling. Review the facts and current guidance.
Who is responsible when an SMB uses a third-party chatbot?
The provider may control system-level design, while the SMB deployer controls configuration and presentation. Contracts should allocate support and evidence, but they do not automatically remove statutory responsibilities.
Get a 20-Minute AI Workflow Audit
AI Operator can map one customer-facing AI workflow, identify missing disclosure states, and turn the result into testable implementation requirements.