The AI Act's chatbot rule is live. It may not be yours
Since 2 August 2026 the EU AI Act has required AI systems that talk to people to say they are AI. Most of the advice written since tells every business with a chat widget to go and add a disclosure line. That advice is pointed at the wrong people, because the duty in Article 50(1) sits with the provider of the system rather than with everyone who embeds one. The line between the two is drawn by who built the thing and whose name is on it. Do you know which side of it your contact page sits on?
The text, and the date it started
Here is the whole obligation, verbatim from the consolidated Regulation on EUR-Lex. Article 50(1): "Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use." Two things in that sentence do most of the work. The first word is Providers. The last clause is an exemption that reads generously until you see how the Commission reads it.
The date is not in doubt. Article 113 still says the Regulation "shall apply from 2 August 2026", and the Commission's own guidelines repeat it. Plenty of commentary this summer suggested the Digital Omnibus had pushed transparency back. It did not. The Omnibus is real and in force as Regulation (EU) 2026/1744, effective 27 July 2026, and it amends dozens of provisions, but inside Article 50 it replaced paragraph 7 and nothing else. Paragraph 7 is about codes of practice. What the Omnibus did delay is the high-risk regime, out to 2 December 2027 and 2 August 2028. Transparency is already enforceable, and has been since the day it applied.
Timing within the interaction is fixed too. Article 50(5) requires the information to be given "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure". Not on page three of the terms. Before or at the first message.
The exemption is where most people get comfortable, and it is narrower than it looks. Less than two weeks before the rules applied, the Commission published 51 pages of guidelines saying the "obviousness" exception "should be limited to cases where there is almost no doubt left about the nature of the interaction for an average person from the targeted and reasonably foreseeable audience". The same paragraph closes the loophole everyone reaches for: "The general awareness of consumers and other natural persons that AI systems (including chatbots and agents) exist does not imply that they recognise them in interactions." And the Commission's list of cases where the exemption is unavailable names helpdesk chatbots and assistance support tools embedded in websites. If yours is public-facing, assume the exemption is gone.
Provider or deployer, in three questions
The AI Act splits every operator into providers and deployers, and it gives them different duties. Article 50(1) and 50(2) land on providers. Deployers get 50(3) on emotion recognition and biometric categorisation, and 50(4) on deepfakes and published text of public interest. A business that pays a vendor for a chat widget, styles it and drops it on the contact page is a deployer, and Article 50(1) does not reach it at all.
You become a provider by building or by rebranding. The Commission's example of a provider is "a company or another organisation (e.g. a public authority) that has developed an interactive AI system (e.g. chatbot) in-house and puts it into service in the Union for its own use and under its name or trademark". The same section adds the modification route: if you take an existing generative system, change it with new training data and then put it out under your own name or trade mark, you are the provider of the new system. Three questions settle it.
Landing on question three is not the end of it. Article 50(1) is a design duty, so a vendor who ignored it hands you a widget that opens on your site, in your brand, with no disclosure, in front of your customers. The regulator's letter would go to the vendor. The bad first impression is yours, and so is the complaint, because any affected person "or any other natural or legal person having grounds to consider such violations" can lodge one under the guidelines at paragraph 151, which means a competitor or an annoyed customer can start the process without any regulator going looking.
In scope, out of scope
The guidelines also deflate the panic about AI-written content. Ordinary marketing copy is out. The Commission's list of text falling outside Article 50(4) includes "AI-manipulated text that is part of a company's advertisement or product descriptions (not including any claims related to e.g. health, consumer safety or sustainability)". Your AI-drafted product blurb needs no label. Your unreviewed article about an EU policy does.
| What is on your site | Where Article 50 puts it |
|---|---|
| A public-facing support chatbot you built or rebranded | In scope of 50(1). The Commission names website helpdesk chatbots as a case where the obviousness exemption does not apply. |
| A vendor's chatbot widget you embedded and configured | You are a deployer. 50(1) is the vendor's duty. Verify it, because the page is still yours. |
| An internal assistant for trained staff (HR, legal, IT support) | Out. Listed by the Commission as an obviousness case where the duty does not apply. |
| AI-written marketing copy and product descriptions | Out of 50(4), unless the text carries health, consumer-safety or sustainability claims. |
| AI-written articles on matters of public interest, published without real human review | In scope of 50(4). Labelling required. |
| A generative system already on the market before 2 August 2026 | Six extra months for the 50(2) machine-readable marking duty only, running to 2 December 2026. |
That last row is the most misquoted date in this whole area. The 2 December 2026 deadline arrived as a new Article 111(4) inserted by the Omnibus, and it covers the machine-readable marking of generated output for systems already on the market. It is not a grace period for chatbot disclosure. The Commission says so at paragraph 153: a system that is partly interactive and partly generative gets the extension "only with regard to the marking obligation under Article 50(2) AI Act, while compliance with the disclosure obligation for AI systems directly interacting with natural persons must be ensured as of 2 August 2026".
The human-review escape hatch for published text is real but demanding. Fact-checking is "a minimum requirement that should be part of that review", and the guidelines rule out spell-checking, the mere existence of an editorial policy, automated review, and one AI reviewing another. You also have to publish who holds editorial responsibility, in "an easily findable location". If you run an AI-assisted blog covering economic, scientific, health or consumer topics, that is a named editor and a real fact-check, or a label.
If you do owe a disclosure, the guidelines are unusually specific about what fails. A generic site-wide line such as "Services on this website use AI" is insufficient. So is a disclosure "contained only in terms and conditions, URLs, or documentation", a machine-readable watermark the user cannot perceive, a vague reference to an "assistant", and a statement that only names the technology, such as "this system uses LLMs". What works is plain and visible: a first-turn greeting saying the user is talking to an AI system, or a persistent label next to the input box, in the words the Commission itself suggests, "You are interacting with an AI system". A single prominent notice before the first interaction is usually enough. Higher-stakes contexts, including financial, insurance, legal and health advice, complaints handling and anything aimed at vulnerable users, need repeating.
What a breach can cost
Article 50 is named explicitly in the penalty list. Article 99(4) sets fines of up to EUR 15,000,000 or 3% of total worldwide annual turnover, whichever is higher, for the breaches listed at points (a) to (g), and point (g) reads "transparency obligations for providers and deployers pursuant to Article 50". For small and medium enterprises the arithmetic flips: Article 99(6) caps the fine at whichever of the two figures is lower, so a small Irish company is exposed to 3% of its turnover rather than to a headline number designed for a hyperscaler.
Treat that as a ceiling and not a forecast. Article 99(7) makes the authority weigh the gravity and duration of the breach, the size of the operator and its cooperation, and in Ireland the fine is set by an adjudicator under section 105 of the Regulation of Artificial Intelligence Act 2026, with public bodies capped at EUR 1,000,000. Nobody is going to fine a Galway physiotherapy clinic fifteen million euro for an unlabelled chat bubble. The number that matters to a small business is 3%, and the realistic risk is a complaint, an information request and the cost of answering it.
Ireland moved further than the commentary did
Most of what you will read about Irish enforcement predates the Irish law. There is now a national statute: the Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026), commenced on 31 July 2026, which fixed the same day as the establishment day for Oifig IS na hÉireann, the national AI office. On that day the designation regulations were amended too.
The amendment is narrower than its reporting, which usually lands as "Coimisiún na Meán now polices AI chatbots". S.I. No. 405/2026 designates Coimisiún na Meán as the market surveillance authority for Article 50 only where the provider or deployer is an intermediary service, an audiovisual media service, a sound broadcasting service, a relevant designated online service or a hosting service. A hotel, a clinic or an accountancy firm with a support chatbot is none of those five things. The general Article 70(1) designation, and therefore the authority for an ordinary business website, is Oifig IS na hÉireann. Counting the instrument as amended, Ireland has designated fourteen bodies as market surveillance authorities, with the Minister for Enterprise, Tourism and Employment as the single point of contact.
How many Irish businesses this actually touches is harder to say than the headlines suggest, because no official statistic counts chatbots. The CSO measures how many firms use AI at all, and nothing about what they put on their websites. In 2025, 20.2% of Irish enterprises used AI technologies in some capacity, and the nearest published proxy for chat and generated copy is natural language generation at 9.3%. Treat that as a proxy and nothing more. Eurostat, counting separately, puts the EU-wide figure close to it, at 19.95% of enterprises using AI in 2025.
The gap between 17.2% of small Irish enterprises and 57.7% of large ones is the story behind the compliance advice. The businesses being told to audit their AI estate are mostly the ones that have one. The small firm with a single embedded widget has a much shorter job, and it starts with a question about procurement rather than about law. Brussels has had a busy season with websites either way; we wrote recently about the EU deciding ChatGPT counts as a search engine.
What you actually do
1. Answer the three questions. Built it, modified and rebranded it, or embedded it. That single answer decides whether Article 50(1) is your duty or your supplier's, and everything else follows from it. Write the answer down somewhere a colleague can find it, because the next person asked will otherwise guess.
2. If you are the provider, put the disclosure where it is seen. A first-turn greeting that says the user is talking to an AI system, or a persistent label beside the input field, in plain language, at or before the first message. Terms and conditions do not carry it, metadata does not carry it, and a site-wide footer line does not carry it.
3. If you are the deployer, ask your vendor in writing. What have they done for Article 50(1), what does the widget say on first open, and have they signed the Code of Practice on Transparency of AI-Generated Content? About 190 organisations had signed it before the obligations applied, including OpenAI, Google, Meta, Microsoft, Anthropic and Mistral. Signing is voluntary and the Code is not law, but the Commission expects non-signatories to run a gap analysis against it and to answer more questions. A vendor who cannot answer yours has told you something.
4. Then look at the page itself. Every one of these obligations resolves in rendered HTML: what the widget prints on first open, whether the label survives on mobile, whether any AI-generated block carries a marking, whether your editorial owner is published somewhere findable. A policy document cannot tell you that. Open the page as a stranger would, or run a technical audit that reads what actually ships. We use the same audit as the first step of any AI-visibility work, for the reasons set out in the state of GEO in 2026.
Questions people ask about this
Sources: EUR-Lex consolidated Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744, the European Commission's Guidelines on the implementation of the transparency obligations under Article 50 (C(2026) 5054 final) and its AI Act Service Desk timeline and resources pages, the EU AI Office Code of Practice on Transparency of AI-Generated Content, the Irish Statute Book (S.I. No. 403/2026, S.I. No. 405/2026 and the Regulation of Artificial Intelligence Act 2026), the Central Statistics Office, and Eurostat. All primary sources, read on 8 September 2026.
