AI Chatbot Disclosure in the EU: What Article 50 Actually Requires
If a chatbot on your site talks to EU users, AI chatbot disclosure isn't optional guidance — it's a legal requirement under Article 50 of the EU AI Act, enforceable since 2 August 2026. The rule itself is short: people need to know they're talking to an AI system, unless that's already obvious from context. Implementing it correctly, in a way that would actually hold up if someone checked, is where most teams go wrong.
When disclosure is required
The obligation applies to any chatbot, virtual assistant, or conversational AI system that interacts directly with a person — support widgets, sales bots, in-app assistants, voice agents. It doesn't matter whether you built the underlying model or you're calling OpenAI, Anthropic, or Gemini through an API: under Article 50(1), the duty sits with the provider of the system people interact with, which in practice means whoever puts it in front of users under their own name, not whoever trained the model behind it.
If you build your own chatbot or agent and put it into service under your name, you are usually its provider, even if it runs on OpenAI, Anthropic or Gemini. If you embed a ready-made chatbot product from a vendor without substantially changing it, that vendor is typically the provider and carries the Article 50(1) duty, though you should confirm this in your contract. When in doubt, check with your counsel.
There's a narrow exception for cases where AI use is “obvious from context” — a page whose entire premise is testing an AI model, for instance. A support widget with a human name and a friendly tone on a page selling a product is the far more common case, and it doesn't clear that bar just because the team building it already knew it was a language model.
What counts as compliant disclosure
- Shown before or at the first interaction — not buried three clicks deep in a terms-of-service page the user never opens.
- Clear and distinguishable — a notice a person actually registers, not text styled to blend into the background.
- Accessible — readable by assistive technology, not conveyed only through a visual icon or color.
- Appropriate for session length — a single flash on page load that's gone before the conversation starts doesn't serve the same function as a notice shown when the conversation actually begins.
The two disclosure patterns that actually work
In practice, two approaches satisfy the rule without annoying users into ignoring it entirely:
Modal once, then a persistent badge
A non-dismissable notice on the first message of a session, then a small, always-visible badge for the rest of that session. Said once clearly, never repeated into wallpaper, and a new session gets the full notice again.
Inline disclosure in the first reply
The AI's first response includes a disclosure line directly in the text. Simpler to implement, but it means every first reply is partly a fixed string rather than pure model output — most teams outgrow this pattern once they want more control over tone.
What doesn't hold up: a banner shown once on page load before any conversation exists, a disclosure only visible in a help center article, or a repeated disclaimer appended to every single message — which people learn to stop reading within the first few replies, defeating its purpose.
Disclosure is not the same as an audit trail
Showing a disclosure notice and being able to prove you showed it are two different things. If a regulator or a customer ever asks, “we designed it to show a notice” is a weaker answer than a backend record — timestamp, session ID, which provider handled the interaction — tied to the specific conversation. That record doesn't need to store what was actually said; the fact that disclosure happened, and when, is what the obligation is checking for.
How Disclarion handles this
Disclarion's SDK implements the modal-once-then-badge pattern by default across OpenAI, Anthropic, and Gemini, as a reference widget your frontend renders — not text your model is forced to say. Every disclosure event is logged to an insert-only backend record alongside the interaction it describes, so the evidence exists whether or not anyone ever asks for it.
Frequently asked questions
Does a small chatbot on a niche site really need to comply?
Yes. Article 50 doesn't exempt by company size, traffic, or how simple the bot is — if it interacts with EU users and isn't obviously an AI system from context, disclosure is required.
Can I just put 'AI Assistant' in the chatbot's name?
A name alone is weak evidence. What matters is whether a reasonable user actually understood they were talking to an AI, not whether a label existed somewhere on the page.
Do I need consent, or just disclosure?
Article 50 requires disclosure — telling the user — not opt-in consent. The user doesn't have to agree to talk to an AI, they just have to be told before or as it happens.
What if my chatbot is white-labeled inside a customer's product?
Under Article 50(1), the duty sits with the provider of the AI system people interact with, meaning whoever puts it into service under their own name. If your customer's brand is what the end user sees, that's usually your customer, not you. The underlying AI system still needs to make that disclosure technically possible.