Your internal AI tools owe the same disclosure duty the customer-facing one does
Almost every Article 50 conversation I have starts with the customer-facing surface: the support widget, the sales chatbot, the voice agent on the contact line. Fewer teams stop to ask about the AI tool that shipped internally last quarter — the HR bot answering benefits questions, the IT helpdesk assistant triaging tickets, the internal copilot drafting replies for the sales team. The quiet assumption is that “internal” means “exempt.” It doesn't, and the reason is in the text itself.
Article 50's disclosure duty attaches to AI systems intended to interact directly with natural persons, unless it's obvious from context. Nothing in that sentence filters for who the natural person is. An employee opening a chat window to ask the internal HR bot about parental leave is still a natural person interacting with an AI system, in exactly the sense the Act is written to catch. The obligation was never keyed to “customer” — it was keyed to “person on the other end of the conversation,” and an employee qualifies on the same terms a customer does.
This is the same shape of mistake as the two misconceptions covered in the main Article 50 explainer: “we're too small” doesn't work as an exemption, and “we just call someone else's model” doesn't either. “Our audience is internal” is a third version of the same error — reaching for a boundary the Act never actually drew.
Where this shows up in practice, in roughly descending order of how often teams miss it:
- An HR or benefits chatbot that answers employee questions about leave, payroll, or policy — built once, pointed at an internal wiki, and never put through the same review as the public chatbot because nobody outside the company will ever see it.
- An internal IT helpdesk assistant that triages tickets or walks staff through a password reset. It talks to employees directly, in real time, which is the exact pattern Article 50 is written around — the fact that it never leaves the corporate network doesn't change that.
- A sales-enablement copilot that drafts or suggests replies for a rep. If the rep is the one interacting with it — asking it questions, getting suggestions back — the rep is the natural person on the other end, even though the tool's output is ultimately meant for a customer.
There's a real boundary here, and it's worth being precise about it rather than over-claiming. A system with no interactive, conversational interface at all — a batch model scoring leads overnight, an internal recommendation algorithm ranking tickets by priority, something nobody actually talks to — doesn't fall under this specific disclosure duty, because there's no direct interaction with a natural person for it to attach to. That's a genuinely different case from the three above, not a loophole that covers them. The moment the system has a chat window, a voice line, or anything a person is meant to address questions to, it's back in scope.
The stakes are the same stakes, too. There's no separate, smaller penalty tier for getting this wrong internally — it's the same ceiling as everything else under Article 50, up to €15M or 3% of global annual turnover under Article 99(4)(g). An EU-based workforce using an undisclosed internal AI tool is exposure a company carries the same way it carries exposure from its public chatbot, just in a place compliance reviews don't usually think to look.
This is also why Disclarion's SDK doesn't have a notion of “internal” traffic to begin with. dc.track(reply, session_id=session.id) logs the interaction the same way whether the session belongs to a customer on your marketing site or an employee on your intranet, because the obligation it's built against doesn't distinguish between the two either.
For what counts as compliant disclosure once you've confirmed a tool is in scope, see AI chatbot disclosure in the EU. For the full list of system types the duty covers beyond ordinary chatbots, see AI disclosure requirements in the EU.
More from the blog
Does the EU AI Act apply if you're not based in the EU?
"We're a US company, we don't have an EU entity" isn't the exemption it sounds like. The actual test is about who's on the other end of the conversation, not your mailing address.
Why I built Disclarion as an SDK, not a dashboard
The easier product to build is a dashboard you configure after the fact. I built Disclarion to sit inside the AI call itself instead, and it's worth explaining why.
Deepfakes get a stricter rule than an AI-written blog post
Article 50(4)'s deepfake duty isn't the same obligation as ordinary AI content labeling — it applies to image, audio, and video specifically, and the built-in exemptions work differently too.
Your chatbot isn't the only thing that owes a disclosure under Article 50.
Article 50's disclosure duty doesn't stop at chatbots — emotion recognition and biometric categorization systems carry the same obligation, and they're the two system types teams miss most often.
You named it "AI Assistant." That's not the same thing as disclosing it.
A bot's name feels like disclosure. Article 50 cares whether a reasonable user actually understood they were talking to an AI — not whether a label existed somewhere on the page.
Your editor touched it. Article 50's label exemption still might not apply.
Article 50(4) waives the visible AI-content label when a human takes substantive editorial responsibility for a piece — but a quick skim doesn't qualify, and the exemption doesn't touch the audit-trail duty underneath it.
You labeled the article. That's not the same thing as marking it.
Article 50(2)'s machine-readable marking and Article 50(4)'s visible label are two different duties. Images already meet the first one by accident. Article text usually doesn't meet it at all.
Your AI answers the phone now. There's no modal for that.
Article 50's disclosure duty doesn't go away because there's no screen. What actually discloses an AI voice agent on a phone call, when a modal isn't an option.
An AI audit trail doesn't need to know what your users actually said.
Teams hear "audit trail" and picture a database of every conversation. Article 50's version is narrower: it has to prove disclosure and labeling happened, not repeat what was said.
Article 50 skips disclosure when it's "obvious from context." That word is doing more work than it looks like.
Disclosure isn't required when AI use is obvious from context, but Article 50 never defines obvious, and most of the cases teams assume qualify, don't.
Your chatbot needs to disclose it's an AI. Once, not every message.
Disclosing a chatbot is AI sounds simple until you build it: repeat it every message and people tune it out, show it once and later visitors never see it.
You have logs. That's not the same thing as an audit trail.
Under Article 50, an audit trail has to be insert-only, complete, and producible on demand, not a data-engineering project when a regulator actually asks.
Your AI-generated content needs a label. Here's what that actually means.
A disclaimer someone remembers to add isn't a labeling system. Under Article 50, AI-generated content needs to be identifiable as such, reliably, not as a manual step someone can forget.
EU AI Act Article 50, explained: who it affects and what it requires
Article 50 of the EU AI Act has been enforceable since August 2, 2026: who it applies to, its three obligations, and the penalties for getting it wrong.