EU AI Act Article 50, explained: who it affects and what it requires
If you run a chatbot, a virtual assistant, or any AI agent that talks to real people, there's a good chance a specific piece of EU law already applies to you: Article 50 of the EU AI Act. It's been enforceable since August 2, 2026, and the obligations it creates are narrower and more mechanical than most of the AI Act's headline-grabbing provisions, which is exactly why they're easy to miss.
This post covers what Article 50 actually requires, who it applies to, and the misconceptions that most often lead teams to assume, incorrectly, that it doesn't apply to them.
What Article 50 requires
Article 50 is a transparency obligation, not a safety or risk-classification rule like much of the rest of the AI Act. It boils down to three things:
Disclosure
People need to be told they're interacting with an AI system, unless it's obvious from context. A chatbot that answers support questions without ever making this clear is the central case the provision is written for. More detail: AI chatbot disclosure in the EU.
Content labeling
AI-generated content, text, images, audio, or video published or distributed, needs to be identifiable as AI-generated where the Act requires it. More detail: AI-generated content labeling in the EU.
Audit trail
A record of when disclosure happened and what was logged, so that compliance is demonstrable after the fact, not just asserted.
Who it applies to
If you operate a chatbot, virtual assistant, or AI agent that interacts with people, including one built on OpenAI, Anthropic, or Gemini, this obligation applies to you, regardless of company size. Building on top of someone else's model does not change that. Under Article 50(1), the duty sits with the provider of the AI system people interact with. If you put a chatbot into service under your own name, that is usually you, not the lab that trained the model.
If you build your own chatbot or agent and put it into service under your name, you are usually its provider, even if it runs on OpenAI, Anthropic or Gemini. If you embed a ready-made chatbot product from a vendor without substantially changing it, that vendor is typically the provider and carries the Article 50(1) duty, though you should confirm this in your contract. When in doubt, check with your counsel.
Who's responsible: provider or deployer
The AI Act draws a line between whoever builds a model (“provider”) and whoever puts it in front of end users under their own name (also a “provider”, for this purpose, even if they built nothing themselves; “deployer” is a separate role the Act uses for other Article 50 duties, like labeling AI-generated public content under Article 50(4)). Article 50(1)'s chatbot-disclosure duty sits with whoever puts the system into service under their own name or brand. In practice, that means the company whose brand the end user actually sees, not the company whose API is being called behind the scenes. If your product embeds a chatbot inside a customer's own site or app under their branding, your customer is typically that provider for that surface. The underlying system still needs to make disclosure and logging technically possible, since they can't comply with a tool that gives them no way to.
Article 50 vs. the AI Act's high-risk rules
A common source of confusion: the AI Act's high-risk provisions (Annex III), the ones covering things like biometric identification and employment-decision systems, don't take full effect until December 2027. That delay applies to a completely different, much narrower set of high-risk use cases. Article 50's transparency obligations, covering ordinary chatbots, content generation, and disclosure, are on their own, earlier timeline and have already been enforceable since 2 August 2026. Assuming the 2027 date buys you more time on disclosure and labeling is one of the more expensive misreadings of the Act we've seen teams make.
Two misconceptions worth clearing up
“We're too small for this to apply to us.”
Article 50 doesn't carve out an exception for company size or revenue. A two-person startup's chatbot is in scope on the same terms as an enterprise deployment.
“We just call the OpenAI/Anthropic/Gemini API, so this is their problem, not ours.”
The obligation follows deployment, not training. Whoever puts the system in front of end users is the one responsible for disclosure, labeling, and logging, regardless of whose model is doing the underlying generation.
What non-compliance costs
Penalties can reach €15M or 3% of global annual turnover, whichever is higher. That ceiling puts Article 50 in the same enforcement tier as GDPR, even though the underlying obligation is much smaller in scope.
What compliance actually looks like
In practice, the three obligations above translate into a small, mostly mechanical set of changes: a disclosure notice shown once per conversation, a label attached to generated content at the point it leaves your system, and a durable, timestamped log of both. None of it requires retraining a model or changing what your product does, it's infrastructure that sits alongside the AI calls you're already making.
That's the specific gap Disclarion is built to close: a Python SDK, n8n node, and REST API that add disclosure, content labeling, and an audit-ready log to an existing OpenAI, Anthropic, or Gemini integration in a few lines of code, rather than a compliance project.
This article is a plain-language summary, not legal advice. It doesn't replace a lawyer's review of your specific situation.
Check where you stand
If you're not sure whether your product currently discloses AI use or labels generated content, the fastest way to find out is to check it directly.
Want the practical, step-by-step version of this instead of the explainer? Our Article 50 compliance checklist walks through exactly what needs to be in place, section by section. For the sequence of work to actually get there, see our practical compliance guide.
More from the blog
Your internal AI tools owe the same disclosure duty the customer-facing one does
An HR bot or IT helpdesk assistant used only by your own staff still interacts with natural persons. Article 50 doesn't carve out an exception for "internal-only."
Does the EU AI Act apply if you're not based in the EU?
"We're a US company, we don't have an EU entity" isn't the exemption it sounds like. The actual test is about who's on the other end of the conversation, not your mailing address.
Why I built Disclarion as an SDK, not a dashboard
The easier product to build is a dashboard you configure after the fact. I built Disclarion to sit inside the AI call itself instead, and it's worth explaining why.
Deepfakes get a stricter rule than an AI-written blog post
Article 50(4)'s deepfake duty isn't the same obligation as ordinary AI content labeling — it applies to image, audio, and video specifically, and the built-in exemptions work differently too.
Your chatbot isn't the only thing that owes a disclosure under Article 50.
Article 50's disclosure duty doesn't stop at chatbots — emotion recognition and biometric categorization systems carry the same obligation, and they're the two system types teams miss most often.
You named it "AI Assistant." That's not the same thing as disclosing it.
A bot's name feels like disclosure. Article 50 cares whether a reasonable user actually understood they were talking to an AI — not whether a label existed somewhere on the page.
Your editor touched it. Article 50's label exemption still might not apply.
Article 50(4) waives the visible AI-content label when a human takes substantive editorial responsibility for a piece — but a quick skim doesn't qualify, and the exemption doesn't touch the audit-trail duty underneath it.
You labeled the article. That's not the same thing as marking it.
Article 50(2)'s machine-readable marking and Article 50(4)'s visible label are two different duties. Images already meet the first one by accident. Article text usually doesn't meet it at all.
Your AI answers the phone now. There's no modal for that.
Article 50's disclosure duty doesn't go away because there's no screen. What actually discloses an AI voice agent on a phone call, when a modal isn't an option.
An AI audit trail doesn't need to know what your users actually said.
Teams hear "audit trail" and picture a database of every conversation. Article 50's version is narrower: it has to prove disclosure and labeling happened, not repeat what was said.
Article 50 skips disclosure when it's "obvious from context." That word is doing more work than it looks like.
Disclosure isn't required when AI use is obvious from context, but Article 50 never defines obvious, and most of the cases teams assume qualify, don't.
Your chatbot needs to disclose it's an AI. Once, not every message.
Disclosing a chatbot is AI sounds simple until you build it: repeat it every message and people tune it out, show it once and later visitors never see it.
You have logs. That's not the same thing as an audit trail.
Under Article 50, an audit trail has to be insert-only, complete, and producible on demand, not a data-engineering project when a regulator actually asks.
Your AI-generated content needs a label. Here's what that actually means.
A disclaimer someone remembers to add isn't a labeling system. Under Article 50, AI-generated content needs to be identifiable as such, reliably, not as a manual step someone can forget.