Why I built Disclarion as an SDK, not a dashboard
A question I get a version of often, usually from someone who's just read the Article 50 requirements for the first time: why does this need to be a library I install, instead of a dashboard I log into and configure? It's a fair question, and the honest answer isn't “because SDKs are more impressive.” It's that the dashboard version of this product has a structural problem, and I only really understood it by trying to build the other thing first.
The dashboard version looks simple from the outside: connect your chatbot, point us at your conversation logs, we'll handle disclosure and record-keeping from there. The problem is everything in that sentence happens after the actual interaction already occurred. A disclosure shown after the fact isn't a disclosure, it's a notice about one that should have been there. A content label applied in a second pass can drift out of sync with whatever the model actually said, especially the moment someone edits a prompt template and forgets to update the labeling config to match. And an audit log built from imported conversation exports is only as complete as whoever remembered to export them that week.
So Disclarion wraps the call instead of watching it from outside. dc.track(reply, session_id=session.id) sits in the same line of code that already sends the model's reply back to your user, and it hands back disclarion_meta synchronously, including whether this is the first message of the session, which is what your frontend uses to decide whether to show the disclosure notice right then. There's no separate ingestion step where logs get uploaded later, because there's no later: the record is written at the moment the interaction happens, by the same call that's already there.
One detail I'm a little proud of, because it took longer to get right than it should have: the SDK itself doesn't remember whether a session has already been disclosed to. That's deliberate. If the SDK kept that state in memory, it would be wrong the moment your app runs behind more than one worker process, which is most production deployments past a certain size, someone's first message could hit worker A and get the notice, their second message could hit worker B and get it again. The “is this the first message” check runs against the backend instead, so it's correct regardless of how many processes are actually running your app. Boring infrastructure decision, but it's the kind of thing that only shows up as a bug in someone else's production traffic if you get it wrong, so I'd rather mention it than have someone discover it the hard way.
Content labeling works on the same principle, at the source rather than after the fact. track_content() doesn't generate a label and hope someone attaches it correctly downstream, it returns one, already built: a watermark baked into an image's actual pixel data if you pass it image bytes, or a positioned HTML snippet for text, both the moment the content leaves your system. I'll be straight about where this is still thinner than I'd like: images get the real, baked-in mark today, audio and video get the same logging and audit trail but not yet a mark baked into the file itself. That's next, not done.
None of this makes Disclarion compliance in a box, and I'd rather say that plainly than let the pitch imply it. Whether a given interaction needs disclosure at all is sometimes a judgment call, the “obvious from context” exception is a real one and it's not something software can decide for you. What the SDK approach buys you is narrower and, I think, more honest: once you've made that call, the mechanical parts (showing the notice, labeling the output, keeping an unfalsifiable record of it) happen automatically and can't quietly drift out of sync with what your product actually sent, because there's no gap in time or process between the two. That gap is exactly what a dashboard bolted on afterward can't close, no matter how good its UI is.
More from the blog
Your internal AI tools owe the same disclosure duty the customer-facing one does
An HR bot or IT helpdesk assistant used only by your own staff still interacts with natural persons. Article 50 doesn't carve out an exception for "internal-only."
Does the EU AI Act apply if you're not based in the EU?
"We're a US company, we don't have an EU entity" isn't the exemption it sounds like. The actual test is about who's on the other end of the conversation, not your mailing address.
Deepfakes get a stricter rule than an AI-written blog post
Article 50(4)'s deepfake duty isn't the same obligation as ordinary AI content labeling — it applies to image, audio, and video specifically, and the built-in exemptions work differently too.
Your chatbot isn't the only thing that owes a disclosure under Article 50.
Article 50's disclosure duty doesn't stop at chatbots — emotion recognition and biometric categorization systems carry the same obligation, and they're the two system types teams miss most often.
You named it "AI Assistant." That's not the same thing as disclosing it.
A bot's name feels like disclosure. Article 50 cares whether a reasonable user actually understood they were talking to an AI — not whether a label existed somewhere on the page.
Your editor touched it. Article 50's label exemption still might not apply.
Article 50(4) waives the visible AI-content label when a human takes substantive editorial responsibility for a piece — but a quick skim doesn't qualify, and the exemption doesn't touch the audit-trail duty underneath it.
You labeled the article. That's not the same thing as marking it.
Article 50(2)'s machine-readable marking and Article 50(4)'s visible label are two different duties. Images already meet the first one by accident. Article text usually doesn't meet it at all.
Your AI answers the phone now. There's no modal for that.
Article 50's disclosure duty doesn't go away because there's no screen. What actually discloses an AI voice agent on a phone call, when a modal isn't an option.
An AI audit trail doesn't need to know what your users actually said.
Teams hear "audit trail" and picture a database of every conversation. Article 50's version is narrower: it has to prove disclosure and labeling happened, not repeat what was said.
Article 50 skips disclosure when it's "obvious from context." That word is doing more work than it looks like.
Disclosure isn't required when AI use is obvious from context, but Article 50 never defines obvious, and most of the cases teams assume qualify, don't.
Your chatbot needs to disclose it's an AI. Once, not every message.
Disclosing a chatbot is AI sounds simple until you build it: repeat it every message and people tune it out, show it once and later visitors never see it.
You have logs. That's not the same thing as an audit trail.
Under Article 50, an audit trail has to be insert-only, complete, and producible on demand, not a data-engineering project when a regulator actually asks.
Your AI-generated content needs a label. Here's what that actually means.
A disclaimer someone remembers to add isn't a labeling system. Under Article 50, AI-generated content needs to be identifiable as such, reliably, not as a manual step someone can forget.
EU AI Act Article 50, explained: who it affects and what it requires
Article 50 of the EU AI Act has been enforceable since August 2, 2026: who it applies to, its three obligations, and the penalties for getting it wrong.