chatbot disclosure

You open a website and start chatting with customer support. The replies are quick, friendly and convincing. But is there a person on the other end? Then a video appears in your feed. Someone recognisable is speaking confidently about an event. Their face looks right. Their voice sounds familiar. Yet the recording may never have happened. These everyday uncertainties help explain the thinking behind the EU AI Act’s transparency rules: people should have a fair chance of knowing when AI is involved. The requirements cover certain chatbot interactions and types of AI-generated content. They do not mean that every use of AI needs the same warning label.

What has changed under the EU AI Act?

The EU AI Act is a broader regulatory framework with different requirements depending on the technology and its use. The changes discussed here concern Article 50, which addresses transparency for certain AI systems.

These obligations generally began applying on 2 August 2026. The European Commission published guidance in July to help organisations interpret them.

There is an important timing exception. Providers of qualifying generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking requirement. That transition does not postpone every transparency duty.

For readers, the practical distinction is between being told that a conversation involves AI and being able to identify content that AI has generated or manipulated.

Chatbots must make their identity clear

Under Article 50, providers of systems designed to interact directly with people must ensure users are informed that they are dealing with AI, unless that is already obvious in the circumstances.

The information must be clear, accessible and provided by the first interaction at the latest.

For a website chatbot, straightforward wording could be:

You’re chatting with an AI assistant.

There is no need to turn the greeting into a legal essay. The point is to help visitors understand the conversation they are entering.

A human name and a realistic profile photograph can create a different impression. If the interface looks like a staff member’s live chat, a vague reference to “smart support” may leave users guessing.

From a design perspective, it makes sense to check the first screen a visitor actually sees, including on mobile.

AI content has two different kinds of transparency

One source of confusion is that technical marking and visible disclosure serve different purposes.

Providers of generative AI systems must make covered synthetic outputs machine-readable and detectable as AI-generated or manipulated. This concerns text, images, audio and video, with exceptions including certain standard editing functions. A technical mark is not necessarily a visible caption across an image.

Separate duties apply to people and organisations using AI systems professionally, described in the law as deployers. These include disclosing deepfakes and certain AI-generated public-interest text.

That distinction matters. A software company building a content generator and an agency publishing a video made with it may have different responsibilities.

An agency should therefore understand what its chosen tool handles automatically and what remains part of its own publishing process.

Which videos and images need disclosure?

The deepfake rules concern AI-generated or manipulated images, audio or video that resemble existing people, objects, places, entities or events and could falsely appear authentic.

A realistic clip appearing to show a person saying something they never recorded is an obvious example to examine. The assessment also depends on the content, its context and the audience’s likely expectations.

The law recognises creative uses. For evidently artistic, fictional, satirical or similar works, disclosure can be handled appropriately without spoiling the presentation or enjoyment. This is a tailored obligation rather than a blanket exemption.

For creators, a useful editorial question is: could a viewer reasonably mistake this for a genuine recording?

That question will not settle every legal case, but it is a sensible place to begin before publishing a realistic AI avatar, reconstructed event or cloned voice.

Does every AI-assisted blog need a label?

No blanket rule says that every article touched by AI must carry an identical disclosure.

Article 50 specifically addresses AI-generated or manipulated text published to inform the public on matters of public interest. An exception applies where the content undergoes human review or editorial control and a person or organisation holds editorial responsibility for its publication.

For publishers, that makes the review process important. Who checked the facts? Who approved the final version? Who will correct an error?

As an editorial practice, checking only spelling and layout leaves the most consequential work undone. A polished paragraph can still contain a false claim.

Can the rules affect organisations outside Europe?

Yes. The EU AI Act can apply to providers placing AI systems on the EU market regardless of where they are based. It can also cover providers and deployers outside the EU where the system’s output is used within the EU.

Purely personal, non-professional use by individuals is excluded from deployer obligations. Professional and commercial activities need a different assessment.

However, using a globally available AI tool does not automatically make every user subject to every requirement.

The relevant questions concern the organisation’s role, what it supplies or publishes, where the system or output is used, and which obligation is being considered.

What about the €15 million fines?

The headline figures are substantial. Breaches of Article 50 can fall within a penalty category of up to €15 million or 3% of worldwide annual turnover, whichever is higher for undertakings.

For SMEs, including start-ups, the relevant ceiling uses the lower figure. The amended rules also provide a lower-of-the-two ceiling for small mid-cap enterprises in this penalty category.

These are maximum limits. Authorities must consider the circumstances, including the seriousness of the infringement, the organisation’s size and corrective action. A breach does not automatically produce a €15 million bill.

The sensible response is to establish what applies and address any gaps, rather than treating the largest possible fine as the likely outcome.

What should creators and businesses check?

A practical review can start with the material customers and audiences already encounter:

• Chat interfaces: Is the AI identity clear when the conversation begins?
• Realistic media: Could viewers mistake generated footage or speech for an authentic recording?
• Publishing workflows: Who reviews factual content and takes responsibility for it?
• Supplier documentation: Which transparency features does the AI platform provide?
• Responsibility: Who checks disclosures before a new campaign or feature goes live?

These checks are a starting point, not proof of legal compliance. Organisations with uncertain responsibilities should obtain advice on their particular use case.

Transparency should be easy to understand

A customer should not have to inspect a privacy policy to work out who—or what—is answering them. A viewer should not need specialist software to discover that an apparently genuine recording was fabricated.

The EU AI Act brings those questions into the way AI products and content are presented.

For creators, the challenge is to make disclosure a normal part of production. For software providers, it belongs in the product design. For audiences, the intended benefit is straightforward: better information about what they are seeing and using.

AI can still be useful, entertaining and impressive when people know it is AI.

Information checked on 9 October 2026. This article provides general information about transparency obligations and is not legal advice or a complete guide to the EU AI Act.