DEV Community: mdodeja

Making a chatbot's AI disclosure accessible: what Article 50(5) asks for

mdodeja — Mon, 02 Nov 2026 00:20:05 +0000

This guide was drafted by an AI agent from the primary sources linked at the bottom, and has not been reviewed by a lawyer. It is general information, not legal advice. The original is at https://mdodeja.github.io/eu-ai-act-article-50-guide/guides/accessible-chatbot-ai-disclosure.html.

Short answer. Article 50(5) says the AI disclosure "shall conform to the applicable accessibility requirements". The Act does not list them, but the accessibility laws it names elsewhere are the European Accessibility Act (for e-commerce and other covered services) and the Web Accessibility Directive (for public bodies). Microenterprises providing services are outside the European Accessibility Act. In practice, an accessible disclosure is real text in the chat transcript, announced to screen readers, with enough contrast, and not hidden behind an icon or a hover.

What the Act says

Article 50(5) covers every disclosure in Article 50, chatbots included:

"The information referred to in paragraphs 1 to 4 shall be provided to the natural persons concerned in a clear and distinguishable manner at the latest at the time of the first interaction or exposure. The information shall conform to the applicable accessibility requirements."

"Applicable" is not defined in Article 50. Where the Act deals with accessibility for high-risk systems, Article 16(l) points to two directives: the Web Accessibility Directive (EU) 2016/2102 and the European Accessibility Act, Directive (EU) 2019/882. Reading Article 50(5) the same way, the disclosure has to meet whichever of those already applies to the website or app the chatbot sits on. That is a reading, not settled law; the Commission's guidelines may say more.

Which rules apply to whom

Where the chatbot runs	Accessibility rule that already applies	Effect on the AI disclosure
Public-sector website or app	Web Accessibility Directive	Disclosure must meet the same standard as the rest of the site
Online shop, banking, transport ticketing or another service covered by the European Accessibility Act (applies since 28 June 2025)	European Accessibility Act	Same
Service run by a microenterprise (fewer than 10 staff and turnover or balance sheet of no more than EUR 2 million)	Not the European Accessibility Act: its requirements do not apply to microenterprises providing services, per Ireland's CCPC	No specific accessibility law, but the disclosure still has to be "clear and distinguishable"
B2B site not in a covered sector	Often none	Same as above

National laws implementing the two directives add detail and differ by country. Germany's BFSG is one example.

For agencies, the useful point is that the disclosure is part of the chat interface. If a client's site has to meet the European Accessibility Act, an inaccessible chat widget is already a problem, and the AI line inherits that.

What an accessible disclosure looks like

The harmonised European standard for these directives is EN 301 549, whose web clauses follow WCAG 2.1 level AA. These are the WCAG success criteria a chatbot disclosure most often fails:

Real text, not an image or icon (1.1.1). A robot icon or an "AI" badge alone is not a disclosure for a screen reader user unless it has a text alternative that says the same thing. Better: put the words in the first message.
Announced when it appears (4.1.3, status messages). Chat messages added to the page should be announced, usually through an ARIA live region on the message list. Test that the first bot message, with the disclosure in it, is read out without the user moving focus.
Contrast (1.4.3). Small grey "Powered by AI" text under the input box often falls below the 4.5:1 ratio for normal text. Check it with a contrast checker.
Not colour alone (1.4.1). A different bubble colour for the bot is fine as an extra cue, but it cannot be the only thing that says "this is an AI".
Keyboard (2.1.1). The chat opens, the disclosure can be reached and the "talk to a person" option works with the keyboard alone.
No hover-only text. A tooltip that says "AI assistant" when you hover the avatar does not reach keyboard, touch or screen reader users.
Language of the page (3.1.1 and 3.1.2). If the bot answers in the visitor's language, mark the language so a screen reader pronounces the disclosure correctly.

Plain wording helps everyone: "I'm an AI assistant, not a person" is easier to follow than "This conversational agent is powered by generative artificial intelligence". The disclosure wording guide has examples.

Voice and video

Voice agents. The disclosure is spoken, so it reaches blind callers already. Deaf or hard-of-hearing users who reach the business by relay or text chat need the same line in text. The voice agent guide covers the spoken wording.
AI avatars and video. If the disclosure is only spoken, captions must carry it (1.2.2). If it is only on screen, a screen reader user may miss it, so say it in the audio too.

A quick test before go-live

[ ] Turn on a screen reader (VoiceOver, NVDA or TalkBack), open the chat and confirm the AI line is read out.
[ ] Open the chat, reach the disclosure and the "person" option with the Tab key only.
[ ] Check the contrast of the disclosure text and any "AI" label.
[ ] Zoom to 200% and confirm the disclosure is not cut off or hidden.
[ ] Confirm icons and badges have text alternatives that say "AI".
[ ] For voice or video, check the transcript or captions include the disclosure.

Sources

Regulation (EU) 2024/1689 (AI Act) on EUR-Lex: Article 16(l) and Article 50(5).
Article 50 text and Article 16 text at artificialintelligenceact.eu.
Directive (EU) 2019/882 (European Accessibility Act) on EUR-Lex.
Directive (EU) 2016/2102 (Web Accessibility Directive) on EUR-Lex.
CCPC (Ireland): European Accessibility Act guidelines for microenterprises, for the microenterprise definition and the services exemption.
W3C: WCAG 2.1, for the success criteria named above.

AI sales and lead-capture chatbots: disclosure, consent and handing leads to sales

mdodeja — Sun, 01 Nov 2026 00:15:12 +0000

Short answer. A sales or lead-capture chatbot needs the same AI disclosure as any other chatbot, shown before the visitor types. On top of that it collects personal data, so it needs a short privacy notice at the point of collection and a lawful basis for passing the lead to sales. Follow-up marketing email to a lead who never bought anything generally needs consent under the ePrivacy rules, so ask for it in the chat with an unticked option. What the bot says about price and terms counts as the business's own statement.

What applies, in one table

Part of the chat	Rule	What to do
The bot itself	AI Act Article 50(1) and (5)	Say it is an AI, at the latest at the first message
Asking for name, email, company	GDPR Articles 6 and 13	Short notice in the chat, link to the privacy policy
"Can we email you about offers?"	ePrivacy Directive Article 13	Separate opt-in, not pre-ticked
Chat widget cookies and identifiers	ePrivacy Directive Article 5(3)	Covered by the cookie banner unless strictly necessary
Claims about price, stock, discounts	Unfair Commercial Practices Directive	Answers from approved content only
Handing over to a sales rep	Article 50(1), GDPR	Tell the visitor a person is taking over

The AI disclosure

A lead-capture bot interacts directly with visitors, so Article 50(1) applies to it like any support bot. The duty sits with the provider of the system (often the chatbot vendor, sometimes the agency that built or branded it; see does Article 50 apply to client chatbots). In practice the business running the landing page should check the wording itself.

Sales bots raise two specific risks:

Human personas. "Hi, I'm Sarah from the sales team" with a stock photo is the set-up Article 50 is aimed at. A named persona is fine if the first message also says it is an AI assistant.
The "obvious" exception. Article 50(1) does not apply where it is obvious from the context that the visitor is talking to an AI. Sales bots are built to sound like a person, so don't rely on it.

Opening line that works on a landing page:

"Hi, I'm the AI assistant for Northgate. I can answer questions about plans and pricing, or book a call with someone from our team."

More wording options are in the disclosure wording guide.

Collecting the lead's details

A name, work email and phone number are personal data, including for B2B leads. The GDPR points that matter for a chat:

Notice at the point of collection. Article 13 requires the information to be given when the data is obtained. A line before the bot asks for an email does this: "We'll use your details to reply to this request. Privacy policy: [link]." The full notice sits in the policy.
Lawful basis. Replying to the visitor's own request (a demo, a quote) can usually rest on steps taken at the person's request before a contract (Article 6(1)(b)) or legitimate interests (Article 6(1)(f)). Adding them to marketing lists is a different purpose and needs its own basis.
Transcripts. Chat logs often hold more than the form fields. Set a retention period and say in the policy that conversations are stored and who processes them (the chatbot vendor is usually a processor).
Lead scoring. Scoring leads to decide who sales calls first is unlikely to be a decision with legal or similarly significant effects under Article 22. Scoring that decides who gets a credit offer or a price is a different matter; ask a lawyer.

The Article 50 and GDPR guide covers the general chatbot GDPR points.

Follow-up email: ask in the chat

Under Article 13 of the ePrivacy Directive, email for direct marketing to individuals needs their prior consent. The "soft opt-in" exception covers a business's own customers whose details were obtained in the context of a sale, for similar products. A lead who asked a bot a question has not bought anything, so in most cases the exception does not fit.

Rules for business addresses differ by country: Article 13(5) leaves member states to protect legal persons, and national laws went different ways. If leads come from several EU countries, the simple route is to ask everyone.

What that looks like in the chat:

"Would you like occasional emails about new features? [Yes, email me] [No thanks]"

Keep the answer to the visitor's request separate from the marketing yes or no, store the answer with a timestamp, and don't make the demo depend on saying yes.

What the bot is allowed to promise

Statements a chatbot makes on a business's site are treated as the business's statements. In Moffatt v. Air Canada (2024 BCCRT 149), a Canadian tribunal held the airline responsible for a refund policy its website chatbot had described wrongly (reported widely; not EU law, but the reasoning travels). In the EU, a bot that invents a discount, misstates a price or claims "only 2 left" without basis can be a misleading practice under the Unfair Commercial Practices Directive.

Practical limits:

Price, plan and contract answers come from an approved source the bot quotes, not from the model's general knowledge.
The bot does not offer discounts, trials or terms that sales has not approved.
No false urgency or scarcity. Article 5(1)(a) of the AI Act also bans AI systems that use manipulative techniques to distort behaviour in a way that causes significant harm. Ordinary sales chat is far from that bar, but pressure tactics built into a bot move towards it.

Handing over to a sales rep

When a person takes over the chat, say so: "You're now chatting with Tom from our sales team." Visitors who were told they were talking to an AI should not have to guess when that stops being true. The reverse matters too: if the rep leaves and the bot comes back, the AI line goes back in.

If the chat is passed to a rep by email or CRM, the lead's details go only to the people who need them, and the transcript goes with the consent answer so sales knows whether marketing email is allowed.

Checklist for a lead-capture bot

[ ] First message says it is an AI assistant, persona or not.
[ ] One-line privacy notice before the bot asks for contact details.
[ ] Marketing opt-in is a separate, unticked choice, stored with a timestamp.
[ ] Price and terms answers come from approved content.
[ ] No invented discounts, urgency or scarcity.
[ ] Handover to a person, and back, is announced in the chat.
[ ] Transcript retention period set and named in the privacy policy.
[ ] Chat widget cookies covered by the consent banner where needed.

Sources

Regulation (EU) 2024/1689 (AI Act) on EUR-Lex: Article 5(1)(a) and Article 50(1) and (5).
Article 50 text and Article 5 text at artificialintelligenceact.eu.
Regulation (EU) 2016/679 (GDPR) on EUR-Lex: Articles 6, 13 and 22.
Directive 2002/58/EC (ePrivacy Directive) on EUR-Lex, as amended: Articles 5(3) and 13.
Directive 2005/29/EC (Unfair Commercial Practices Directive) on EUR-Lex.
Moffatt v. Air Canada, 2024 BCCRT 149, Civil Resolution Tribunal of British Columbia, reported.

AI email replies and Article 50: when an email needs an AI disclosure

mdodeja — Sat, 31 Oct 2026 00:14:10 +0000

Short answer. An AI that writes and sends email replies to customers by itself is interacting directly with them, so the replies need to say they come from an AI. An AI draft that a member of staff properly reviews and sends as their own reply is, on the Commission's reported reading, not direct interaction. Rule-based auto-responders (out-of-office, "we got your ticket") are not AI systems at all. The line is whether a person really acts as the sender, not whether a person could have stepped in.

Three kinds of automated email

Set-up	Article 50(1) disclosure?	Why
Out-of-office or fixed "we received your request" auto-reply	No	A rule-based template is not an AI system
AI reads the customer's email and sends a reply on its own	Yes	The AI system interacts directly with the customer
AI drafts, a member of staff reads, edits where needed and sends	Usually no, if the review is real	A person is the one communicating
AI drafts, staff click "send" on everything without reading	Likely yes	The review is a formality
Staff reply, with AI-written paragraphs dropped in unread	Likely yes for those parts	See the mixed-content point below

What "interact directly" means for email

Article 50(1) puts the duty on providers of AI systems "intended to interact directly with natural persons". The Commission's guidelines on Article 50 explain "directly". As summarised by Modulos (paragraph 30 of the guidelines approved on 20 July 2026), the interaction is usually in real time or near real time, and it is not direct where it goes through another person. Their examples are a person using AI to help write to someone else, and a person passing on AI output.

The same summary reports two limits on that:

Being able to intervene or review is not enough. A human who could step in but does not does not take the email outside Article 50.
Content that mixes AI and human writing is in scope unless the AI outputs were properly reviewed and sent by humans acting as the main interlocutors.

It also reports that traditional out-of-office emails and rule-based quick answers are not AI systems and so are outside Article 50.

The guidelines are non-binding, and the Commission said they apply once formally adopted in all language versions. Check the current text on the Commission's pages before relying on a paragraph number.

Auto-sent AI replies: what to write

Put the disclosure where it is read first. That is the top of the email body, not the footer:

"This reply was written by Brightline's AI assistant. If it doesn't answer your question, reply with 'person' and a member of our team will pick it up."

Article 50(5) asks for the information to be clear and distinguishable and given at the latest at the first interaction. For an email thread, the first AI-sent reply is the first interaction. Repeat the line in every AI-sent reply, because emails get forwarded and read out of order.

Other points:

Sender name. A sender name like "Emma from Brightline" on an AI-sent reply works against the disclosure. Use "Brightline Support (AI assistant)" or similar. The Commission reads the "obvious from the context" exception narrowly, so a human-sounding signature makes it less likely to apply, not more.
Subject line. Optional. "[AI reply]" is acceptable but may hurt open rates. The body line is what counts.
Language. Write the disclosure in the language of the reply.

AI drafts that staff send

If staff send AI drafts as their own replies, the safe course is to make the review real and be able to show it:

staff read the whole draft and the customer's original email before sending
they correct facts, tone and promises (refunds, delivery dates) rather than sending as is
the helpdesk shows who sent each reply and whether it was edited
volume targets leave time to read, since 200 approvals an hour is not review

If you can't meet that, treat the replies as AI-sent and add the disclosure. It is one line, and customers rarely mind it.

Outbound sales and marketing email

The same test applies to AI-written sales sequences. An AI agent that writes and sends follow-ups to prospects on its own is interacting directly with them, and the follow-ups need the disclosure. Templates a person wrote once (with or without AI help) and a tool sends to a list are a person's message. Separately, ePrivacy rules on unsolicited email and the GDPR apply to the list whatever wrote the email.

A check for email workflows

[ ] List every automated email flow: rule-based, AI-sent, or AI-drafted and human-sent.
[ ] AI-sent replies open with a one-line AI disclosure and how to reach a person.
[ ] Sender name on AI-sent replies does not suggest a person.
[ ] Human-sent AI drafts: review is real and recorded in the helpdesk.
[ ] Outbound AI agents that send on their own carry the disclosure.
[ ] Privacy notice covers AI processing of incoming emails.

Sources

Regulation (EU) 2024/1689 (AI Act) on EUR-Lex: Article 3(1) and Article 50(1) and (5).
Article 50 text at artificialintelligenceact.eu.
Modulos: summary of the Commission's Article 50 guidelines, reported, for paragraph 30 on "directly", human review and auto-responders.
William Fry: Articles 50(1) and 50(2) transparency obligations, reported, for the narrow reading of the "obvious" exception.
European Commission: AI Act policy pages, for the guidelines themselves.

AI phone receptionists for clinics, salons and restaurants: what to say and what to keep away from the bot

mdodeja — Fri, 30 Oct 2026 00:14:32 +0000

Short answer. Open every call with one sentence saying it is an AI and how to reach a person. That covers Article 50 for all three. The sector rules are where the risk is. A clinic bot hears health data and must not slide into triage. A salon or restaurant bot should not take card numbers by voice, and a restaurant bot should read allergen answers from a checked list or pass them to staff.

The part that is the same everywhere

An AI that answers the phone interacts directly with people, so Article 50(1) of the AI Act applies. Callers have to be told they are talking to an AI at the latest at the first interaction (Article 50(5)). On a phone call that means the greeting:

"Hello, you've reached Riverside Dental. I'm the practice's AI assistant and I can book, move or cancel appointments. To speak to someone at reception, say 'reception' at any time."

The voice agent guide covers wording, transfers, voicemail and outbound calls. The duty sits with the provider of the system, which is often the software vendor, but the business that switches it on is the one callers complain to, so check the greeting yourself.

What changes by sector is what the bot hears and what it is allowed to decide.

Clinics: health data and the triage line

Health data. A caller who says "I need an appointment, my tooth is swollen and I have a fever" has given health data. That is special category data under Article 9 of the GDPR, which needs one of the Article 9(2) conditions on top of a normal lawful basis, and a bot that processes it at scale is a likely case for a data protection impact assessment (Article 35). Check where call audio and transcripts are stored, for how long, and whether the vendor uses them to train its models.

Do not let the bot triage. Booking the next free slot is administration. Deciding who is urgent is a clinical call, and it moves the system into other law:

The AI Act lists as high-risk AI systems used to evaluate and classify emergency calls and emergency healthcare patient triage systems (Annex III, point 5(d)). Under the Digital Omnibus, high-risk duties for Annex III systems apply from 2 December 2027.
Software intended by its manufacturer for a medical purpose, such as diagnosis, prediction or prognosis, can be a medical device under the Medical Device Regulation (Regulation (EU) 2017/745, Article 2(1)).

A receptionist bot that books appointments is unlikely to be either. One that asks about symptoms and decides who gets seen today might be. Keep a hard rule: any mention of chest pain, breathing problems, heavy bleeding, suicidal thoughts or similar triggers an immediate transfer or an instruction to call the emergency number (112 in the EU), and the bot gives no medical advice.

Salons: bookings, deposits and no-shows

Payments. Don't let the bot collect full card numbers by voice. Card data in a call recording or transcript is hard to secure, and card schemes' security standards apply to anyone who stores it. Send a payment or deposit link by SMS or email instead, through your booking system's payment provider.

Deposits and cancellation fees. If the bot tells callers about a deposit or late-cancellation fee, the wording has to match your actual terms. A bot that improvises a policy creates a promise you may have to honour. Keep these answers fixed, not generated.

Recognising regulars. Matching a caller's number to their booking history is ordinary personal data processing and should be covered in your privacy notice. Identifying people by their voice is biometric processing, which brings the GDPR's special category rules and can bring AI Act duties too (Annex III, point 1 covers some biometric identification systems). Most salons have no reason to do it.

Restaurants: allergens and reservations

Allergens. EU food information rules require allergen information for non-prepacked food, such as restaurant meals, to be available to customers (Regulation (EU) No 1169/2011, Articles 9(1)(c) and 44). A generative bot that guesses whether a dish contains nuts is a real risk. Either have it read answers from a dish-by-dish allergen list that staff maintain, or have it say "I'll pass that to the team" and take a callback number. Never let it say a dish is "safe" for an allergy.

Reservations and changes. Confirm every booking by text or email so the guest has a record that does not depend on the call. Say clearly when a request (a large group, a special occasion) needs a person to confirm it.

One script, three variants

Sector	After the AI greeting, add	Hand to a person when
Clinic	"I can't give medical advice. If this is an emergency, hang up and call 112."	Any symptom question, urgency, results, prescriptions
Salon	"I'll text you a link to pay the deposit."	Complaints, refunds, treatment suitability questions
Restaurant	"For allergy questions I'll read from our allergen list or pass you to the team."	Allergies not on the list, large groups, complaints

Setup check

[ ] Greeting says it is an AI and how to reach a person, before anything else.
[ ] Call recording and transcripts covered in the privacy notice, with a retention period.
[ ] Vendor's training-on-your-data setting checked.
[ ] Clinic: emergency words trigger a transfer or an emergency instruction; no triage or medical advice.
[ ] Salon and restaurant: no card numbers taken by voice.
[ ] Policy answers (fees, allergens, opening hours) come from fixed text, not generation.
[ ] Every booking confirmed in writing.

Sources

Regulation (EU) 2024/1689 (AI Act) on EUR-Lex: Article 50(1) and (5), Annex III point 5(d).
Annex III and Article 50 at artificialintelligenceact.eu.
Regulation (EU) 2026/1744 (Digital Omnibus on AI) on EUR-Lex, for the high-risk dates.
Regulation (EU) 2016/679 (GDPR) on EUR-Lex: Articles 9 and 35.
Regulation (EU) 2017/745 (Medical Device Regulation) on EUR-Lex: Article 2(1).
Regulation (EU) No 1169/2011 (food information to consumers) on EUR-Lex: Articles 9 and 44.

AI chatbots on WhatsApp and Messenger: how to show the Article 50 disclosure

mdodeja — Thu, 29 Oct 2026 00:14:44 +0000

Short answer. A messaging app gives you no banner or widget header, so the disclosure has to be in the conversation itself. Put it in the first message the AI sends in each conversation ("You're chatting with [Brand]'s AI assistant..."), before or with its first answer. When a conversation starts from a template the business sends, say so at the first AI reply. WhatsApp's Business Messaging Policy separately requires a clear path to a person when you automate replies.

Why messaging apps need a different approach

On a website, the chat widget has a header, a launcher button and a welcome panel where "AI assistant" can sit before anyone types. In WhatsApp or Messenger, the customer sees your business name and a message thread like any other. There is nowhere to put a label except the messages themselves.

Article 50(1) of the AI Act requires an AI system that interacts directly with people to be designed so they are informed they are interacting with an AI, unless that is obvious from the context. Article 50(5) says the information has to be clear and distinguishable and given at the latest at the first interaction. A customer messaging a shop on WhatsApp will often expect a person, so "obvious from the context" rarely applies. The duty sits with the provider of the chatbot system: whoever builds it, or has it built and supplies it under their own name (see the white-label guide).

Where the disclosure goes

Customer starts the chat. Make the AI's first reply in each conversation open with the disclosure:

"Hi, you're chatting with Brightline's AI assistant. It can answer questions about orders, delivery and returns. Type 'agent' at any time to reach a person."

Keep it at the top of the message, not after the answer. On a phone lock screen and in the chat list, only the first line or two shows.

Business starts the chat with a template. On the WhatsApp Business Platform, a business can only start a conversation, or write after the 24-hour customer service window has closed, with an approved Message Template. If a person or a fixed template sends that first message and the AI only replies once the customer answers, put the disclosure in the AI's first reply. If an AI writes or picks the template's content, put it in the template.

Returning customers. "At the latest at the first interaction" is about the first interaction, but a thread can sit unused for weeks. Showing the disclosure again at the start of each new conversation (for example, after 24 hours of silence) costs nothing and avoids an argument about whether someone remembered.

Business profile. Add a line to the WhatsApp business profile or Messenger page "About" text, such as "Our chat replies are answered by an AI assistant, with staff available." It helps, but people rarely open the profile, so it does not replace the in-thread message.

Display name. A name like "Brightline Support" says nothing about AI. Adding "AI" to a display name may need the platform's approval and still sits outside the conversation, so treat it as extra, not as the disclosure.

Handover to a person

When the bot hands the chat to staff, say so in the thread: "You're now chatting with Sam from our support team." It tells the customer the AI has stopped answering, and it avoids the opposite problem of staff replies being mistaken for the bot's.

WhatsApp requires an escalation route anyway. Its Business Messaging Policy says businesses may use automation when responding during the 24-hour window, but "must also have available prompt, clear, and direct escalation paths", such as transfer to a human agent in the chat, a phone number, an email address or a support form. A disclosure message that also says how to reach a person meets both needs in one line.

WhatsApp's limit on AI assistants

Separately from the AI Act, Meta changed the WhatsApp Business Solution terms so that AI providers cannot use the platform to distribute general-purpose AI assistants where the assistant is the main product. It was reported to apply to new users from 15 October 2025 and to existing users from 15 January 2026. Meta told TechCrunch, as reported, that the change does not affect businesses using AI for customer service, such as support, bookings and order tracking. A support bot for your own customers is the allowed case. Check the current Business Solution terms if your bot answers open-ended questions beyond your business.

A disclosure that also covers the GDPR

A WhatsApp or Messenger bot processes personal data, so a short privacy pointer fits in the same first message:

"You're chatting with Brightline's AI assistant. Type 'agent' for a person. How we use your messages: brightline.example/privacy"

The Article 50 and GDPR guide covers the rest of what the GDPR needs, including the processing agreement with your messaging platform provider.

Setup check for a messaging bot

[ ] The AI's first message in each conversation says it is an AI assistant, in the first line.
[ ] Template-started conversations: disclosure in the template if an AI wrote it, otherwise in the AI's first reply.
[ ] Disclosure shown again when a new conversation starts after a gap.
[ ] A word or button to reach a person, and a handover message when staff take over.
[ ] Business profile mentions the AI assistant.
[ ] Privacy link in or right after the first message.
[ ] Bot scope stays within customer service for your business (WhatsApp terms).

Sources

Regulation (EU) 2024/1689 (AI Act) on EUR-Lex: Article 50(1) and (5).
Article 50 text at artificialintelligenceact.eu.
WhatsApp Business Messaging Policy, for automation, escalation paths and Message Templates.
respond.io: WhatsApp general-purpose chatbots ban, reported, for the Business Solution terms change and its dates.

Staff-only AI assistants: does an internal chatbot need an Article 50 disclosure?

mdodeja — Wed, 28 Oct 2026 00:15:45 +0000

Short answer. Article 50(1) is not limited to customers. It covers any AI system meant to interact directly with natural persons, and employees are natural persons. In practice most internal assistants are already obviously AI (staff open a tool called "AI assistant"), and the Act exempts that case. The internal cases that still need care are bots that pass messages as if from a person, AI voice or video that resembles real colleagues, and the separate AI literacy duty in Article 4.

The rule does not stop at customers

Article 50(1) says providers must design AI systems "intended to interact directly with natural persons" so that the people concerned are informed they are interacting with an AI system. Nothing in it limits the duty to consumers or the public. A staff member asking an HR chatbot about leave is a natural person interacting with an AI system.

There is also no general exemption for internal use. "Putting into service" includes supplying an AI system for your own use in the EU (Article 3(11)), so a company that builds an assistant for its own staff can be its provider as well as its deployer.

Why most internal assistants are already covered

The same paragraph has a built-in exception: no disclosure is needed where the AI nature is obvious "from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use".

Most internal tools meet that easily:

Internal tool	Obvious it is AI?	Comment
Staff open an app or tab called "AI assistant" or "Copilot"	Yes	The name and the way it is reached tell them
IT helpdesk chat that greets staff as "the AI helpdesk assistant"	Yes	The greeting is the disclosure
HR chat in the intranet with a person's name and photo, no AI mention	No	Staff could think HR is replying
Bot that posts in team chat or email under a colleague's name	No	It looks like a message from a person
Ticket system where an AI drafts and sends replies in an agent's name	No	Unless the reply or the system says so

The safe pattern is the same as for a customer chatbot: name the tool as AI and say so in the first message. It costs one line, and it removes the argument about what is obvious.

Who carries the duty

Under Article 50(1) the duty is the provider's: whoever builds the assistant, or has it built and puts it into service under its own name. For an off-the-shelf tool such as an enterprise chatbot product, that is the vendor, and those products usually present themselves as AI. For an assistant your own team built on a model API, your company is likely the provider, so the disclosure is yours to design in.

The internal cases that do need a label

AI voice or video of real colleagues. Article 50(4) requires deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake to disclose that the content is artificially generated or manipulated. Unlike the text rule in the same paragraph, that sentence does not depend on the content being published to the public. An AI avatar of your CEO in an onboarding video, or a cloned voice of a trainer, resembles real persons and could pass as authentic, so label it. The deep fake guide covers the definition.

AI-written internal text. The Article 50(4) text duty covers text "published with the purpose of informing the public on matters of public interest". Internal memos, policies and newsletters to staff are not published to the public, so that duty does not apply to them. Labelling them can still be good practice.

Emotion recognition at work. Article 50(3) requires deployers of emotion recognition systems to inform the people exposed. Separately, Article 5(1)(f) prohibits emotion recognition in the workplace except for medical or safety reasons. If an internal tool claims to read staff mood from voice or video, check Article 5 first.

Other duties that apply to internal AI anyway

AI literacy (Article 4). Providers and deployers must take measures to support a sufficient level of AI literacy among their staff and others who use AI systems on their behalf. The consolidated text, as amended by the Digital Omnibus, says this does not require guaranteeing a specific level of literacy for any individual, and adds a supporting role for the Commission and Member States. Telling staff plainly which tools are AI and what they get wrong is part of that.
High-risk systems at work. If an internal AI system is high-risk (for example, used for recruitment, promotion or task allocation decisions under Annex III point 4), Article 26(7) requires the employer to inform workers' representatives and the affected workers before putting it into service. Under the Digital Omnibus the high-risk obligations for Annex III systems apply from 2 December 2027.
GDPR. An internal assistant that processes staff data needs a lawful basis and must be covered in the employee privacy notice. National labour law may also require consulting a works council before introducing it.

A short check for internal assistants

[ ] The tool's name and first message say it is AI.
[ ] No AI-written message goes out under a person's name without saying so.
[ ] AI avatars or cloned voices of real people are labelled.
[ ] No emotion recognition on staff outside the Article 5 exceptions.
[ ] Staff have been told which tools are AI and their limits (Article 4).
[ ] Employee privacy notice covers the assistant's data.

Sources

Regulation (EU) 2024/1689 (AI Act) on EUR-Lex: Articles 3(3), 3(11), 4, 5(1)(f), 26(7) and 50, Annex III point 4.
Regulation (EU) 2026/1744 (Digital Omnibus on AI) on EUR-Lex: amendments to Article 4 and the high-risk dates.
Article 4 (consolidated) and Article 50 text at artificialintelligenceact.eu.

White-labelled AI tools: is your agency the provider under the AI Act?

mdodeja — Tue, 27 Oct 2026 00:16:18 +0000

Short answer. Possibly. The AI Act's provider is whoever develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. An agency that sells a vendor's chatbot as "AgencyBot" fits that wording more closely than one that installs the vendor's branded widget for a client. If you are the provider, the Article 50(1) duty to design the chatbot so people know it is an AI is yours, even though the vendor wrote the code. Get the vendor to give you the means to meet it, in writing.

The definitions that decide it

Three definitions in Article 3 of the AI Act do the work:

Provider (Article 3(3)): a person or body "that develops an AI system ... or that has an AI system ... developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge".
Deployer (Article 3(4)): a person or body using an AI system under its authority, except for personal non-professional use.
Distributor (Article 3(7)): someone in the supply chain, other than the provider or importer, who makes an AI system available on the EU market.

Two phrases matter for white-label deals. "Has an AI system developed" means you do not have to write the code yourself. "Under its own name or trademark" means the brand on the product counts. A reseller that puts its own name on someone else's system can therefore land in the provider role.

Common agency set-ups

Set-up	Likely role	Why
You install the vendor's widget, with the vendor's name on it, on a client's site	Deployer (with the client), not provider	The vendor's name is on it; the vendor is the provider
You sell "YourAgency Assistant", built on a white-label chatbot platform, to several clients	Possibly the provider	You have a system developed and supply it under your own name
You build a custom bot on an LLM API and hand it to one client under the client's brand	You or the client may be the provider	You developed it; the client may be the one putting it into service under its name. Decide it in the contract
You only resell the vendor's product, unchanged and under the vendor's name	Distributor	You make it available but don't put your name on it
The client uses the bot on its own site, whoever built it	Deployer	Using an AI system under its own authority

The roles are not exclusive. The client is usually a deployer whatever you are, and one company can be both provider and deployer of the same system.

Where the line is unclear

The Act does not say how much of a system you need to shape before you "have it developed". Changing a logo and a system prompt on a SaaS platform is a long way from commissioning a custom build, and the text does not draw the line between them. Article 25, which makes distributors, importers and deployers into providers when they put their name on a system, applies only to high-risk AI systems, so it does not settle the question for an ordinary customer-service chatbot.

The Commission's guidelines on Article 50 are the place to check for its reading of these roles. Until there is guidance or case law that says otherwise, the safer working assumption for a branded reseller is that it may be the provider, and to design for that.

What being the provider means under Article 50

For a chatbot or other AI system that interacts directly with people, Article 50(1) puts the duty on the provider: the system has to be designed and developed so that the people using it are informed they are interacting with an AI system, unless that is obvious from the context. Article 50(5) adds that the information must be clear and distinguishable, given at the latest at the first interaction, and accessible.

If your agency is the provider, that means:

The disclosure has to be part of the product you supply, not something you leave each client to add.
If the white-label platform has no setting for a disclosure message, you need another way to show one before or at the first message (a fixed greeting, a banner in the widget), or a different platform.
For tools that generate images, audio, video or text, the Article 50(2) machine-readable marking duty is also the provider's. You will usually depend on the vendor's model or platform to embed the marking. Check that it does.

The deployer duties in Article 50(3) and (4) (emotion recognition and biometric categorisation, deep fakes, public-interest text) stay with whoever uses the system: the client, or you if you run it for them under your authority. The guide on whether Article 50 applies to client chatbots covers the deployer side.

What to put in the vendor contract

If you might be the provider, you are answering for code someone else controls. Ask the vendor for:

a confirmed setting, on every plan you resell, to show an AI disclosure before or at the first message, and a commitment not to remove it
confirmation of what machine-readable marking the platform or model applies to generated content, and that exports keep it
notice of changes that affect disclosure or marking, with enough lead time to fix client set-ups
the documentation you would need to answer a market surveillance authority about how the system informs users
a clear statement of who is provider, so the contract matches how you sell the product

And with each client, write down who is provider and who is deployer for the system you are supplying, and who answers if an authority asks.

A quick decision check

[ ] Whose name or trademark do end users see on the chatbot or tool?
[ ] Did you develop it, or have it developed, rather than only install a vendor's product?
[ ] If both answers point to you, plan as the provider.
[ ] Disclosure built into the product at or before the first message.
[ ] Vendor contract covers the disclosure setting, marking and change notice.
[ ] Client contract records the roles.

The compliance log in the Article 50 kit for agencies has a column for recording your role on each system. Everything on this page works without it.

Sources

Regulation (EU) 2024/1689 (AI Act) on EUR-Lex: Article 3(3), (4), (7), (9) and (11), Article 25, and Article 50.
Article 3 definitions and Article 25 at artificialintelligenceact.eu.
Article 50 text at artificialintelligenceact.eu.
European Commission: AI Act policy pages, for the Article 50 guidelines.

AI-generated images on social media: what EU brands have to label

mdodeja — Mon, 26 Oct 2026 00:15:04 +0000

Short answer. Under Article 50(4) a brand that posts a realistic AI image or video that could pass as real (a deep fake in the Act's sense) has to say it is AI-made, clearly and at the first exposure. Stylised, obviously artificial graphics don't trigger that duty. Platform labels such as Meta's "AI info" or YouTube's altered-content setting are the platforms' own rules. They can help, but they are not the brand's Article 50 disclosure and they don't always show.

Which posts need a label under the AI Act

Article 50(4) applies to deployers, meaning anyone using an AI system in their own business, so a brand posting its own content counts. The duty covers image, audio or video that is a deep fake: AI-generated or manipulated content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful (Article 3(60)). The deep fake guide works through that definition in detail.

For a brand's social feed, that splits roughly like this:

Post	Article 50(4) label?	Why
Photorealistic AI image of your product in a setting it was never in	Likely yes	Resembles a real object and would pass as a real photo
AI "customer" or model who looks like a real person	Likely yes	Resembles a person and would pass as authentic
AI video of a real location, such as your shop front at night	Likely yes	Resembles a real place
Flat illustration, cartoon or 3D-render style graphic	Usually no	Nobody would take it for real
Real photo with AI used only to remove a stray cable or adjust light	Usually no	The content is not generated or substantially changed
Clearly fantastical ad (a sneaker walking on the moon)	Reduced duty	See the creative exception below

The last row matters for ad creative. Where the content is part of an evidently artistic, creative, satirical, fictional or analogous work, Article 50(4) limits the duty to disclosing that AI-generated content exists, in a way that does not get in the way of showing or enjoying the work. A small credit line is enough there. A campaign that looks like a real product photo is not "evidently" creative just because an agency made it.

When and how the label has to appear

Article 50(5) says the information has to be clear and distinguishable and given at the latest at the time of the first interaction or exposure, and it has to meet accessibility requirements. For social posts that means:

Feed image or carousel: put the disclosure on the image or in the first line of the caption. Captions get cut after a line or two on most apps, so a note at the end of a long caption is not seen at first exposure. If only one slide of a carousel is AI-made, label that slide.
Reel, Short or TikTok video: an on-screen text label at the start, and the first line of the caption.
Story: a text sticker on the frame itself. Stories have no caption that people read first.
Paid ads: the same rule applies to the creative. The platform's ad label is not a substitute (see below).
Alt text: add "AI-generated image of..." to the alt text as well. It helps screen reader users, which is part of the accessibility point in 50(5), but alt text alone is not a visible label.

Plain wording works: "AI-generated image", "Made with AI", or "This scene was created with AI." Avoid wording that hides it, such as "digitally enhanced", for a fully generated scene.

The platforms' own AI labels

Each big platform has its own labelling rules. They are separate from the AI Act and are set by the platforms' terms, not by EU law.

Meta (Instagram, Facebook). Meta shows an "AI info" label. It applies it when it detects industry-standard AI signals in the file or when the person uploading discloses it. Since September 2024, content that was only edited with AI tools has the label moved into the post's menu, while content detected as AI-generated keeps the visible label (Meta's newsroom post, updated through October 2025). For ads, trade press has reported that the disclosure sits in the "About this ad" panel. So a viewer may never see Meta's label on an ad.
TikTok. TikTok says it requires creators to label realistic AI-generated content and that it auto-labels some content made on other platforms by reading Content Credentials (C2PA) metadata (TikTok newsroom, 2024). Auto-labelling only works if the metadata survives your editing and export.
YouTube. YouTube requires creators to disclose meaningfully altered or synthetic content that seems realistic, through the altered-content setting in YouTube Studio. Its help page lists a real person doing or saying something they didn't, altered footage of real events or places, and realistic scenes that never happened. Clearly unrealistic or animated content, special effects and beauty filters are exempt.

Use these settings, because breaking a platform's rules can cost you reach or the post. But don't rely on them for Article 50: they may sit in a menu, they depend on metadata that editing can strip, and the duty in 50(4) is yours as the deployer, not the platform's.

Metadata: don't strip it

The machine-readable marking duty in Article 50(2) falls on the provider of the generation tool, not on the brand (see the marking guide). But your workflow decides whether that marking survives. Screenshotting an image, re-exporting it from some editors, or running it through a compressor can remove Content Credentials, which then also stops Meta and TikTok from auto-labelling it. Export from the generation tool or from an editor that keeps provenance data, and spot-check a final file with a Content Credentials inspector before you schedule a campaign.

Other EU rules still apply

The AI Act sits next to consumer law. Under the Unfair Commercial Practices Directive (2005/29/EC), a commercial practice is misleading if it deceives or is likely to deceive the average consumer about things like the main characteristics of a product. An AI image that makes a product look bigger, better made or different from what ships can be misleading whether or not it carries an AI label. The label tells people how the image was made. It does not make an inaccurate picture of the product acceptable.

A pre-posting check for social teams

[ ] Is the image or video AI-generated or substantially changed by AI?
[ ] Would a viewer take it for a real person, product, place or event? If yes, it needs a visible label.
[ ] Label visible at first exposure: on the image or video, or in the first caption line.
[ ] Platform AI setting switched on where the platform asks for it (YouTube altered content; TikTok AI-generated label).
[ ] Content Credentials still present in the exported file.
[ ] The image shows the product as it actually is.
[ ] Post and label recorded in your content log.

Sources

Regulation (EU) 2024/1689 (AI Act) on EUR-Lex: Article 3(4) (deployer), Article 3(60) (deep fake), Article 50(2), (4) and (5).
Article 50 text at artificialintelligenceact.eu.
Directive 2005/29/EC (Unfair Commercial Practices Directive) on EUR-Lex: Article 6.
Meta: Our approach to labeling AI-generated content and manipulated media, with its update notes.
Social Media Today: Meta adds updated disclosure tags for AI-generated ads, reported, for the ad placement.
TikTok newsroom: Partnering with our industry to advance AI transparency and literacy.
YouTube Help: Disclosing use of altered or synthetic content.

Article 50 fines: what Article 99 sets and who enforces it

mdodeja — Sun, 25 Oct 2026 00:13:56 +0000

Short answer. Breaking Article 50 can cost up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)(g)). For SMEs and start-ups, and since the 2026 Digital Omnibus also small mid-caps, the cap is whichever of the two is lower. These are ceilings. Member States write the actual penalty rules, and national market surveillance authorities do most of the enforcing.

The fine tiers in Article 99

Article 99 of the AI Act sets three maximum fines. Article 50 sits in the middle one.

Breach	Maximum fine	Article
Prohibited AI practices (Article 5)	EUR 35 million or 7% of total worldwide annual turnover for the preceding financial year, whichever is higher	99(3)
Other operator duties, including the Article 50 transparency obligations	EUR 15 million or 3% of total worldwide annual turnover, whichever is higher	99(4), point (g) for Article 50
Giving incorrect, incomplete or misleading information to notified bodies or national authorities	EUR 7.5 million or 1%, whichever is higher	99(5)

Point (g) of Article 99(4) refers to the "transparency obligations for providers and deployers pursuant to Article 50". Both roles are covered. A provider that ships a chatbot with no AI disclosure and a deployer that publishes an unlabelled deep fake are in the same tier.

The same 99(4) tier also covers deployer duties under Article 26 and provider duties under Article 16, which apply to high-risk systems. An agency running ordinary chatbots and content tools will mostly meet Article 50 and not those.

Smaller companies: the lower of the two

For SMEs, including start-ups, Article 99(6) flips the rule: each fine is capped at the percentage or the fixed amount, whichever is lower.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026, added Article 99(6a). It gives small mid-cap enterprises (SMCs) the same "whichever is lower" cap for fines under Articles 99(4) and 99(5), which includes Article 50. The amended Article 3 defines SMEs by reference to Commission Recommendation 2003/361/EC and SMCs by reference to Recommendation (EU) 2025/1099. Check those two documents for the headcount and turnover thresholds; this page does not restate them.

The arithmetic for the Article 50 tier:

Company	3% of turnover	Fixed amount	Maximum fine
Agency with EUR 2 million turnover, an SME	EUR 60,000	EUR 15 million	EUR 60,000 (lower)
Group with EUR 1 billion turnover, not an SME or SMC	EUR 30 million	EUR 15 million	EUR 30 million (higher)

These are maximums. Nothing in Article 99 says a first breach gets the maximum, and Article 99(1) says penalties must be "effective, proportionate and dissuasive" and must take account of the interests and economic viability of SMEs and SMCs.

What an authority weighs

Article 99(7) lists what the authority considers when it decides whether to fine and how much. In short:

the nature, gravity and duration of the breach, how many people it affected and the harm they suffered
whether other market surveillance authorities, or authorities under other laws, already fined the same operator for the same conduct
the operator's size, annual turnover and market share
financial gains made or losses avoided
how far the operator cooperated with the authorities
the operator's degree of responsibility, given its technical and organisational measures
how the breach came to light, and whether the operator reported it
whether it was intentional or negligent
what the operator did to reduce the harm

Several of these are things you can show with paperwork. A dated record of which client sites have an AI disclosure, when you added it, and what you changed after an issue was found speaks directly to responsibility, cooperation and mitigation. The client audit checklist produces that kind of record.

Article 99(1) also says the national rules can include warnings and non-monetary measures, not only fines.

Who enforces Article 50

Each Member State writes its own penalty rules within these limits and notifies them to the Commission (Article 99(1) and (2)). Enforcement of Article 50 for most systems falls to the national market surveillance authorities that each country designates under Article 70. Which body that is differs by country, so look for your government's designation rather than assuming it is the data protection authority.

The Omnibus also made the Commission's AI Office the authority for two groups of systems under the amended Article 75(1): AI systems built on a general-purpose AI model where the model and the system come from the same provider or group, and AI systems integrated into a very large online platform or search engine designated under the Digital Services Act. An agency deploying a chatbot built on someone else's model on a client's ordinary website will normally deal with the national authority, not the AI Office. Where exactly the line falls in edge cases is not settled yet.

When this applies

Article 50 applies from 2 August 2026. The Omnibus did not move that date. It added one transition: providers of generative systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the Article 50(2) machine-readable marking duty (new Article 111(4)). The chatbot disclosure in Article 50(1) and the deep fake labelling in Article 50(4) have no such extra time. The marking guide covers 50(2) in detail.

The penalty chapter itself has applied since 2 August 2025, but a fine for an Article 50 breach needs the Article 50 duty to be in force, so the practical start is 2 August 2026, and 2 December 2026 for the marking transition.

Sources

Regulation (EU) 2024/1689 (AI Act) on EUR-Lex: Articles 50, 70, 99 and 113.
Regulation (EU) 2026/1744 (Digital Omnibus on AI) on EUR-Lex: amendments to Articles 3, 75, 99 and 111.
Article 99 text at artificialintelligenceact.eu, consolidated with the Omnibus changes.
Commission Recommendation 2003/361/EC on the SME definition.

Article 50 and GDPR for chatbots: where the two overlap

mdodeja — Sat, 24 Oct 2026 00:13:49 +0000

Short answer. The two laws ask different questions. Article 50 asks whether people know they are talking to an AI. The GDPR asks what happens to their personal data. A chatbot that collects names, emails or order details needs both, and the AI Act says it does not affect the GDPR. You can put both messages at the start of the chat, but meeting one does not meet the other.

Two laws, two questions

A customer chatbot on an EU-facing site usually falls under two sets of rules at once.

	AI Act, Article 50(1)	GDPR
The question	Do people know they are dealing with an AI system?	Is their personal data handled lawfully, fairly and transparently?
Who carries it	The provider of the chatbot system (who builds or brands it)	The controller (who decides why and how data is processed), with processors acting for it
When it applies	Whenever the system interacts directly with people, unless it is obvious	Whenever the chatbot processes personal data
Main output	A clear AI disclosure at the latest at first interaction (Article 50(5))	A privacy notice, a lawful basis, contracts, security, and rights handling

Article 2(7) of the AI Act says the Act does not affect the GDPR. Article 50(6) adds that the transparency duties are without prejudice to other transparency obligations in EU or national law. So the GDPR applies in full alongside the AI disclosure; one does not replace the other.

Where they overlap

Both laws care about what the user is told at the start of the conversation. That is the one place where you can do both jobs with one design:

"You're chatting with an AI assistant. It can make mistakes, and you can ask for a person at any time. We use what you type here to answer your question. See our privacy notice for how we handle it."

The first sentence handles Article 50. The last two point to the GDPR information. The disclosure wording guide covers the AI part in more detail.

What the overlap does not do: a link to a privacy notice is not an AI disclosure, and an AI disclosure is not a privacy notice. If either half is missing, that law is not met.

GDPR points that chatbots often miss

These come up in most chatbot builds. They are general pointers, not a full GDPR review.

The privacy notice has to cover the chat. Article 13 GDPR requires information at the time data is collected: who the controller is, the purposes, the lawful basis, recipients (including the chatbot vendor), retention, and the user's rights. A site-wide notice written before the bot existed usually says nothing about chat logs.
The vendor is usually a processor. If a third-party platform or model provider processes chat content for your client, the client needs a data processing agreement with it under Article 28. Check whether the vendor uses chat data to train its models, and whether that can be switched off.
International transfers. If the vendor or its model runs outside the EU, the transfer rules in Chapter V GDPR apply. Check what mechanism the vendor relies on.
Retention. Decide how long chat transcripts are kept and delete them on schedule. "Forever, in the vendor's dashboard" is the common default and the common problem.
Users type more than you ask for. People paste order numbers, health details and account information into chat boxes. Plan for special category data even if the bot never asks for it, for example by warning users not to share it and by limiting who can read transcripts.
Automated decisions. If the bot decides something with legal or similarly significant effects on a person by itself, such as refusing a refund or a loan, Article 22 GDPR applies. Most support bots stay clear of this by handing those decisions to a person.
Impact assessment. A data protection impact assessment under Article 35 is required where processing is likely to result in a high risk. New technology handling customer data at scale is a common trigger; decide and document whether one is needed.
Cookies and local storage. A chat widget that stores identifiers in the browser can fall under the ePrivacy rules on storing and reading information on a user's device, which are separate from both laws above.

Who does what in an agency setup

Roles under the two laws do not always line up. An agency can be the provider of a branded chatbot under the AI Act while its client is the controller under the GDPR, and the agency is the client's processor. The guide on whether Article 50 applies to client chatbots covers the AI Act roles. For the GDPR, write the roles into the contract: who is controller, who is processor, and who answers access and deletion requests that arrive through the chat.

A combined launch check

[ ] AI disclosure shown before or at the first message
[ ] Privacy notice updated to cover chat data, linked from the chat window
[ ] Lawful basis for processing chat content recorded
[ ] Data processing agreement in place with the chatbot vendor
[ ] Vendor's training-on-your-data setting checked
[ ] Transfer mechanism checked if data leaves the EU
[ ] Transcript retention period set and applied
[ ] Handover to a person for decisions with significant effects
[ ] DPIA decision recorded
[ ] Widget storage covered by the site's consent setup where required

Sources

Regulation (EU) 2024/1689 (AI Act) on EUR-Lex: Article 2(7) and Article 50.
Regulation (EU) 2016/679 (GDPR) on EUR-Lex: Articles 13, 22, 28, 35 and Chapter V.
Directive 2002/58/EC (ePrivacy Directive) on EUR-Lex: Article 5(3).
Article 50 text at artificialintelligenceact.eu.
European Data Protection Board for guidance on applying the GDPR.

Should a small agency sign the Code of Practice on transparency of AI-generated content?

mdodeja — Fri, 23 Oct 2026 00:13:55 +0000

Short answer. The Code is voluntary, but Article 50 is not. Deployers, including agencies that publish AI images, video or public-interest text, may sign. Signatories can rely on the Code's measures to show they comply; everyone else has to show their own measures are adequate, case by case. For an agency that labels AI content for clients regularly, signing is worth considering once you have read Section 2 and checked you can follow it.

What the Code is

The Code of Practice on Transparency of AI-generated Content is a document drawn up by independent experts in a process run by the EU AI Office. It sets out practical measures for the marking and labelling duties in Article 50 of the AI Act, specifically paragraphs 2, 4 and 5.

It has two sections:

Section 1, providers: rules for machine-readable marking and detection of AI-generated and manipulated content. This is for the companies that build generation tools.
Section 2, deployers: rules for labelling deep fakes and AI-generated or manipulated text. This is the part that applies to agencies and brands that publish AI content.

The Commission's page says the Commission and the AI Board have confirmed the Code is an adequate voluntary tool to demonstrate compliance. It also says that by the end of July 2026 about 190 companies and organisations had signed. The Code sits alongside the Commission's guidelines on the scope of Article 50; it does not replace the Act or the guidelines.

Voluntary code, mandatory law

Signing is optional. The duties are not. Article 50 has applied since 2 August 2026, and a deployer that publishes deep fakes or AI-generated text on matters of public interest has to disclose them whether or not it signs anything. The deep fake guide and the guide on AI-written articles cover what those duties are.

So the real question for an agency is not whether to comply but how to show that it does.

What signing gets you

According to the Commission:

A recognised way to show compliance. Signatories can rely on the Code's measures to demonstrate compliance with the labelling and detection rules. That gives predictability across all member states.
Less case-by-case argument. Providers and deployers that comply by other means have to show their own measures are adequate, and that is assessed individually by different market surveillance authorities.
A seat in the Signatory Taskforces, which the Commission says will be set up to share practice on marking and labelling.

Signing does not stop you being checked, and it does not cover anything outside Article 50(2), (4) and (5). Consumer law, data protection and platform rules still apply in full.

What it costs a small agency

The Code is a commitment, not a badge. Before signing, expect to:

Read Section 2 in full and check that every measure fits how you actually make and publish content. If you sign, you are expected to follow it.
Make it part of your production process: how assets are classified, where labels go, who checks, and what record you keep. The record template in the AI-written articles guide is a starting point.
Brief staff and freelancers, because the people who make the assets are the ones who will skip the label.
Expect your name on a public list. The Commission publishes the list of signatories, so clients and competitors can see it.

A way to decide

Your situation	Suggested approach
You publish AI images, video or voice for clients every month	Read Section 2 and seriously consider signing; you need a documented process anyway
You write AI-drafted news-style or public-interest content for clients	Same, and pair it with the editorial-responsibility setup in the articles guide
You use AI mainly for internal drafts, product copy or obvious illustrations	Signing adds little; keep a short written policy and label the borderline cases
You build and sell your own generation tool	You may be a provider; Section 1 is the part to read first

Whichever way you go, write down what you do and why. If you do not sign, that written policy is what you would show an authority to demonstrate your measures are adequate.

How to sign

The Commission's Code page links to the signatory form, instructions and a questions-and-answers page on signing. Use those rather than any third-party summary, because the process and form can change.

Sources

European Commission: Code of Practice on Transparency of AI-generated Content, including the Code PDF, the signatory form and the list of signatories.
European Commission: guidelines on transparency obligations for providers and deployers of AI systems, published 20 July 2026.
Regulation (EU) 2024/1689 on EUR-Lex: Article 50, including 50(7) on codes of practice.
Article 50 text at artificialintelligenceact.eu.

What counts as a deep fake under Article 50(4)? Examples for marketing teams

mdodeja — Thu, 22 Oct 2026 00:13:43 +0000

Short answer. Under the EU AI Act a deep fake is AI-generated or manipulated image, audio or video that resembles real people, objects, places, entities or events and would falsely appear authentic. It is not limited to faces or to fakes made to deceive. A deployer who publishes one has to disclose that it is AI-made, clearly and at first exposure. Text is never a deep fake; it has its own rule.

The definition, in four tests

Article 3(60) of the EU AI Act defines a deep fake as "AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful". Recital 134 uses the phrase "appreciably resembles".

Split into tests, a piece of content is a deep fake when all four hold:

AI made or changed it. It was generated or manipulated by an AI system, not just shot and lightly retouched by hand.
It is image, audio or video. Text is never a deep fake. AI text has its own rule in the second half of Article 50(4), covered in the guide on AI-written articles.
It resembles something that exists. A real person, object, place, organisation or event. The definition is wider than faces.
A viewer could take it for real. It "would falsely appear" authentic or truthful to a person seeing it.

The definition says nothing about intent. A harmless, well-meant ad can meet it. The question is how the content looks to the audience, not what the brand meant.

What the duty is

Article 50(4) says deployers of an AI system that generates or manipulates content constituting a deep fake "shall disclose that the content has been artificially generated or manipulated". Article 50(5) adds that the information must be clear and distinguishable and given at the latest at the time of first exposure, and must meet accessibility requirements.

In marketing, the deployer is usually the brand or agency that uses the AI tool to make the asset and publishes it. The tool vendor has a separate duty under Article 50(2) to mark output in machine-readable form; that mark does not replace your visible disclosure.

There is one softer track. Where the content is part of an "evidently artistic, creative, satirical, fictional or analogous work or programme", the disclosure can be limited to saying such content exists, "in an appropriate manner that does not hamper the display or enjoyment of the work". Most ads are not evidently fictional works, so do not lean on this by default.

Worked examples

These are readings of the definition, not official classifications. The Act does not list examples, so treat borderline cases as covered.

Content	Deep fake?	Why
A video ad with an AI avatar of a real, named spokesperson	Yes	AI-made video resembling an existing person, presented as them
A cloned voice of a real presenter reading a radio ad	Yes	AI audio resembling an existing person
A photorealistic AI "customer" giving a testimonial	Likely yes	Resembles a real person to the viewer and appears authentic; it may also break consumer law if presented as a real customer
AI photo of your real product in a kitchen it was never in	Likely yes	Resembles an existing object and appears to be a real photo
AI-generated photo of your real shop front or a real landmark	Likely yes	Resembles an existing place
AI-made "footage" of a launch event that did not happen as shown	Yes	Resembles an event and appears truthful
Obviously illustrated or cartoon-style artwork	Usually no	Would not falsely appear authentic
A clearly stylised 3D render of a concept product	Usually no	Not presented or likely taken as a real photo
Background removal, colour correction, light retouching	Usually no	Not substantial AI generation or manipulation of what is shown; keep it minor
AI-written ad copy or captions	No	Text is outside the deep-fake definition

A grey area is the photorealistic AI person who does not exist. Such a person does not resemble a specific existing person, but the image still presents a "real" person in a real-looking scene, and it can resemble existing places or events. The Act does not settle this. If an audience would believe the image is a photograph, label it.

How to label the ones that qualify

Images: a short line on or next to the image, such as "AI-generated image" or "Image created with AI". Not in alt text alone and not in a footnote page.
Video: an on-screen label from the start, kept visible or repeated, plus a line in the caption or description.
Audio: say it at the start, for example "This ad uses an AI-generated voice." In a podcast or radio slot, put it in the spoken part, not only in show notes.
Social posts: use the platform's AI label where one exists and also say it in the caption. Platform labels differ and can be hidden in some views.
Carousels and galleries: label each AI image, or label the set clearly at the start if all are AI-made.

The Commission's Code of Practice on transparency of AI-generated content includes common icons that deployers may use. Using the code is voluntary; the disclosure duty is not.

Beyond the AI Act

Article 50(6) keeps other laws in force. For marketing that matters in three places:

Consumer protection. An AI "customer" or an edited product image that misleads buyers is a problem under EU consumer law whether or not it carries an AI label.
Personality and image rights. Using a real person's face or voice needs their permission. A label does not fix a missing consent.
Platform rules. Ad platforms and social networks have their own AI and synthetic-media policies, which change often.

Sources

Regulation (EU) 2024/1689 on EUR-Lex, the official text: Article 3(60), Article 50(4) to (6), Recital 134.
Article 50 text, Article 3 definitions and Recital 134 at artificialintelligenceact.eu.
European Commission: guidelines on transparency obligations for providers and deployers of AI systems, published 20 July 2026.
European Commission: Code of Practice on Transparency of AI-generated Content.