AI disclosure requirements: when you must tell people it's AI

Until recently, telling people they were dealing with AI was a courtesy. In the EU it is now a legal duty with a start date that has already passed. Article 50 of the EU AI Act has applied since 2 August 2026, and it covers the situations ordinary businesses create every day: a chatbot on your website, an AI-written article, a generated image in an ad, a tool that analyses voices or faces. This post sets out the four duties in plain language, who carries each one, and what a disclosure has to look like to count.

Quick answer

• Talking to AI: people interacting with an AI system — a chatbot, a voice agent — must be told it is AI, unless that is genuinely obvious. (Article 50(1).)
• AI-made content: generative AI output must carry a machine-readable mark so it can be detected as AI-generated. This duty sits on the provider of the tool. (Article 50(2).)
• Being analysed by AI: if you use emotion recognition or biometric categorisation on people, the people exposed must be informed. (Article 50(3).)
• Deepfakes and AI-written public text: if you publish a deepfake, or AI-generated text meant to inform the public on a matter of public interest, you must disclose that it was artificially generated — unless a named person reviewed it and takes editorial responsibility for it. (Article 50(4).)
• All four have applied since 2 August 2026. Breaches sit in the penalty tier of up to €15 million or 3% of worldwide annual turnover — with a lower cap formula for small businesses, explained below.

The four duties, one by one

1. Chatbots and AI agents: say so at the start

Article 50(1) requires that AI systems intended to interact directly with people are designed so users are informed they are interacting with AI — unless it would be obvious to a reasonably well-informed, observant person. Read the exception narrowly. A support widget named "Support Bot" may be obvious; a chat window staffed by "Alex, Customer Care" is not.

Formally, this design duty sits on the provider of the system. Practically, it is your website, your chat window and your customer. If the notice is switched off, buried in settings, or appears only after the conversation ends, it is your business that the customer — and a regulator — will come to. Check how your tool is actually configured, not how the vendor's brochure describes it.

2. Machine-readable marking of AI output

Article 50(2) requires providers of generative AI systems to mark their outputs in a machine-readable format — metadata, watermarking or similar techniques — so content can be detected as AI-generated or manipulated. As a business using these tools, this is mostly a procurement question: ask your vendors how their marking works and whether it survives your normal handling of files. One timing point: systems already on the market before 2 August 2026 have a grace period for this marking duty, ending 2 December 2026. The other Article 50 duties have no grace period.

3. Emotion recognition and biometric categorisation: tell the people exposed

If your business deploys a system that recognises emotions or categorises people biometrically — some call-analytics, proctoring and retail tools do — Article 50(3) requires that the people exposed to it are informed. Note the boundary: some emotion-recognition uses, in workplaces and education settings, are prohibited altogether under Article 5 rather than disclose-and-proceed. If a vendor sells you emotion analysis of staff or students, disclosure alone does not settle it.

4. Deepfakes and public-interest text: label what you publish

Article 50(4) is the duty most likely to catch a marketing or communications team. Deployers must disclose:

• Deepfakes — AI-generated or manipulated image, audio or video content that resembles real people, places or events and could pass as authentic. There is limited room for evidently artistic or fictional work, where disclosure can be made in a way that doesn't obstruct the work itself.
• AI-generated text published to inform the public on matters of public interest — news-style content, public information pages, statements. The exception: the disclosure is not required where the text has been through human review and a natural or legal person takes editorial responsibility for it. A spell-check does not meet that bar; a named editor who reviewed and stands behind the piece does.

Routine commercial copy — a product description, a routine ad — is generally outside the public-interest limb. The closer your content gets to news, public information or a person's likeness, the more likely the duty applies.

What counts as disclosure — and what doesn't

The Act's standard is functional: the person has to actually be informed, at the point it matters. In practice:

• At the start, not the end. A chatbot disclosure belongs in the first exchange, not in a transcript footer.
• In the open, not in the small print. A line in your terms of service, or a footer link three clicks deep, is disclosure on paper only. Put it where the interaction happens.
• In plain words. "You're chatting with an AI assistant" works. "This experience is powered by next-generation conversational technology" does not tell anyone anything.
• Next to the content. For published material, the label travels with the piece — a caption, a byline note, an on-screen credit — not a policy page somewhere else on your site.

Illustrative wording, to adapt rather than copy as legal text:

• Chatbot: "You're chatting with an AI assistant. If you'd rather speak to a person, type 'agent' at any time."
• Article: "This article was drafted with AI assistance and reviewed by [name], who takes editorial responsibility for it." — or, without that review: "This article was generated by AI."
• Image or video: "Created with AI."

The European Commission has published guidelines and a code of practice on marking and labelling AI-generated content, which are the reference points if you need the detailed version.

Beyond the EU

The EU is the furthest ahead, not the only mover. California's AI Transparency Act became operative on 2 August 2026; its duties fall on the largest generative AI providers — systems with over a million monthly users must offer a free detection tool and build in visible and embedded disclosures — so as a small business you will feel it through your tools rather than carry it directly. Other US states are adding narrower rules of their own. Canada has no equivalent general AI-disclosure statute in force; there, disclosure expectations still arrive mainly through privacy and consumer-protection law. The direction is consistent everywhere: assume AI involvement will need to be disclosed, and build the habit now.

Penalties

Article 50 breaches fall under Article 99(4) of the Act: up to €15 million or 3% of total worldwide annual turnover, whichever is higher, with Member States setting the actual fines. For small and medium-sized enterprises and start-ups, the cap is the lower of the two figures. As with most of the Act, the proportionate outcome for a small business that fixes a missing label is different from the headline ceiling — but "we didn't know" stopped being available on 2 August 2026.

Frequently asked questions

We use an off-the-shelf chatbot. Is disclosure our problem or the vendor's?

Both, in different ways. The provider must design the system so users can be informed; you are the one who configured it, branded it and put it in front of your customers. Verify the notice is on, visible and early — don't assume the default setting is compliant.

Does every AI-written social post need a label?

Article 50(4)'s text duty concerns text published to inform the public on matters of public interest. A routine promotional post is generally outside it; a post presenting itself as news or public information is closer to the line. Deepfake-style media is covered regardless of topic.

Our editor reviews everything the AI drafts. Are we covered?

For the public-interest text duty, yes — if the review is real and a person takes editorial responsibility for publication. Document who that person is and what the review involves; an undocumented claim of review is hard to defend later.

What about AI used internally, where the public never sees it?

Article 50 is about people interacting with AI or consuming its output. A purely internal drafting aid that never reaches the public usually carries no Article 50 duty — though the Act's staff AI-literacy duty (Article 4) still applies to your team, and your customers may ask about internal use in their own due diligence.

Is there a grace period?

Only for one piece: the machine-readable marking duty for generative AI systems that were already on the market before 2 August 2026, which runs to 2 December 2026. The chatbot, emotion-recognition and deepfake/text disclosure duties have applied in full since 2 August 2026.

Put the habit in writing

Disclosure works when it is a rule, not a memory. The businesses that handle this well write down which tools get used for what, where the labels go, and who is responsible — the same practices the Ethicality AI Use Standard (EAUS) checks. Our free templates include disclosure language you can adapt, and the FAQ covers how certification treats public disclosure of your AI use. If you want those practices independently assessed, get certified — the assessment is free, and you pay only if you pass.