AI disclosure for chatbots: what Article 50 of the EU AI Act asks of small businesses in customer chat
Since August 2, 2026, Article 50 of the EU AI Act has required that customers learn when an AI is answering them. What that means for businesses that bought their chatbot, what counts as a notice, and ready lines for website chat, WhatsApp, email and SMS.
Contents
A shoe shop calls its chatbot “Lena” and gives it a photo of a sales assistant. At 11:10 pm, a customer asks: “Lena, are you real?” Since August 2, 2026, a reply that dodges the question gets the shop into trouble with the EU's AI Act.
To you, that may sound like yet another rule with a fine attached. Really, it comes down to a few sentences in the right places, and here they are: for website chat, WhatsApp, email and SMS.
What Article 50 has required since August 2, 2026
The core rule is in Article 50(1) of the AI Act, Regulation (EU) 2024/1689. AI systems that interact directly with people must be built so that those people learn they are dealing with an AI system.
The only exception is when, given the circumstances, this is already obvious “from the point of view of a natural person who is reasonably well-informed, observant and circumspect” (full text of Article 50). Article 50(5) covers the how: clear and distinguishable, at the first interaction at the latest, and accessible.
Why the exception rarely applies in customer service
Don't count on that exception. The European Commission's guidelines on Article 50 of July 20, 2026 read it narrowly: it should only apply where there is practically no doubt.
As an example where it explicitly does not apply, the guidelines name AI chatbots on help desks whose answers customers could mistake for a person's (paragraph 45).
No delay for the notice in the chat
Article 50 has applied since August 2, 2026. The package known as the AI Omnibus was published in the Official Journal of the EU on July 24, 2026 (overview by the Future of Privacy Forum), and it postpones only one duty in Article 50.
For generative systems already on the market before August 2, 2026, the duty under Article 50(2) to mark output so machines can read it applies only from December 2, 2026. There is no delay for the notice in the chat. The Commission makes that clear in paragraph 153 of its guidelines.
What a breach can cost
Under Article 99(4), breaking Article 50 can cost up to €15 million or 3% of worldwide annual turnover. For small and medium businesses, Article 99(6) caps it at whichever of the two amounts is lower.
In Germany, the Federal Network Agency (Bundesnetzagentur) has been the supervising authority since the German AI market surveillance act (KI-Marktüberwachungsgesetz) came into force on July 29, 2026 (summary by the IHK Elbe-Weser chamber of commerce, in German).
What the duty doesn't cover
According to the guidelines, two things fall outside Article 50(1) (paragraph 30):
- classic away messages and quick replies that follow fixed rules, because there is no AI system behind them
- replies that an AI only suggests to your team, as long as a person checks them and sends them personally
The mere chance that someone might look a reply over is not enough for that.
Austria, Switzerland and businesses outside the EU
The regulation applies directly in every EU country, so in Austria just as in Germany. Under Article 2(1)(c), it also covers businesses outside the EU when the output of their AI system is used in the EU.
In Switzerland, the AI Act does not apply directly. But the Swiss Federal Data Protection and Information Commissioner writes that under the current data protection act, users already have the right to know whether they are talking or writing to a machine (FDPIC, May 2025).
Provider or deployer: who carries the duty
Article 50(1) is addressed to the provider. Under Article 3(3), that is anyone who develops an AI system, or has one developed, and places it on the market or puts it into service under their own name or trademark.
Under Article 3(4), the deployer is anyone who uses an AI system under their own authority in a professional context.
If you buy a chatbot off the shelf and connect it to your website or your WhatsApp number, you are, as a rule, the deployer. That's the view of NordFlux in a guide to Article 50, and of onlinemarktplatz.de (in German).
The Commission sees it the same way. In paragraph 11, it names as the provider the company that supplies a chatbot under its own name to other businesses, which then use it without changes.
Where opinions differ
The line isn't perfectly clean. Anyone who modifies an existing system (the guidelines give new training data as an example) and then puts it into service under their own name becomes the provider of the new system.
The guidelines don't say outright whether giving the bot you bought your own FAQ, your menu and a name like “Lena from the shoe shop” is already enough to cross that line.
The German law firm Härting considers it possible that a company becomes the provider if it has a system built for it and uses it under its own name. The site onlinemarktplatz.de warns that anyone who substantially modifies a system or offers it under their own brand could slip into a different role.
The guidelines themselves are not binding. In the end, only the Court of Justice of the European Union can interpret the regulation with binding effect, as the Commission writes in paragraph 5.
What the dispute means for you
For you as an owner, it matters less than it sounds. The duty is met once the notice reaches the customer, no matter who produces it on the technical side.
That's why NordFlux advises settling three things in your contract with the software vendor: who delivers the notice, who documents it and who is liable if it's missing.
On top of that, paragraph 50 of the guidelines says consumer protection law keeps applying alongside, even where the AI would be obvious. So a bot that poses as a member of staff is risky even without the AI Act.
This post is general information, not legal advice. For questions about your own case, talk to a lawyer who specializes in IT law.
What counts as a notice and what doesn't
Article 50 doesn't prescribe any particular wording. But in paragraphs 37 and 38, the guidelines get fairly concrete.
Works well
- a greeting that calls the AI an AI in its very first sentence
- a clearly visible notice close to the field where people type, in plain words
- a permanent icon or label in the chat window, in addition to the text
- for emails an AI writes, a notice in the email itself (the guidelines give an AI label at the top of the email as an example)
Not enough on its own
- a sentence only in your terms and conditions, your privacy policy or behind a link
- vague words like “assistant” without the word AI, and profile pictures that look human
- blanket statements like “We use AI on this website”
- purely technical details like “based on a language model”
When to repeat the notice
According to paragraph 40, one clear notice before the first reply is enough in most cases. The Commission considers reminders along the way necessary for:
- complaints
- questions about money, the law or health
- people who are easier to mislead, such as children or older people
And if someone asks “Are you human?”, the AI has to answer honestly.
Channel by channel, with lines you can copy
The examples come from three fictional businesses: a shoe shop, a restaurant and an electrical contractor. Swap in your own names.
| Channel | Where the notice goes | What to avoid |
|---|---|---|
| Website chat | In the greeting that appears before anyone types | A stock photo of a real person as the bot's picture |
| Above the AI's first reply | Putting the notice only in your profile description | |
| In every single email the AI writes | Putting the line only in the footer, between the legal notice and the privacy policy | |
| SMS | Briefly, at the start of the first reply | Leaving the notice out because the message is short |
Website chat: the shoe shop
In the chat window on a website, customers are most likely to expect a person, because the team often answers there too. So the line belongs in the greeting:
Hi, I'm the AI assistant at Sample Shoes, and I answer questions about sizes, shipping and returns right away. If you'd rather chat with someone from the team, just let me know.
Give the bot a picture that looks like a bot, for example your logo or a drawn character. The guidelines explicitly name a profile picture with a human face as something that makes an AI harder to recognize (paragraph 45).
WhatsApp: the restaurant
On WhatsApp, guests write the way they text their friends. Hardly anyone opens the profile description, so the line goes above the first reply:
You're chatting with the AI assistant at Sample Trattoria. Only our team can confirm your table.
For automated replies, WhatsApp also requires a quick, clear and direct way to reach a person, such as a handover in the chat, a phone number or an email address (WhatsApp Business Messaging Policy, as of September 23, 2026).
The away message in the WhatsApp Business app, on the other hand, follows fixed rules and has no AI behind it, so Article 50 doesn't cover it. Which guest questions an AI should answer at a restaurant in the first place is covered in our post AI for restaurants.
Email: the electrical contractor
An electrical contractor lets an AI answer questions about appointments, emergency service and missing paperwork first. But emails are often read hours later, forwarded or printed out.
That's why the notice goes into every email the AI writes, as a sentence of its own in the body:
This reply was written by the AI assistant at Sample Electric. Reply with “human” and someone from the office will get back to you.
SMS: the shoe shop again
By text, almost everyone asks just one thing: where's my package? The notice still goes into the first reply, it just needs to be short:
Sample Shoes AI assistant: Your order has been on its way since yesterday. Would you rather text with the team? Just say so.
Telegram, LINE, X and the phone
Telegram, LINE and direct messages on X work the same way as WhatsApp. On the phone, the line goes at the very start, before the caller explains what they need.
Your check for this week
- Write down every place where an AI answers your customers: website chat, WhatsApp, email, SMS, phone.
- From your personal phone, send your own business a question on each of these channels. Does the notice appear before or in the first reply?
- Ask “Are you human?” and read what comes back.
- Check the bot's name and picture. A first name alone gives nothing away, so “AI assistant” belongs next to it.
- Take dated screenshots and file them. NordFlux recommends exactly this kind of record.
- Agree in writing with your software vendor who delivers the notice and what happens if it's missing.
Finally, check that people can reach a person at any time. Article 50 doesn't require that, but WhatsApp's policy for automated replies does.
How Fynn identifies itself as AI in Deskwoot
Deskwoot is our own product. In Fynn, the AI assistant inside it, the notice is built in and can't be switched off. You only choose the name of the bot and of your business (how the AI notice works).
What your customers see
- On WhatsApp, SMS, Telegram, LINE, X, Microsoft Teams and Discord, a line like “Fynn, the AI assistant of Sample Shoes” sits above Fynn's first reply, and again after a reply from your team.
- Every email from Fynn ends with “This reply was written by Fynn, the AI assistant of Sample Shoes.” If Fynn is allowed to hand over, a note follows that replying with “human” is enough.
- In the website chat, Fynn shows up with its name and picture, or with a robot icon if you haven't uploaded one. You write the first sentence yourself, in the greeting (how to customize the widget).
- If someone asks whether they're talking to a person, Fynn says in their language that it's an AI assistant, even under a human name. If someone wants a person, Fynn hands over to your team, as long as the bot is allowed to hand over in that inbox (the default setting).
The line appears in the customer's language if that's English, German, Spanish, French or Portuguese, and otherwise in your workspace's language.
Replies from your team carry no notice, even when Copilot suggested them. So read those drafts before you send them.
Your next step
In the live demo for restaurants, trades or online stores, ask Fynn: “Are you human?” Then create a workspace at deskwoot.com/signup and run steps 2 and 3 of your check on one channel.
Your first 7 days run on the Enterprise plan, with no credit card and for up to 30 people including you. After that, Fynn comes with the Startup plan and up, from $4 per agent a month (see pricing). If you don't pay, you keep the free Hacker plan, just without Fynn.
Also available in:DeutschEspañolFrançaisPortuguês (Brasil)
