AI Disclosure Duty: What Has Applied Since 2 August 2026

Since 2 August 2026, every company must disclose when customers are speaking or writing to an artificial intelligence. The obligation comes from Article 50 of the EU AI Act, it applies regardless of company size, and it is the first rule of this regulation that hits ordinary mid-sized businesses directly in daily operations. Anyone running a website chatbot, a phone assistant or AI-answered customer enquiries is affected.

Key takeaway: Article 50 of the EU AI Act has applied since 2 August 2026. Anyone using a chatbot, voice bot or AI assistant in customer contact must make it clearly recognisable at first contact that the response comes from a machine. A note only in the terms, legal notice or privacy policy is not enough under the European Commission's guidelines of 20 July 2026. This also applies to systems already running before the cut-off date; the only transitional period, until 2 December 2026, concerns the machine-readable marking of generated content under paragraph 2. Violations can be penalised with up to 15 million euros or 3 percent of worldwide annual turnover.

What has applied since 2 August 2026?

The transparency obligations under Article 50 have been binding since that date. The core in one sentence: people must know they are dealing with an AI, and they must know it before disclosing something they might have phrased differently to a human.

The regulation distinguishes four cases:

For the typical mid-sized company, row one is the practically relevant case. Row two concerns the providers of systems that generate text, images, audio or video, regardless of whether the content is published.

Timing matters: the information must be available at the first interaction at the latest, clearly and distinguishably. A note that only appears after three exchanged messages does not satisfy the obligation.

Wasn't the AI Act postponed?

Partly, but not this part. This is currently the most common misunderstanding, and an expensive one.

With the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) the EU postponed several AI Act deadlines. Affected are primarily the obligations for high-risk systems: the requirements from Annex III apply only from 2 December 2027, those from Annex I from 2 August 2028. That postponement made headlines and left many with the impression that the AI Act had been defused across the board.

Article 50 was explicitly excluded from this deferral. The transparency obligations have applied since 2 August 2026 as originally planned. The only transitional period concerns the machine-readable labelling of generated content under Article 50 paragraph 2: providers of systems placed on the market before 2 August 2026 have until 2 December 2026 for it. Anyone who relied on the Omnibus headlines is behind.

The distinction has a practical reason: the high-risk rules require elaborate conformity assessments for which technical standards are still missing. Labelling a chatbot, by contrast, takes an hour.

What do the European Commission's guidelines say?

Since 20 July 2026 there has been official interpretive guidance: the European Commission published guidelines on Article 50 (C(2026) 5054). They are not binding, as the final word lies with the Court of Justice of the EU, but they show what supervisors will measure deployments against. For companies running a chatbot or phone assistant they contain five clarifications:

1. Having it built makes you a provider too. Anyone who has a chatbot developed and puts it into service under their own name is the provider and must ensure the disclosure. Anyone using a provider's finished system unchanged is a deployer; the provider must then build the disclosure into its system.
2. One notice per conversation is usually enough. According to the guidelines, a clear notice before the first interaction suffices in most cases. The Commission considers repeated notices likely to be necessary in sensitive contexts, such as financial, insurance, legal and health advice, complaints, and conversations with children or older people. If someone asks, the system must disclose that it is an AI.
3. AI agents also name their principal. An agent that books appointments, handles correspondence or triggers orders must identify itself as AI and state on whose behalf it is acting. For an email an agent sends itself, this can be done with an AI notice at the top, for example.
4. Aids for humans are not covered. If the AI only drafts a suggestion that a service employee reviews and sends personally, there is no direct interaction. Likewise, automatic text completion, translation tools, spam filters, classic out-of-office replies and rule-based quick answers fall outside.
5. The "obvious" exception is narrow. A customer service chatbot is expressly not considered obvious. It can be met by an internal assistant used by trained staff who know they are working with AI.

The Commission is just as clear about what is not enough on its own:

Am I affected by the disclosure duty?

Three questions are enough for a first assessment. One yes is sufficient:

1. Do customers, applicants or suppliers communicate with a system that formulates answers itself rather than playing back prepared text blocks?
2. Does your company publish text, images or audio that were wholly or largely generated by an AI?
3. Does a system analyse voices, faces or emotions of individuals?

Not affected are classic forms, rule-based menus without a generative component, and internal tools without external contact, provided no employees are deceived. A contact form remains a contact form.

Company size is irrelevant. There is no de minimis threshold and no exemption for small businesses.

All of this applies unchanged in Austria, because the AI Act takes direct effect there. A company in Switzerland does not fall under it directly, but can be covered via Article 2 as soon as its chatbot or phone assistant serves customers in the EU. The position for both countries is set out in our article on the EU AI Act for SMEs.

How must a chatbot be labelled?

Visibly, understandably, and inside the dialogue itself. The disclosure belongs where the conversation happens, not in a legal document nobody opens.

A short sentence as the first message in the chat window has proven effective. It should contain two things: the fact that an AI is answering, and the route to a human.

An example covering both:

You are chatting with an AI assistant. It answers questions about products, prices and appointments. If you would rather speak to a person, simply type "agent" or call us at the number provided.

What is not sufficient:

• a sentence in the legal notice or privacy policy
• a bot name such as "Anna" or "Max" without further indication, since it rather suggests a human
• a note displayed only after the conversation
• a symbol-only marking whose meaning is not self-evident

The "unless obvious" exception should not be overstretched. It applies where a reasonable user recognises the machine anyway. With a modern language model producing natural sentences, that is precisely no longer the case. When in doubt, label it.

What applies to voice bots on the phone?

The same obligation, only with less room. On the phone there is no chat window to write a note into, so the disclosure must be spoken.

In practice that means a greeting clarifying the nature of the counterpart right away, for example: "Hello, you are speaking with the AI assistant of Muster Medical Practice. I can book appointments and take prescription requests. For anything else I will connect you with the team." The word AI belongs in the sentence, because the Commission's guidelines treat a mere reference to an assistant as an ambiguous signal.

Four points often forgotten in practice:

• The note must come before the first substantive question, not after.
• In longer calls, after an interruption or when the assistant takes on a new task, the guidelines recommend a reminder. A tone can help recognition but does not replace the spoken sentence.
• The route to a human should work at every stage of the conversation, not only at the start.
• If the call is recorded or transcribed, data protection information is added. That is a separate GDPR obligation and does not replace the AI disclosure.

Do companies have to label AI-generated texts and images?

Yes, but the obligation is split between two parties. Providers of generative systems must mark their outputs in machine-readable form, for instance through watermarks or metadata. This duty falls on the makers of the models and tools, not on the mid-sized company using them.

As a deployer you are obliged when you publish deepfakes or distribute AI-generated texts on matters of public interest. An AI-written piece about a political debate falls under this; an automatically generated product description in a shop generally does not. The Commission's guidelines draw the line with examples: advertising copy and product descriptions are not covered as long as they make no claims about, for example, health, consumer safety or sustainability; an AI-revised corporate report with investor information on a listed company's website, by contrast, is. Internal texts, such as on the intranet, and personal correspondence do not count as published.

For texts there is an exception open to many companies: no label is needed if a knowledgeable person has reviewed the content thoroughly, facts included, and a person or company holds editorial responsibility whose name and contact details are easy to find, for instance in the website's legal information. A spell check, a cursory nod or an editorial policy that exists only on paper are not enough. Anyone who has the AI rewrite the substance again after sign-off loses the exception.

Nobody has to label retroactively: content generated and published before 2 August 2026 is unaffected. A text generated earlier but published only afterwards, however, falls under the duty. For visible labelling, a voluntary code of practice has existed since 10 June 2026, which the Commission and the AI Board have confirmed as an adequate means of demonstrating compliance. In addition, the EU has published a common set of icons that deployers can use to label AI-generated content.

For most companies this means: check which tools you use and whether their outputs are marked. And label voluntarily where readers would otherwise be misled. That is the better position anyway should case law tighten the boundaries later.

Am I a provider or a deployer?

This is the pitfall on which most responsibility questions hang. In principle, the provider is whoever develops an AI system and places it on the market; the deployer is whoever uses it.

The role can shift, however: anyone who has a system developed, or modifies someone else's system, for example with their own training data, and puts it into service under their own name or trademark becomes a provider themselves (Article 3 point 3) and takes on the more extensive obligations. The Commission's guidelines give two examples: a company that develops a chatbot in-house and uses it under its own name, and a company that modifies an existing system with new training data. Anyone who uses a ready-made product unchanged remains a deployer according to these examples. A chatbot that a service provider builds specifically for you and that you present as "your personal adviser from Muster GmbH", by contrast, puts you in the provider role. For high-risk systems, Article 25 already makes putting your own name on someone else's system enough.

That is why two points belong in every contract with an AI service provider: a clear assignment of roles, and written assurance that the labelling is technically implemented. Which further evidence to request from the provider is shown in the guide to vendor assessment under the AI Act and GDPR. If in doubt, have it reviewed by a lawyer. This article does not constitute legal advice.

What applies to chatbots already running?

There is no grace period for the notice in the dialogue: a chatbot or phone assistant that was already running before 2 August 2026 has had to identify itself since then, just like a new one. The only transitional period, until 2 December 2026, concerns the machine-readable marking of generated content under Article 50 paragraph 2, for systems placed on the market before 2 August 2026.

Anyone whose running chatbot is not yet labelled should therefore fix that immediately. Visibly labelling a chatbot is not a development project but a text change taking a few minutes.

What does a violation cost?

The range is up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher. For small and medium-sized enterprises including start-ups, the regulation provides for mitigation: here the lower of the two values applies.

These figures are the statutory maximum, not the standard case. More realistic for most businesses is a different kind of damage: a warning letter from competitors, a notice from the supervisory authority, or simply the loss of trust when a customer realises they unknowingly spoke to a machine.

How do I implement this in five steps?

1. Take inventory. List every system that communicates with people or generates content: website chat, phone assistant, WhatsApp channel, automatic email replies, text generators in marketing.
2. Clarify roles. Determine for each system whether you are provider or deployer, and obtain the service provider's assurance in writing.
3. Draft the disclosure. One sentence per system, in your customers' language, with the route to a human. No legalese.
4. Build it in. As the first chat message, as a spoken greeting, as a visible note in the interface. Not in the legal notice.
5. Document it. Record which system is labelled how and since when. It takes ten minutes and is the difference between "we implemented it" and "we can prove it".

Frequently asked questions about the disclosure duty

Conclusion

Article 50 is the first rule of the EU AI Act that does not demand a compliance project but a decision: tell your customers they are talking to a machine. The effort is about an hour, the benefit considerably greater, because transparency at this point does not cost conversion in our experience. It only prevents the awkward discovery at the wrong moment.

For a broader overview of all AI Act obligations for mid-sized companies, see our article EU AI Act 2026: What German SMEs with AI agents need to know.

How the disclosure can be handled inside a live assistant without disrupting the conversation is shown on the AI chatbot page.

This article was published on 4 August 2026. Austria and Switzerland were added on 18 September 2026, we corrected the transitional period on 16 October 2026, and on 18 October 2026 we incorporated the European Commission's guidelines of 20 July 2026. It does not constitute legal advice. For a binding assessment of your individual case, please consult a qualified lawyer.

Sources

• Regulation (EU) 2024/1689 (EU AI Act), Article 3 point 3, Articles 50 and 99
• Regulation (EU) 2026/1744 (Digital Omnibus on the AI Act) - EUR-Lex; transitional period until 2 December 2026 only for Article 50 paragraph 2
• European Commission: Guidelines on the transparency obligations under Article 50 of the AI Act, C(2026) 5054 of 20 July 2026 - providers and deployers, timing and form of disclosure, AI agents, obviousness exception, texts of public interest and editorial review, no retroactive labelling
• European Commission: Code of Practice on Transparency of AI-generated Content - final code of 10 June 2026, confirmed as adequate by the Commission and the AI Board, alongside the EU icons for labelling
• European Commission: Transparency obligations under Article 50 of the AI Act - questions and answers on the obligations from 2 August 2026, including the transitional period for paragraph 2 until 2 December 2026