{"id":8575,"date":"2026-08-04T21:59:17","date_gmt":"2026-08-04T21:59:17","guid":{"rendered":"https:\/\/dextora.agency\/?post_type=insight&p=8575"},"modified":"2026-08-04T21:59:17","modified_gmt":"2026-08-04T21:59:17","slug":"ai-act-article-50-chatbot-disclosure-deployer","status":"publish","type":"insight","link":"https:\/\/dextora.agency\/en\/insights\/ai-act-article-50-chatbot-disclosure-deployer\/","title":{"rendered":"Got a Chatbot on Your Site? Since 2 August 2026 the AI Act Says Someone Has to Tell the Visitor"},"content":{"rendered":"

On 2 August 2026 the transparency chapter of the EU AI Act became applicable. Three days on, most of the businesses affected by it still do not know they are affected, because the rule does not arrive addressed to them. It arrives addressed to the company that built the chatbot. The company that merely bought one, dropped it into the corner of its website and named it after a friendly-sounding assistant is nonetheless in scope, in ways that are worth spelling out precisely.<\/p>\n

This article sets out what actually changed, who carries which duty, and what a compliant disclosure looks like in practice. It is written for the operator of an ordinary commercial website, not for a model developer.<\/p>\n

What became applicable, and on what authority<\/h2>\n

The instrument is Regulation (EU) 2024\/1689<\/a>, the AI Act. Article 113 staggers its application across several dates, and 2 August 2026 is the general one for Chapter IV, which contains Article 50, the transparency obligations for providers and deployers of certain AI systems.<\/p>\n

The European Commission published a dedicated FAQ on the Article 50 transparency obligations<\/a> on 24 July 2026, nine days before the date. It is short, it is not binding, and it is currently the clearest statement of how the Commission reads the provision.<\/p>\n

The four criteria that make a chatbot a chatbot<\/h2>\n

Article 50(1) is not drafted around the word “chatbot” at all. It covers “AI systems intended to interact directly with natural persons”. The Commission FAQ unpacks that into a set of conditions that have to be met together. Miss one and the duty does not bite.<\/p>\n\n\n\n\n\n\n\n\n
Condition<\/th>\nWhat it excludes<\/th>\n<\/tr>\n<\/thead>\n
The thing qualifies as an AI system<\/td>\nA scripted decision tree with fixed answers and no inference is arguably not one<\/td>\n<\/tr>\n
It is designed for a genuine two-way exchange<\/td>\nA lead form, a survey widget or anything that only collects and does not converse<\/td>\n<\/tr>\n
The interaction is direct: the system itself communicates<\/td>\nA tool that drafts a reply for a human agent who then sends it<\/td>\n<\/tr>\n
The counterparty is a natural person<\/td>\nMachine-to-machine exchanges, and pure business-to-business API traffic<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

There is one further escape hatch in the text itself. The duty does not apply where the AI nature “is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use”. The Commission says this exemption should be read restrictively, because it takes transparency away from people. Betting your compliance on “everyone knows it is a bot” is a poor bet, and it gets worse the more human the persona is.<\/p>\n

Provider or deployer: the distinction that decides who is on the hook<\/h2>\n

This is where most summaries go wrong, including some written by vendors selling the fix. The Act defines both roles, and Article 50 assigns different paragraphs to each.<\/p>\n\n\n\n\n\n\n\n\n\n
Provision<\/th>\nWho owes it<\/th>\nSubstance<\/th>\n<\/tr>\n<\/thead>\n
Article 50(1)<\/td>\nProvider<\/td>\nDesign the system so people are informed they are interacting with an AI system<\/td>\n<\/tr>\n
Article 50(2)<\/td>\nProvider<\/td>\nMark synthetic audio, image, video or text in a machine-readable format<\/td>\n<\/tr>\n
Article 50(3)<\/td>\nDeployer<\/td>\nInform people exposed to emotion recognition or biometric categorisation<\/td>\n<\/tr>\n
Article 50(4)<\/td>\nDeployer<\/td>\nDisclose deep fakes, and AI-generated text published to inform the public on matters of public interest<\/td>\n<\/tr>\n
Article 50(5)<\/td>\nBoth<\/td>\nDeliver the information clearly and distinguishably, at the latest at first interaction, meeting accessibility requirements<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Read strictly, the chatbot disclosure in Article 50(1) is a provider obligation. A shop that licenses a widget is a deployer, and the specific duties that name deployers are 50(3) and 50(4). That is the accurate legal position and it is worth stating plainly, because the loose version circulating online says every website with a chatbot now owes Article 50(1) directly, and that is not what the text says.<\/p>\n

It does not follow that a deployer can relax. Three things pull the duty back toward you. First, the provider discharges 50(1) through a notice that lives inside an interface you configure: change the greeting, rename the assistant, suppress the banner, and you have quietly defeated the provider’s compliance in your own deployment. Second, if you put your own trade name on a system or modify it substantially, the value-chain rules can recharacterise you as a provider. Third, Article 50(4) is squarely yours the moment your site publishes AI-drafted text on matters of public interest without human editorial responsibility. Our note on the AI governance rules worth writing down now<\/a> covers how to record which role you occupy for each tool, which is the part that saves time in an audit.<\/p>\n

What a compliant notice looks like<\/h2>\n

Article 50(5) is the operative sentence: the information “shall be provided to the natural persons concerned in a clear and distinguishable manner at the latest at the time of the first interaction or exposure” and “shall conform to the applicable accessibility requirements”.<\/p>\n

Three practical consequences follow from that wording, and none of them requires a lawyer to see.<\/p>\n