Do you have to tell people your chatbot is AI? Usually yes.

Article 50 of the EU AI Act applies from 2 August 2026. It was not deferred by the Digital Omnibus, which moved the high-risk regime to December 2027 and took all of the coverage with it.

It is also the only part of the Act that reaches a business whose entire exposure is a support chatbot and a marketing team that generates images. There is no size threshold in it and no sector limit.

Four paragraphs, and each names its actor in its opening words. Two say providers shall ensure. Two say deployers of. That split is the whole of the difficulty and it does not depend on the facts of your business.

Breaching it sits in the second penalty tier under Article 99(4): up to 15 million euro or 3% of worldwide annual turnover. For an SME, Article 99(6) applies whichever of the two figures is lower rather than higher, which is the one piece of good news in the paragraph.

A provider of an AI system intended to interact directly with natural persons has to ensure the person is informed that they are dealing with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person taking account of the circumstances and the context of use.

There is a second exemption for systems authorised by law to detect, prevent, investigate or prosecute criminal offences, unless the system is available to the public to report an offence. That is not going to be you.

The get-out is real and it is narrower than people want it to be. A widget labelled AI Assistant with a robot icon is probably obvious. A chat window that opens with a first-person greeting and a human-sounding name is not, and the more work a vendor has done to make an assistant feel personal the less available this exception becomes.

The cheapest way out of the argument is a line of text. Something in the shape of: you are chatting with an automated assistant, and you can ask for a person at any time. That satisfies the duty, it costs nothing, and it removes the question of whether the exception applies.

Note who carries it. The duty sits on the provider, which is whoever put the system on the market or into service under their own name. If you bought a chatbot and dropped it on your site, the provider is your supplier. That does not make the disclosure somebody else's problem: it is your customers talking to it, and the practical answer is that you require the disclosure of the party that can build it in, and you put the sentence on your own page as well.

A provider of an AI system generating synthetic audio, image, video or text has to ensure the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated.

Machine-readable is the operative phrase and it is why this duty cannot be discharged by a business that bought the tool. It means metadata, watermarking or a provenance signal embedded in the file, applied at generation. A caption under a picture on your website is not machine-readable marking, and adding one does not satisfy 50(2).

So for almost every Irish business the honest position on 50(2) is that it is the model provider's duty and the thing to do about it is procurement: ask the vendor whether the outputs carry provenance marking, and keep the answer.

The paragraph carries exceptions for systems performing an assistive function for standard editing, and for systems that do not substantially alter the input data provided by the deployer or the semantics of it. Spell check is not in scope. Generating a product photograph is.

There is a transitional worth knowing if your supplier pleads difficulty. Article 111(4), as amended, gives providers of generative systems that were already on the market before 2 August 2026 until 2 December 2026 to meet the marking requirement. That date has not passed at the time of writing, which is the honest reason a vendor may not have an answer yet, and it is also the reason to ask now rather than in January.

50(3) binds the deployer of an emotion recognition system or a biometric categorisation system to inform the people exposed to it. Before relying on this paragraph, check Article 5 first: inferring emotions of a person in the workplace or in education is prohibited outright, outside narrow medical and safety exceptions, and has been since 2 February 2025. A duty to disclose does not make a prohibited practice lawful.

50(4) binds the deployer in two situations. Generating or manipulating image, audio or video content that constitutes a deep fake has to be disclosed as artificially generated or manipulated. And publishing AI-generated or AI-manipulated text to inform the public on matters of public interest has to be disclosed too, unless the content underwent human review or editorial control and a person or organisation holds editorial responsibility for it.

50(4) also carries an exception the creative industries argued for: where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work, the duty reduces to disclosing in a manner that does not hamper the display or enjoyment of the work. It is not a general exemption for anything with a picture in it.

The second limb is the one an Irish marketing team can walk into. A blog post about a change in the law, drafted by a model and published without anybody taking editorial responsibility for it, is text published to inform the public on a matter of public interest. The exception is available and it is easy to satisfy: somebody reads it, somebody owns it. That is the whole test.

Article 50 requires the information to be provided at the latest at the time of the first interaction or exposure, in a clear and distinguishable manner, and conforming with accessibility requirements.

That last clause is doing real work and it is routinely missed. A disclosure inside an image, or in a tooltip that only appears on hover, or in grey text below the fold, is not clear and distinguishable and it is not accessible. If the disclosure is part of a chat widget, it has to be reachable by a screen reader and by a keyboard, which is the same standard the European Accessibility Act asks of the rest of the page.

Article 50 is a disclosure regime. It does not make a system lawful, it does not decide whether the system is high-risk, and it says nothing about the personal data going through it.

That last one is the practical gap. A support chatbot receiving customer messages is processing personal data, and the questions that follow are data protection questions: what is the lawful basis, how long are the transcripts kept, who is the processor, and does the model provider sit outside the EEA. Whether an assessment is needed first is a separate test with its own published list, and where the data ends up is a separate question again.

Four steps, and none of them needs a consultant to start.