Does your chatbot have to tell people it is AI? Yes, unless that is obvious.

Article 50 of the EU AI Act applies from 2 August 2026. The Digital Omnibus, Regulation (EU) 2026/1744, kept that date and added one transitional rule: providers of generative systems already on the market before 2 August 2026 have until 2 December 2026 to meet the marking duty in 50(2). The Omnibus moved the high-risk rules to 2 December 2027 for the uses listed in Annex III and to 2 August 2028 for AI in products covered by Annex I.

It reaches even a business that uses AI only for a support chatbot and for marketing images. The AI literacy duty in Article 4 reaches it too, because it applies to every provider and deployer of an AI system. There is no size threshold in it and no sector limit.

Each of the four paragraphs says in its opening words who carries the duty. Two place it on providers. Two place it on deployers. That split is fixed by the text. Which side of it you are on depends on the facts: whether you developed the system, or had it developed, and put it into service under your own name.

A breach of Article 50 falls in the second penalty tier under Article 99(4): up to 15 million euro or 3% of worldwide annual turnover. For an SME, the cap is whichever of the two figures is lower (Article 99(6)).

If an AI system is intended to interact directly with people, its provider has to make sure each person is told they are dealing with an AI system. The exception is where that is obvious to a reasonably well-informed, observant and circumspect person, taking account of the circumstances and the context of use.

There is a second exemption for systems authorised by law to detect, prevent, investigate or prosecute criminal offences, unless the system is available to the public to report an offence.

The exception is narrow. The Commission's guidelines say it must be read restrictively and cannot be relied on where the general public, including children, older people and people with lower AI literacy, can use the system. A widget labelled AI Assistant is disclosing through its label, not relying on the exception, and the guidelines list prominent, plain-language labels as one way to disclose. A chat window that opens with a first-person greeting and a human-sounding name does not disclose that it is AI. The more a vendor has done to make an assistant feel personal, the harder it is to rely on this exception.

A line of text at the start of the conversation settles it, saying something like "You are chatting with an AI system, not a person." The Commission's guidelines give that kind of statement as an example, say a generic reference to an assistant is not enough on its own, and expect the system to say it is AI whenever someone asks. A line like that removes the question of whether the exception applies.

Note who carries it. The duty sits on the provider, which is whoever put the system on the market or into service under their own name. If you bought a chatbot and dropped it on your site, the provider is your supplier. That does not make the disclosure somebody else's problem, because it is your customers talking to it. In practice, require the disclosure from whoever can build it in, and put the sentence on your own page as well.

A provider of an AI system generating synthetic audio, image, video or text has to ensure the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated.

Machine-readable means a mark that software can find without a person looking at it, such as a watermark, metadata, a cryptographic provenance record, a fingerprint or a log. The duty sits on the provider of the tool, which can apply the mark at generation or afterwards, or rely on marking built into the model it uses. A caption under a picture on your website is not machine-readable marking, and adding one does not satisfy 50(2).

If you bought your AI content tools, 50(2) is the duty of each tool's provider. That is not necessarily the company behind the underlying model. Your part is to ask the vendor whether the outputs carry machine-readable marking and a way to detect it, and to keep the answer.

There are exceptions for systems that assist with standard editing, and for systems that do not substantially change the input data the deployer provides, or its meaning. Spell check is not in scope. Generating a product photograph is.

There is a transition period. Under Article 111(4), as amended, providers of generative systems already on the market before 2 August 2026 have until 2 December 2026 to meet the marking requirement. A vendor that has not marked its outputs yet may still be inside that period. Ask what it is doing, and keep the answer.

50(3) binds the deployer of an emotion recognition system or a biometric categorisation system to inform the people exposed to it. Before relying on this paragraph, check Article 5 first: inferring emotions of a person in the workplace or in education is prohibited outright, outside narrow medical and safety exceptions, and has been since 2 February 2025. A duty to disclose does not make a prohibited practice lawful.

50(4) applies to the deployer in two situations. First, image, audio or video content that is a deep fake has to be disclosed as artificially generated or manipulated. Second, AI-generated or AI-manipulated text published to inform the public on matters of public interest has to be disclosed too, unless the content underwent human review or editorial control and a person or organisation holds editorial responsibility for it.

50(4) also carries a lighter rule for creative work: where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work, the duty reduces to disclosing in a manner that does not hamper the display or enjoyment of the work. It is not a general exemption for anything with a picture in it.

The second situation is the one an Irish marketing team can walk into. A blog post about a change in the law, drafted by a model and published without anybody taking editorial responsibility for it, is text published to inform the public on a matter of public interest. The exception needs two things. Somebody with knowledge of the subject has examined the substance of the text, including checking its facts, and a named person or organisation holds editorial responsibility for publishing it. The Commission's guidelines say a spelling or grammar pass, or a sign-off without real engagement, does not count.

Article 50 requires the information to be provided at the latest at the time of the first interaction or exposure, in a clear and distinguishable manner, and conforming with accessibility requirements.

A disclosure that only appears in a tooltip on hover, or in faint text further down the page, can easily be missed, and the Commission's guidelines say information that can easily be overlooked or missed is not given in a clear and distinguishable manner. Text that exists only inside an image also needs a text description before a screen reader can read it out.

The accessibility clause does not create a separate standard: the Commission's guidelines say it points to accessibility rules that already apply, such as the European Accessibility Act for online shops and the other services it covers. Recital 132 asks for the information in accessible formats for persons with disabilities. Where the European Accessibility Act covers your site, the disclosure has to meet the same rules as the rest of the page, including making all functionality available from a keyboard and compatible with screen readers. Microenterprises providing services are exempt from those rules.

Article 50 is a disclosure regime. It does not make a system lawful and it does not decide whether the system is high-risk. Apart from a line in 50(3) requiring emotion recognition and biometric categorisation to follow the GDPR, it does not deal with the personal data going through a system.

That last one is the practical gap. A support chatbot receiving customer messages is processing personal data, and the questions that follow are data protection questions: what is your legal reason for using the data (the lawful basis), how long are the transcripts kept, which outside company handles the data for you (the processor), and is the model provider based outside the European Economic Area. Whether an assessment is needed first is a separate test with its own published list, and where the data ends up is a separate question again.

Four steps, and none of them needs a consultant to start.