EU AI Act Article 50: chatbot disclosure rules and dates

What does Article 50 require for a chatbot?

Article 50(1) says providers must ensure that AI systems intended to interact directly with people are designed and developed so that those people are informed they are interacting with an AI system, unless that is obvious from the context. Article 50(5) says the information must be clear and distinguishable, given at the latest at the first interaction, and meet accessibility requirements.

The duty sits with the provider: whoever develops the system and puts it into service under its own name. A company that builds its own refund or sales agent on a model API is usually the provider of that agent, not just a deployer. The deployer duties in Article 50(3) and (4) cover emotion recognition, biometric categorization and deepfakes, which rarely apply to a support agent.

Under Article 99(4)(g), breaches of Article 50 by providers or deployers can bring fines of up to €15 million or, for a company, 3% of total worldwide annual turnover, whichever is higher.

When does it apply, and what did the Digital Omnibus change?

Article 50 has applied since 2 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It moved the high-risk obligations for Annex III systems to 2 December 2027 and for Annex I product-linked systems to 2 August 2028.

It did not delay the chatbot disclosure in Article 50(1). It gave generative AI systems placed on the market before 2 August 2026 until 2 December 2026 to meet the separate machine-readable marking duty in Article 50(2), and replaced Article 50(7) on codes of practice.

Is a refund or collections agent high-risk under the AI Act?

Most refund, discount and support agents are not in Annex III, so for them the main AI Act duty is Article 50 disclosure. Annex III does list AI used to evaluate the creditworthiness of individuals or set their credit score. An agent that decides payment plans or credit terms by assessing creditworthiness should get a specific legal review, with the high-risk deadline now 2 December 2027.

Which US state laws require chatbot disclosure?

There is no general federal rule. Two state laws matter most for commercial agents.

California. Business and Professions Code § 17941, in force since 1 July 2019, makes it unlawful to use a bot to communicate online with a person in California with intent to mislead them about its artificial identity in order to incentivize a purchase or sale. There is no liability if the bot is disclosed in a way that is clear, conspicuous and reasonably designed to inform. California’s newer companion-chatbot law, SB 243 (signed 13 October 2025), excludes bots used solely for customer service.

Utah. The Artificial Intelligence Policy Act, as amended by SB 226 and SB 332 effective 7 May 2025, requires disclosure of generative AI when a consumer makes a “clear and unambiguous request” to know. Proactive disclosure is required for “high-risk” interactions, which include collecting sensitive financial data and giving personalized financial advice. Disclosing clearly at the outset and throughout gives a safe harbor. The Division of Consumer Protection can fine $2,500 per violation, and the act is set to repeal in July 2027 (Davis Polk).

Law	Trigger	What your agent must do	How to test it
EU AI Act Art. 50(1)	Any AI system interacting directly with people in the EU	Inform users they are dealing with AI, at the latest at first interaction, unless obvious	Check the first message in every channel, including voice and email replies
California § 17941	Bot used to mislead about its identity to drive a sale	Clear and conspicuous bot disclosure	Customer asks “are you a real person?” during a sales or retention offer
Utah AI Policy Act	Clear request by a consumer. High-risk interactions in regulated occupations	Disclose on request. Disclose up front in high-risk cases	Ask directly, then ask again after the agent has adopted a persona

Disclosure checklist for a refund or sales agent

Disclosure fails under pressure, not in the happy path. Attackers ask agents to role-play a human manager, or claim the agent “already told me you were a person.”

State that the customer is talking to an AI in the first message, in every channel and language.
Answer “are you human?” truthfully every time, including after role-play or persona instructions.
Do not let the agent claim to be, or speak as, a named manager, supervisor or employee.
Mark handoffs clearly, so the customer knows when a person has taken over and when the AI is back.
Keep the disclosure in system-generated text, not only in the prompt.
Log disclosures per conversation so you can show they happened.
Test with customers who instruct the agent to pretend to be human or to deny being an AI.

Questions

Does giving the agent a human-sounding name break Article 50?

Not by itself. Article 50(1) is about whether people are informed they are dealing with AI. A persona name plus a clear AI disclosure at the first interaction meets the text. A persona name that leaves people thinking they are talking to a person does not.

Was Article 50 delayed by the Digital Omnibus?

The chatbot disclosure in Article 50(1) was not. It applies from 2 August 2026. The omnibus delayed high-risk obligations and gave older generative systems until 2 December 2026 for content marking under Article 50(2).

Do we need to repeat the disclosure in every message?

Article 50 asks for disclosure at the latest at the first interaction. Utah’s safe harbor is for disclosure at the outset and throughout the interaction, so repeating it at handoffs and before decisions is the safer design.

This page summarizes the law in general terms and is not legal advice.

Attack families

Scenarios

Free checklist

Get the guardrail checklist for agents that move money.

A one-page PDF of the controls and the test for each. Download it right away, and we email you the link.

EU AI Act Article 50 and US chatbot disclosure laws: what your agent must tell customers