AI chatbot disclosure under the EU AI Act: who tells users, where and how

Article 50(1) is addressed to providers. If you embed a ready-made chat widget from a vendor such as Intercom, Zendesk or HubSpot, the vendor that places the AI system on the market under its own name is typically the provider, and your business is usually a deployer. The Commission's guidelines on Article 50, adopted on 20 July 2026, give this example: a company offering a chatbot under its own name to business users, who integrate it into their processes without modifying it, is the provider responsible for the disclosure.

The picture can change. According to the same guidelines, a company that develops a chatbot in-house and puts it into service for its own use under its own name is a provider. A company that modifies an existing generative AI system, for example with new training data, and puts it into service under its own name becomes the provider of the new system. Building your own bot on a model API, or rebranding a system as your own, can therefore make you the provider. Where the line falls depends on the facts. For high-risk systems, Article 25 spells out a similar shift.

Even as a deployer, you are not a bystander. You usually choose the bot's name, avatar, greeting and where the widget appears, and those choices decide whether visitors can tell they are talking to AI. Consumer protection law also applies alongside the AI Act: where an AI feature is a main characteristic of a service you sell, the guidelines note it may have to be disclosed whether or not the interaction is obvious. Check whether your vendor provides a disclosure, and make sure your own greeting does not hide or contradict it.

Article 50(1) drops the duty if the AI interaction is obvious to a reasonably well-informed, observant and circumspect person, taking into account the circumstances and the context of use. The Commission's guidelines say this standard draws on the average consumer of EU consumer law, that the exception must be interpreted restrictively, and that it should be limited to cases where almost no doubt is left. General awareness that chatbots exist does not mean people recognise one in a conversation.

The guidelines name factors that make AI less obvious: human-sounding writing or voices, a profile picture showing a person, and advanced personalised replies. If the general public can use the bot, including children, older people or people with lower AI literacy, the exception cannot be relied on. Examples where it may apply are coding assistants used only by professional developers and internal tools for trained staff. AI chatbots in help desks, whose replies users may take for human ones, are listed as needing a notice. For a customer-facing website bot, plan on disclosing.

Article 50(5) requires the information at the latest at the time of the first interaction, in a clear and distinguishable way. The guidelines treat launching a conversation with a chatbot as that first interaction and consider a single, prominent notice before it likely to suffice in most cases. A notice that sits only in terms and conditions, a privacy policy or a linked document is not enough on its own, and neither are generic labels such as "assistant" or technical phrases such as "uses LLMs".

In practice, three spots work well together. A short text line on or next to the chat launcher informs people before they open it. The bot's first message says plainly that it is an AI system. A small persistent note close to the input field keeps it visible, in line with the guidelines' recommendation to place disclosures near the interaction. For longer or sensitive conversations, such as health, finance, insurance, legal help or complaints, the guidelines consider periodic reminders likely to be necessary, and the bot should always answer truthfully when someone asks whether it is human.

Handovers need the same clarity. When a person takes over, say so, for example "You are now chatting with [name] from our support team", and say so again if the bot takes back the conversation. The guidelines state that products blending AI-generated replies with human ones fall under Article 50(1) and need disclosure for the AI parts, unless humans review and send those replies as the main interlocutors. A human-looking avatar or a first name for the bot works against you.

These texts are examples, not legal advice, and no wording guarantees compliance. Replace the placeholders, only promise a handover you actually offer, and test the text in your widget. English, first message: "Hi, I'm the AI assistant of [company]. I'm an AI system, not a person, and I can make mistakes. Type 'human' at any time to reach our team." English, short line next to the launcher or input field: "You are chatting with an AI system. Replies are generated automatically."

German, formal, first message: „Guten Tag, ich bin der KI-Assistent von [Firma]. Ich bin ein KI-System und kein Mensch, meine Antworten können Fehler enthalten. Schreiben Sie ‚Team‘, wenn Sie mit unseren Mitarbeitenden sprechen möchten.“ German, formal, short line: „Sie chatten mit einem KI-System. Die Antworten werden automatisch erzeugt.“ German, informal: „Hi, ich bin ein KI-Assistent, kein Mensch. Meine Antworten entstehen automatisch und können Fehler enthalten. Schreib ‚Team‘, wenn du lieber mit einem Menschen sprichst.“

Voicebot or phone line, spoken at the very start: "Hello, you have reached [company]. You are speaking with an automated AI assistant, not a person. Say 'team' at any time to speak to one of our staff." German: „Guten Tag, Sie sind mit [Firma] verbunden. Sie sprechen mit einem automatischen KI-Assistenten, nicht mit einem Menschen. Sagen Sie jederzeit ‚Mitarbeiter‘, um mit unserem Team zu sprechen.“ The guidelines add that tones can support recognition but are not sufficient alone, and that longer calls or interruptions may call for reminders.

Article 50(5) requires the information to conform to the applicable accessibility requirements, and Recital 132 asks for accessible formats for persons with disabilities. The guidelines point to existing EU accessibility law, such as the European Accessibility Act (Directive (EU) 2019/882) and the directive on accessible public sector websites, and state that Article 50 adds no separate accessibility requirements. Whether those laws apply to your site is a separate check, but an accessible notice is the safe design choice either way.

In practice, the notice should be real text, not only an icon or a colour. Screen readers should announce it: put the disclosure in the first message, announce new messages through a live region, give any AI icon an accessible name such as "AI assistant", and make sure keyboard focus moves correctly when the chat opens. Use plain language and enough contrast. If children or people with low digital literacy are likely to use the bot, the guidelines ask for simple, age-appropriate wording.

The free scan loads your website and recognises widely used chat widgets, such as Intercom, Zendesk, HubSpot, Tidio or Userlike, from their scripts and page elements. It then searches the page text for wording in English and German that tells visitors they are dealing with an AI system, and quotes what it finds. The result shows whether a chatbot was detected and whether matching notice wording was found alongside it.

A scan cannot see everything. Some greetings only load after a visitor opens the chat, sit inside a vendor frame or depend on consent settings, and a detected widget may run fixed rules rather than AI. Treat a missing notice as a prompt to open the chat yourself and check the launcher, the first message and the handover. The scan is a starting point, not a legal assessment.