Your chat widget needs a disclosure

Article 4 of the AI Act still leaves room for discussion, because it demands only a measure and not a result. Article 50 leaves no such room. It demands a disclosure that is either there or missing. It has been fully applicable since 2 August 2026, and unlike the high-risk provisions, the Digital Omnibus has postponed nothing here.

The core of the duty

“Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use.” Regulation (EU) 2024/1689, Article 50(1)

So anyone who uses a chat widget on their own website has to make sure visitors can tell that they are talking to a system and not to a member of staff. An exception applies only where that is obvious anyway, and for law enforcement systems authorised by law with appropriate safeguards.

Three further cases in the same provision

Besides chatbots, Article 50 governs three further situations. AI-generated image, audio, video or text content has to be marked in a machine-readable format as artificially generated, as far as this is technically feasible (paragraph 2). Anyone who operates an emotion recognition or biometric categorisation system has to inform the persons exposed to it (paragraph 3). And deep fakes, that is deceptively real image, audio or video content, have to be disclosed, with an exception for evidently artistic, satirical or fictional work, where the disclosure only has to be made in a way that does not hamper the work (paragraph 4).

For advertising agencies working with AI-generated campaign images, paragraph 2 is the relevant part. For a retailer, law firm or practice with a chat on the website, it is paragraph 1.

When and how

The information has to be given at the latest at the time of the first interaction, in a clear and distinguishable manner, and has to meet the applicable accessibility requirements (paragraph 5). One sentence in the chat window's greeting, “You are talking to an AI assistant here”, settles the most common case. A notice that appears only in the legal notice or in the terms and conditions is not enough, because it is not visible at the moment of the interaction.

Who is liable

The deployer is responsible, that is whoever uses the system, not the agency that installed it. A business cannot rely on the argument that the disclosure was the job of the service provider who supplied the widget.

The real risk: less often the authority, more often the warning letter

Breaches of Article 50 are subject to fines of up to €15,000,000 or 3 % of worldwide annual turnover (Article 99(4)(g)). In practice, however, proactive checks by the new AI supervisory authorities are unlikely in the next few years; the authorities have only just been set up and have no concluded cases yet. In Germany, the more obvious route runs through competition law: a missing disclosure is likely to count as a market conduct rule within the meaning of section 3a of the German Unfair Competition Act, and competitors or the competition watchdog Wettbewerbszentrale can issue warning letters accordingly. The courts have not yet decided the point, but most of the legal literature considers it likely. How this relates to the question of fines under Article 4 is set out in the article on the fine myth.

For existing systems that were already in use before 2 August 2026 there is a transitional period until 2 December 2026 for the machine-readable marking under paragraph 2 (Article 111(4) as amended by the Digital Omnibus). The basic duty under paragraph 1, the disclosure in the chat itself, has no such transitional period.

A practical check

Anyone who wants to check whether their own business is affected goes through three points: is there a chat widget, a voice agent or a similar system on the website, and does it say in its first message that it is AI? Are images or texts for advertising generated with AI, and do they carry a recognisable marking? And, if both apply: is it in a place a visitor actually sees before writing on, not just somewhere on the page?