If your website has a chat widget that answers visitors with AI, Europe now has rules about it, and the first deadline has already passed. On 2 August 2026, the transparency obligations in Article 50 of the EU AI Act took effect. They require anyone running an AI chatbot to tell users they are talking to a machine.

A second deadline, 2 December 2026, closes the grace period for machine-readable marking of AI-generated content. This is not a niche compliance exercise. It applies to any business whose chatbot reaches people in the European Union, regardless of where the company is based.

The penalties go up to 15 million euros or 3% of global annual turnover, whichever is higher. For a small business, the fix is straightforward and cheap. Ignoring it is not.

What Article 50 requires, in plain language

Article 50 of Regulation (EU) 2024/1689 covers transparency obligations for providers and deployers of certain AI systems. It sits in the Act’s limited-risk tier, so it applies independently of the high-risk classification rules. A chatbot does not need to be high-risk to trigger Article 50.

The core rule for chatbots, in Article 50(1), is simple: providers of AI systems that interact directly with natural persons must make sure those people are informed they are interacting with an AI system. The only exception is when that fact is obvious to a reasonably well-informed, observant and circumspect person, taking into account the circumstances and the context of use.

That exception is narrower than most businesses assume. A chat window labeled “Support” with a human-sounding name and a friendly avatar does not make AI involvement obvious.

The European Commission’s guidelines on the transparency obligations, adopted on 20 July 2026, make clear that generic declarations buried in terms of service will not suffice. The disclosure has to be clear, distinguishable, and delivered at the latest at first interaction.

The December deadline: marking AI-generated content

A second duty, in Article 50(2), requires providers of AI systems that generate synthetic audio, image, video or text to mark their outputs in a machine-readable format, detectable as artificially generated or manipulated. In practice this means provenance metadata embedded in the content itself, such as C2PA content credentials or imperceptible SynthID-style watermarks, detectable by software downstream.

For chatbots, the practical overlap is this: if your bot generates text that gets published anywhere, such as help articles or auto-drafted emails, that output may need machine-readable marking. If the bot only converses and its text never leaves the chat window, the disclosure duty in Article 50(1) is the main concern.

The timeline split matters. Article 50 applied from 2 August 2026. But providers of generative AI systems that were already on the EU market before that date were given until 2 December 2026 to implement the machine-readable marking. That four-month grace period came out of the Digital Omnibus negotiations in 2026.

Everything else in Article 50, including chatbot disclosure, has been enforceable since August with no extension. Systems placed on the market on or after 2 August 2026 must comply with the marking duty from day one.

Does this apply to a US business?

Yes, if the chatbot reaches people in the EU. The AI Act’s territorial scope follows the GDPR’s logic: Article 50 binds providers and deployers whose AI systems’ outputs are used inside the Union, regardless of where the company is headquartered. A Texas company whose website chatbot answers a visitor in Berlin is in scope for that interaction.

No European entity is required for Article 50 the way one is for high-risk systems. But the absence of a European presence does not excuse non-compliance. Enforcement sits with national market surveillance authorities in each of the 27 member states.

What the penalties look like

Breaching Article 50 can draw administrative fines of up to 15 million euros or 3% of worldwide annual turnover, whichever is higher, under Article 99(4) of the Act, as summarized in recent legal analysis.

For small and medium-sized enterprises, Article 99(6) softens the ceiling to the lower of the two amounts: for a company with $2 million in annual revenue, the maximum would be around $60,000 rather than 15 million euros. These are maximums, not automatic fees, and authorities must weigh proportionality, intent and cooperation. A chatbot with no disclosure at all is the easiest violation for a regulator to document.

What your chatbot actually needs: a practical checklist

Here is what compliance looks like for a typical small-business website chatbot.

1. Say it is AI, in the chat window itself. Add a persistent label such as “AI assistant” or “Powered by AI” in the chat header or as the first message of every conversation. Example: “Hi, I’m the AI assistant for [business name]. I can answer questions about our services.” Do not rely on a line in your privacy policy. The disclosure must appear at the latest at the first interaction, in the moment.

2. Fix the fake-human signals. If your bot uses a human name, a human photo avatar, or typing indicators designed to mimic a person, remove them or pair them with the AI disclosure. Presenting the bot as human while disclosing AI use three clicks away is not disclosure at all.

3. Put it in your policy pages too. Add a short, plain statement to your privacy policy describing where AI is used on your site. This is the second layer: in the moment, and in your policy.

4. Mark AI-generated content that leaves the chat. If your system publishes bot-generated text, images or audio where customers see it, implement machine-readable provenance marking before 2 December 2026 (immediately, for systems launched after 2 August 2026). At minimum: C2PA-style content credentials or metadata tags identifying the content as AI-generated, preserved through your publishing pipeline. Confirm your image optimizer, CDN and transcoder do not strip the metadata, because a watermark destroyed in delivery satisfies nothing.

5. Keep a short compliance file. For each AI system you run, document: what the system is, who the provider is (you or a vendor), where the disclosure appears (screenshots), what marking is applied to outputs, and when you implemented each. If a vendor supplies your chatbot, get in writing which disclosure features they provide and which responsibilities stay with you. Procurement teams will ask for this before any regulator does.

6. Consider the Code of Practice. The Commission has backed a voluntary Code of Practice on Transparency of AI-Generated Content. Signing it is not mandatory, but it offers a recognized, lower-scrutiny route to demonstrating compliance.

What compliance costs

For a business whose only Article 50 exposure is a website chatbot, the cost is modest. Adding an in-chat disclosure label and updating policy pages is typically a few hours of developer time. If you run the site yourself, the out-of-pocket cost can be close to zero.

The costs rise with complexity. Businesses that publish AI-generated content at scale and need real machine-readable marking should budget for engineering work: auditing the media pipeline, implementing C2PA or equivalent marking at generation, and testing that marks survive delivery. Practitioners describe this as a quarter of engineering time for content-heavy products, roughly $15,000 to $50,000 for a small team.

A legal review of your disclosure wording and compliance file typically runs $2,000 to $8,000 from a technology-focused firm. These are rough ranges, not quotes. The honest baseline: the chatbot disclosure itself is cheap; the watermarking infrastructure is the real project.

The dates to put on the calendar

• 2 August 2026: Article 50 transparency obligations took effect. Chatbot disclosure, deepfake labeling, and AI-generated public-interest text duties have been enforceable since this date.
• 2 December 2026: Grace period ends for machine-readable marking of generative AI systems that were on the EU market before 2 August 2026. After this date, the marking duty in Article 50(2) applies to everyone.
• 2 February 2027: Providers signed onto the voluntary Code of Practice are expected to have an interoperability solution for watermark detection in place.

The rules are not retroactive. Content generated before 2 August 2026 does not need to be labeled after the fact, though the Commission encourages it where feasible. For public-interest text, the publication date controls: an AI-drafted article written in July but published in August may need a label unless it went through genuine human editorial review.

The bottom line

Article 50 is the EU’s simplest AI rule to comply with and the easiest to get wrong by ignoring. If your chatbot talks to Europeans, it needs to say it is a machine, in the chat, from the first message. If your systems generate published content, that content needs machine-readable provenance by 2 December 2026. Do the inventory now, fix the disclosure this week, and schedule the watermarking work before the grace period ends.