EU AI Act Transparency Rules: Does Your Chatbot, AI Assistant, or Generated Content Need a Disclosure?

Since 2 August 2026, the EU AI Act’s Article 50 transparency obligations apply to certain providers and deployers of AI systems. The rules are designed to make people aware when they are interacting with AI or encountering certain AI-generated or manipulated content. If your business offers or uses a customer chatbot, voice assistant, AI agent, synthetic media, or AI-generated material on matters of public interest, you should determine whether a disclosure, marking, detection method, or human editorial-review process is required.

Do not begin with the question “do we need a label?” Begin with “what AI systems do we operate, what do they do, and who can be affected?” The correct answer depends on whether your organisation is a provider or deployer, the nature of the system, where its outputs are used, and whether the content has undergone substantive human editorial review. This article is a practical operational guide, not legal advice; obtain qualified legal advice for your organisation’s circumstances.

The four situations Article 50 addresses

Article 50 distinguishes between duties that apply to providers—those that develop or place an AI system on the market—and deployers, who use an AI system under their authority. The practical categories are as follows.[1]

The rules are not limited to companies headquartered in the European Union. They can apply where an organisation places an AI system on the EU market or where an AI system’s outputs are used within the EU. Scope is a legal question that depends on the facts, so an inventory and a clear description of each system are essential starting points.

The short answer for common use cases

Customer chatbots and AI assistants

If a customer or member of the public is interacting with an AI chatbot, voice assistant, or agent, the safe operational assumption is that the person should be informed that the interaction is with AI unless the nature of the interaction is already obvious. In practice, this can be a clear label at the start of the conversation, a persistent interface indicator, or a concise statement such as “You are chatting with an AI assistant.”

The disclosure should not be hidden in terms and conditions. It should be understandable at the point where a person decides how much trust to place in the interaction or what information to share.

AI-generated text, images, audio, and video

For providers of systems that generate or manipulate synthetic content, Article 50 includes machine-readable marking and detection requirements. There is transitional relief for certain generative-AI systems already on the market: the relevant marking and detection obligations have an extended compliance date of 2 December 2026.[1]

For a business using a third-party AI tool, the first task is to understand what the vendor provides. Does the provider offer a content provenance or labelling feature? Are generated assets automatically marked? Can the organisation retain an audit trail of how material was created and approved? Vendor documentation and contracts matter here.

AI-assisted marketing and public-interest material

Not every use of AI to help write content requires a public label. The rules focus on specified circumstances, and the legal position can turn on whether the material concerns matters of public interest and whether it has undergone substantive human editorial review with a person taking editorial responsibility.

From an operational perspective, the sensible control is to distinguish between AI-assisted drafting and automated publication. If a human editor checks sources, materially revises the work, applies judgement, and accepts responsibility for the final piece, document that process. If content is published automatically or is designed to appear as authentic footage, speech, or reporting, a visible disclosure is more likely to be appropriate.

Internal productivity tools

An internal drafting assistant used by staff may present a lower public-transparency risk than a customer-facing chatbot, but it should not be ignored. The organisation still needs controls around confidential information, inaccurate outputs, employee training, approved use, and vendor terms. If employees use AI to create material that is later published or sent to customers, the public-facing use case becomes relevant.

A practical decision tree

Use the following questions to triage a system before obtaining a detailed assessment:

1. Is there an AI system, feature, or automated workflow in use? Include vendor features that may have been enabled by default.
2. Does it interact with customers, candidates, employees, or the public? If yes, consider an interaction disclosure.
3. Does it generate or manipulate text, images, audio, or video? If yes, identify whether the organisation is the provider, a deployer, or both, and review marking/detection capability.
4. Does it infer emotion or classify people using biometric information? If yes, treat it as a high-priority transparency and privacy review.
5. Could its output be seen as public-interest information, genuine media, or a human-authored decision? If yes, assess visible disclosure and editorial-responsibility controls.
6. Are outputs used in the EU or offered into the EU market? If yes, record the jurisdictions and seek legal guidance on scope.
7. Can you identify the business owner, vendor, data inputs, users, and approval path? If not, complete the AI inventory before expanding use.

This is not a final legal test. It is an operational filter designed to prevent an organisation from discovering a customer-facing or high-impact AI use only after a complaint, procurement review, or incident.

What an implementation programme should contain

1. A complete AI inventory

Record each AI system, embedded feature, agent, and significant workflow. Capture the purpose, owner, vendor, users, data categories, outputs, integrations, territories, and whether it is internal or public-facing. The inventory should include planned deployments as well as live systems.

2. A classification and assessment process

Classify systems by impact and use. A low-risk meeting-notes assistant should not follow the same process as a customer advice chatbot or an AI component in a regulated product. The assessment should cover interaction transparency, content generation, affected people, data protection, security, contractual obligations, and potential harm.

3. Clear disclosures and interface patterns

Create approved wording and design patterns for common scenarios: chatbot introduction, AI-generated media notice, human-review statement, escalation path, and accessibility-friendly disclosure. Standard patterns reduce inconsistent implementation across marketing, product, support, and HR teams.

4. Human editorial and approval records

Where the organisation relies on substantive human review, define what “substantive” means in practice. A person should verify accuracy, context, and appropriateness, make meaningful editorial decisions where required, and accept accountability for publication. Preserve a simple record of the review for material content.

5. Vendor assurance

Review whether suppliers can support your requirements. Ask about model and feature changes, data use, retention, content provenance, disclosure features, audit logs, security controls, regional processing, and incident notification. Treat AI features introduced into existing SaaS products as changes requiring review, not as automatic upgrades.

6. Training and monitoring

Train the people who publish, configure, buy, or approve AI systems. They need to recognise when a disclosure may be needed, where to escalate uncertainty, and why unreviewed AI output should not be presented as authoritative. Monitor complaints, user confusion, disclosure failures, and changes in vendor functionality.

Practitioner detail: a minimum evidence pack

An implementation team should maintain, at minimum, an inventory record, use-case assessment, supplier assessment, approved disclosure wording, configuration evidence, review records for material content, training records, incident/escalation process, and a periodic review log. Link this evidence to existing security, privacy, product, marketing, and change-management processes rather than creating a separate manual filing system.

For an AI chatbot, the evidence pack might include a screenshot of the disclosure, the user journey, an escalation route to a human, the configured knowledge sources, test records for unsafe or inaccurate queries, permissions for any connected tools, and the schedule for reviewing transcripts or quality metrics.

For AI-generated public content, it might include the source material, the human editor, substantive edits or approval, the decision on whether a label is required, the final disclosure if used, and version history. The deeper principle is traceability: a future reviewer should be able to understand what was produced, how it was reviewed, and who was accountable.

Avoid two common mistakes

The first mistake is treating every AI use as identical. Over-labelling low-risk, clearly AI-generated interactions can create noise and reduce usability. Under-labelling a system that people reasonably believe is human or authentic can damage trust. Use a proportional assessment and clear standards.

The second mistake is treating transparency as a marketing or legal task alone. The people who build, buy, configure, monitor, and publish AI systems must know the workflow. A disclosure is only one visible output of a wider operating model that includes inventory, ownership, review, training, evidence, and change control.

Need help building a practical AI inventory, disclosure workflow, and governance evidence without slowing down useful AI adoption? Managed Company can help you translate AI requirements into repeatable operating controls that work across security, compliance, product, and business teams. Explore Growth & Compliance support.