The EU AI Act's transparency obligations began to be enforced on 2 August 2026. Article 50 requires that people interacting directly with an AI system are informed that they are dealing with a machine, unless it is obvious to a reasonably observant person.

Two details matter more than the headline.

The disclosure has to be findable#

The requirement is that information reaches the person clearly and distinguishably, at the latest at the time of the first interaction, and meets applicable accessibility requirements.

Commentary on the rules is consistent on what fails: a disclosure buried in terms and conditions, or hidden behind layers of menu, does not satisfy this. If it can easily be overlooked, it does not count.

It stacks with everything else#

The AI Act does not replace the GDPR, consumer protection law, or accessibility rules. They apply in parallel and have to be reconciled. Satisfying one does not discharge another — a point worth making inside your own organisation before somebody assumes the privacy notice covers it.

Article 50 is one layer. It sits on top of consent, on top of the channel's own policy, and underneath whatever your sector regulator requires. Satisfying one does not discharge the others.

What a single automated reply has to satisfy

  1. Consent basis

    Whether you may contact this person at all, for this purpose, on this channel.

  2. Channel policy

    WhatsApp, RCS and the rest have their own rules about automation and about who may initiate.

  3. AI Act Article 50

    The person must be told they are interacting with an AI system, clearly and at first interaction.

  4. Sector rules

    Financial advice, health, and children's services each add requirements the AI Act does not.

  5. Your own promise

    Whatever your published policy says. It is enforceable against you even where nothing else is.

Compliance is not the top layer. It is all five, and a failure in any one of them is a failure.

What this means in a messaging channel#

A chat widget can show a persistent label. A messaging thread cannot — there is no chrome, only messages. So the disclosure has to be a message, or part of one, and it has to appear at the start.

Practical patterns that work:

  • An opening line in the first automated message. Short, plain, and not apologetic. "You're chatting with our automated assistant. Ask for a person any time."
  • Re-disclosure after a handover back to automation. If a human takes over and then hands back, the person's assumption has changed. Say so again.
  • A persistent way out. "Ask for a person any time" is both good practice and, in effect, part of making the disclosure meaningful.

The regulation asks for disclosure that is clear and happens at first interaction. In a chat channel that rules out three things people try.

A line in the privacy policy. Nobody reads it, it is not at first interaction, and it is not in the conversation.

A disclosure after the third turn. By then the interaction has happened. The obligation attaches to the first one.

A name that implies it. Calling the agent "Aya" and hoping the customer infers it is not a person is the opposite of clear.

What works is dull: a short line in the first message, in the language of the conversation, in the same voice as everything else. "You're chatting with our automated assistant — say agent at any time for a person." It costs one line and it removes the entire question.

Why you would do this anyway#

Set the law aside for a moment.

The most common complaint about automated support is not that it is automated. It is the suspicion of being automated without being told — the feeling of talking to something pretending to be a person. Disclosure removes that entirely, and what remains is judged on whether it is useful.

There is also an operational benefit: people phrase things differently when they know they are talking to software. They are terser, more literal, and less likely to bury the request in pleasantries. Your intent recognition gets easier.

Disclosed automation outperforms undisclosed automation on the measures anyone cares about, and the reason is not subtle: people ask a bot different questions than they ask a person.

Told they are talking to an agent, customers phrase things more explicitly, accept a menu without irritation, and escalate when they need to instead of arguing with something that cannot help. Undisclosed automation gets discovered — usually at the worst moment — and the discovery costs more trust than the disclosure ever would have.

Where to put it in the architecture#

The same place consent lives. It is a per-contact, per-channel, timestamped fact about what a person has been told — which is the definition of something that belongs in a ledger, not in a template.

If your consent model is already a ledger of grants and disclosures rather than a set of flags, this is a new row type. If it is a boolean on a contact, this is the second good reason to change that.

The instinct is to put the disclosure in the bot's prompt or in the first template. Both work until the second channel arrives, or the third agent, or the vendor changes.

Put it where consent lives. The disclosure is the same kind of fact: a per-person, per-conversation record of something you told them and when. Store it, stamp the conversation with it, and have the send path assert it before the first automated turn goes out.

The disclosure record, and what it connects to

  1. Conversation

    The thread the disclosure attaches to. One disclosure per conversation, not per message.

  2. Timestamp

    When it was shown. First interaction is a claim you will have to evidence.

  3. Wording shown

    The exact text, and its language. Wording changes; the record of what this person saw does not.

  4. Consent ledger

    Same store, same shape. A disclosure is a fact about what you told someone.

  5. Send path

    Asserts the disclosure exists before the first automated turn. A missing one blocks the send.

  6. Escalation route

    The human path the disclosure promised. If it does not work, the disclosure was not true.

If the send path cannot check it, the disclosure is a policy rather than a control.

What to take away#

One line, first message, in the conversation's own language, with a working route to a person. Store it as a record next to consent rather than inside a prompt. From 2 August 2026 this is required in the EU; it is a good idea everywhere, and it was a good idea before the deadline existed.

Sources

Every claim worth checking, with somewhere to check it.

  1. Safer and more transparent AIEuropean Commission · 2 August 2026
  2. The EU AI Act's Transparency Obligations: Rules, Scope and TimelineStibbe
  3. AI Act Article 50: transparency rulesartificialintelligenceact.eu