Article 50 for messaging teams: what the AI Act's transparency rules require

If a chatbot, voice bot or AI agent answers your customers on WhatsApp, web chat, SMS or the phone, and any of those customers are in the European Union, a new legal duty applies: they must be told they are dealing with an AI. The European Commission began enforcing the AI Act's transparency rules on 2 August 2026, and breaches of these obligations can attract fines of up to EUR 15 million or 3% of worldwide annual turnover. Most coverage is written for AI developers. This piece is for the people who run customer conversations, and it is deliberately narrow: what the rule requires, what it does not, and what to change. It is not legal advice.

Article 50(1) of the AI Act requires providers of AI systems intended to interact directly with people to design them so that those people are informed they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person given the circumstances.

Commentary on the rules describes a broad scope: chatbots, AI voice assistants, bots on social networks and agentic systems that contact people. An automated support agent on WhatsApp is squarely inside it.

Article 50 also contains other duties (marking AI-generated content in a machine-readable way, labelling deepfakes, informing people exposed to emotion recognition), which matter less to most messaging teams. The European Commission published guidelines on all four duties in July 2026.

Article 50 is narrower than many summaries suggest, and the narrowness is useful. Reading it as "the EU regulates AI in customer service" produces a compliance programme far larger than the text requires.

The AI Act distinguishes the provider (who develops an AI system, or has it developed, and puts it into service under its own name) from the deployer (who uses it). For conversational AI the line matters:

The Commission's guidelines discuss how these roles apply in practice. Whatever the label, in a messaging channel the disclosure appears in your conversation with your customer, so make sure your contract says who is responsible for it, and check it yourself.

The obligation is not merely that the information exists somewhere. Article 50(5) requires it to reach the person clearly and distinguishably, at the latest at the time of the first interaction, and to meet applicable accessibility requirements.

Analysis of the rules is consistent about what fails this test: information buried in terms and conditions, or hidden behind layers of menus. If it can easily be overlooked, it does not count.

For a messaging channel that has practical consequences, because there is no interface chrome to put a permanent label in. The disclosure has to be in the message stream, near the beginning. A privacy policy is not "at the first interaction". A disclosure on the fourth turn is not either. A bot name that hints at automation is probably not "clear". What passes is short, plain, in the conversation's language and with the same visual weight as the rest of the message.

The GDPR, the Digital Services Act, consumer protection law and accessibility legislation continue to apply in parallel. Satisfying Article 50 does not discharge a GDPR obligation, and vice versa. Say this inside your organisation early, because the instinct is to assume the privacy notice already covers it.

In 2026 the EU adopted a simplification package (the "Digital Omnibus" on AI) that postponed the main obligations for high-risk AI systems to December 2027 and later. Law-firm analyses agree that it did not postpone the chatbot disclosure duty in Article 50(1). Several report a short grace period, to 2 December 2026, for the machine-readable marking duty in Article 50(2) for generative systems already on the market before 2 August 2026. If you generate images, audio or video in conversations, check the final text with counsel.

Write the line. One sentence, in the first automated message, in each language you serve, with a working route to a person. If the route does not work, the disclosure is misleading and you have a worse problem than the one you started with.

Re-disclose after a handover back to automation. If a human took over and then handed back, the person's mental model has changed.

Record the disclosure as an event. Per contact, per channel, timestamped: the same shape as a consent record, and best stored in the same ledger (see consent architecture). If asked to demonstrate compliance for a specific conversation eighteen months ago, that record is the answer.

Have the send path check it. A disclosure that lives only in a prompt is a policy. A disclosure that the send path checks before the first automated turn is a control, and only the second survives a change of vendor or model.

Two areas where reasonable people will read this differently:

Rule-based automation. A keyword auto-reply that does not use AI is arguably outside the AI Act's definition of an AI system. In practice most modern systems mix rule-based and model-based handling in one flow, which makes the line hard to hold and probably not worth defending.

Assistive drafting. A human agent using AI to draft a reply they then edit and send is a different case from an autonomous agent. Where a person stays in the loop and is the sender, the analysis differs.

Neither is settled enough to build a strategy on. The defensible default, and one that costs almost nothing, is to disclose whenever automation is generating what the customer reads.

Other jurisdictions have their own, usually narrower, rules on bots, for example California's law requiring disclosure of bots used to incentivise a sale or influence a vote. If you serve customers in several regions, a single honest first line that satisfies the strictest rule is usually simpler than maintaining different behaviour per country.

The core obligation is disclosure. One line, at the first interaction, in the conversation's language, with a real escalation path. Store it as a record beside consent and enforce it in the send path. It applies on top of the GDPR and channel policy rather than replacing either, and it has applied since 2 August 2026.

• A consent architecture that survives an audit: where to store the disclosure record.
• Disclosing AI in a conversation: wording and design patterns for the first line.