Article 50(1) for AI chatbots: the disclosure rule, decoded

# Article 50(1) for AI chatbots: the disclosure rule, decoded

Every SaaS founder I talk to gets Article 50(1) wrong in one of two ways. Either they put a tiny "AI" badge in a corner and call it done, or they bury a 200-word disclaimer in their Terms of Service that nobody reads. Both fail the rule. One gets you fined.

Here is what Article 50(1) actually says and what the Disclos team ships for it.

The rule in one paragraph

If your product holds a conversation with a person, you must tell that person they are talking to an AI. The disclosure has to be clear, has to be distinguishable from your normal UI, and has to appear at the start of the interaction. Not after the third message. Not behind a "Privacy" link. At the start.

The legal text is in Regulation (EU) 2024/1689, Article 50(1):

Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect.

That "unless obvious" clause is narrower than it sounds. A page titled "Chat with our AI assistant" probably qualifies. A widget that opens with "Hi! How can I help you today?" does not. If your chatbot has a human-sounding name, a friendly avatar, and conversational copy, it is not obvious. You disclose.

What "clear and distinguishable" means in practice

I have audited about 40 SaaS chat widgets in the last quarter. Patterns that pass:

• A line above the first AI message: "You are chatting with an AI assistant. Responses may be inaccurate."
• A persistent visual indicator next to every AI message (a small dot, a label, or both)
• A line in the input area itself: "AI assistant. Verify important answers."

Patterns that fail:

• An AI badge in the chat window header, in 10pt grey, that only shows up if you scroll up
• A modal that flashes for two seconds on first load and is never seen again
• A note in the footer of the website that says "This site uses AI"

The rule is point-of-interaction disclosure, not page-of-interaction. Where the conversation happens is where the disclosure goes.

When the disclosure has to repeat

Article 50(1) requires informing the person at the start. It does not require repeating on every message. But for trust and for defensibility in case of a complaint, the Disclos team recommends three layers:

1. An opening line, shown before the first user message
2. A persistent indicator inside the chat UI for the whole session
3. A small "Generated by AI" footer attached to each AI message

We publish the HTML for all three layers, free, in our open-source EU AI Act checklist on GitHub. Use it directly or as a reference.

What happens if the chatbot also does something else

This is where most SaaS teams trip. A chatbot is usually a limited-risk system under Article 50. But the moment the chatbot does something in an Annex III high-risk area, the rules change entirely.

Examples I see often:

• A "career assistant" chatbot that screens job applicants → Annex III(4), high-risk
• A customer support bot that decides who gets a refund → may be Annex III(5)
• An education tutor that grades student work → Annex III(3), high-risk

If your chatbot does any of that, Article 50 disclosure is still required, but you also need a conformity assessment, a technical file, human oversight, risk management documentation, and registration in the EU database. That is a much bigger lift than a disclosure widget.

Penalties for getting this wrong

Article 50 violations fall under Article 99(4): up to 15 million euros or 3 percent of total worldwide annual turnover, whichever is higher. For most early-stage SaaS that means the 15 million ceiling is theoretical, but the percentage can still bite. A SaaS doing 5 million euros in ARR is looking at a 150,000 euro maximum penalty per violation.

National authorities apply penalties proportionally under Article 99(6) for SMEs and startups. In practice, first-time enforcement is more likely to be a corrective order than a fine. But the corrective order itself can require you to take the feature down until you fix the disclosure, and that downtime can hurt more than the fine.

The two-hour fix

If you have one chatbot on your SaaS, you can comply with Article 50(1) in under two hours of work. Add the opening line. Add the persistent indicator. Add the per-message footer. Document what you did in a one-page file you can hand to your DPO or to a regulator if asked.

The Disclos team ships all three components as part of our 5-day EU AI Act audit. For 997 euros you get the disclosure code, a PDF audit report, a Loom walkthrough, and internal compliance templates. Refund guaranteed if your SaaS is not compliant by 2 August 2026.

Or do it yourself with our open-source checklist. The repo will always stay free. We sell the audit, not the rules.

Either way, 2 August 2026 is the date. Get the chatbot disclosure right before then.

Last updated: 2026-06-04