EU AI Act Article 50 Is Live — Your AI Chatbot Needs a Disclosure Now

Five days ago, a significant slice of the EU AI Act became enforceable with real penalties attached. If your business runs an AI chatbot, publishes AI-generated images or text, or has deployed any synthetic media tool that reaches European users, Article 50 of Regulation (EU) 2024/1689 is now active law — and the authority to impose fines up to €15 million arrived on the same day the obligations did: August 2, 2026.

A lot of businesses missed the deadline because they were watching for the wrong thing.

The Omnibus Confusion

In May 2026, the EU reached a provisional agreement on the Digital Omnibus package, which reset the compliance timeline for high-risk AI systems — the Annex III use cases like hiring algorithms, credit-scoring models, and medical diagnostic tools — from August 2026 to December 2, 2027. Headlines announced an "AI Act delay," and a large number of organizations read that as a general reprieve. It was not.

The Omnibus specifically deferred the obligations tied to high-risk AI. Article 50 — the transparency chapter that applies to virtually any AI that interacts with people or generates content — was deliberately left off that delay. It stayed on the original August 2, 2026 schedule, and enforcement authority landed simultaneously. Organizations that assumed the deferral was broad are now out of compliance.

What Article 50 Actually Requires

Article 50 covers four categories of AI systems and imposes duties on both providers (those who build or offer AI tools) and deployers (those who integrate them into products and services):

• Chatbots and conversational AI (Article 50(1)): Any AI system a person can interact with — live-chat assistants, support bots, voice interfaces, agentic workflows — must inform users they are speaking with an AI at the first point of contact. A persistent on-screen notice works. A vague mention buried in a terms-of-service footer does not. The regulation specifically requires the disclosure to be clear and distinguishable.
• AI-generated content — machine-readable marking (Article 50(2)): Providers of generative AI must embed detectable markers in synthetic audio, images, video, and text output. This is a technical watermarking obligation designed to let automated systems identify AI origin — not simply a human-facing label. Generative AI systems already on the market before August 2 get a grace period until December 2, 2026 to implement the marking requirement. Systems deployed new after August 2 must comply immediately.
• Deepfakes and AI-synthesized public-interest content (Article 50(4)): Publishing AI-generated or AI-manipulated content depicting real people, places, or events — especially on topics of public interest — requires disclosure. The label must survive reproduction: visible to someone who screenshots and reshares the content, not merely embedded in metadata that disappears on download.
• Emotion recognition and biometric categorization (Article 50(3)): If your systems analyze facial expressions, voice tone, or other behavioral signals to infer emotional state or classify people biometrically, you must inform the individuals being analyzed.

Does This Apply to US-Based Businesses?

Yes — if your website or service reaches EU users. Article 50 applies to any organization providing, deploying, importing, or distributing AI systems that affect the EU market, regardless of where the company is headquartered. The same extraterritorial logic that made GDPR relevant to American companies in 2018 applies here. Penalties run to €15 million or 3% of total worldwide annual turnover, whichever is higher, with SME considerations built into the proportionality analysis. National market surveillance authorities in each member state hold enforcement power.

One Genuine Carve-Out for AI-Generated Text

Article 50(4) includes a human editorial review exemption that matters for content publishers. If a human editor reads AI-generated text and takes substantive editorial responsibility for it, the AI-origin disclosure is not required. The regulation is explicit that superficial checks — running spell-check, giving a piece a quick skim — do not qualify. Substantive review means real editorial judgment: fact-checking, structural revision, editorial sign-off. If your team does that consistently, you can document and rely on the exemption. If AI copy ships with a light pass, you cannot.

What To Do Right Now

The compliance checklist is shorter than most legal analysis suggests:

• Inventory your AI touchpoints. Chatbot? AI image generator for marketing assets? AI copywriting tool? AI-generated product descriptions? Map every AI system that touches user-facing output.
• Add first-contact chatbot disclosure. If you have an AI chat widget on your site, it needs a clear "You're chatting with an AI" notice before the conversation begins — a persistent banner or clearly positioned label, not a dismissible modal that fires mid-session. This is a UX change, not just a legal document.
• Check who owns the Article 50(2) marking obligation. If you use a third-party generative AI tool (image generators, AI writing APIs, embedded AI in your CMS), confirm whether your vendor is handling machine-readable watermarking on their end or whether the obligation falls on you as the deployer. Get that in writing.
• Review synthetic media in your pipeline. AI-generated or AI-edited images, audio, and video going live on public channels need disclosure — especially if they depict real people.
• Document your editorial process if you're relying on the text exemption. Regulators can ask, and a documented workflow is the difference between a defensible position and a fine.
• Don't neglect pre-August 2 systems. The December 2, 2026 grace period covers only the technical marking requirement in Article 50(2) for systems that were already on the market. The chatbot disclosure, deepfake labeling, and emotion-recognition notification obligations had no grace period — they applied on August 2.

The Bottom Line

Article 50 is the first part of the EU AI Act to hit daily web operations with real enforcement power. The high-risk provisions get more attention in the industry press, but for a typical business website that's added a support chatbot or started using AI image generation over the last two years, Article 50 is the one that's active right now.

The compliance lift is manageable for most web properties: a chatbot disclosure banner, documentation of editorial processes, and a direct conversation with your AI tool vendors about their watermarking roadmap. The main risk is the assumption — still common — that the Digital Omnibus delay covered everything. It didn't cover this.

At Falcon Internet, making sure client sites are built to current legal and technical standards is just part of what ongoing web development looks like — EU or not, regulations that affect how AI is disclosed on the web land on the infrastructure layer eventually.