Chatbot Transparency Requirements: EU and US Rules

Chatbot transparency requirements come down to one duty: people must be told when they are dealing with AI rather than a human. In the European Union, Article 50 of the AI Act sets that duty for customer-facing systems. In the United States there is no single federal chatbot statute. Obligations come from state laws and from FTC enforcement against deceptive claims. This guide covers who must disclose, what the notice must say, which exceptions exist, what penalties apply, and how to verify that a disclosure works in live conversations.

TL;DR

• EU AI Act Article 50 requires that people be informed they are interacting with AI, no later than the first interaction, unless it is obvious from context.
• In the US, rules are state-level (for example Maine, Utah and California) plus FTC enforcement under general deception authority.
• Providers and deployers carry different duties. A company that puts a vendor’s chatbot in front of customers still owns the customer experience.
• A disclosure written into a policy is not proof. Test it in real conversations and keep dated evidence.
• US companies serving EU users fall under the EU rules and should plan for both regimes.

Table of Contents

• What chatbot transparency means in practice
• EU AI Act: Article 50
• United States: no federal statute, a growing state patchwork
• Beyond the law: what a good transparency notice contains
• Where disclosure fails in real deployments
• How to implement and verify transparency
• Perspective
• How Lexic supports transparency checks
• A short checklist for US companies serving EU customers
• FAQ
• Sources

What chatbot transparency means in practice

Chatbot transparency is the set of obligations that make an AI interaction identifiable to the person on the other end. It has three parts:

• Identity disclosure. The user learns the agent is AI, not a person.
• Content marking. Synthetic text, audio, image or video output is labeled or technically marked, where the law requires it.
• Capability and limits information. Some frameworks go further and ask for what the system can do, how data is used, and how to reach a human.

The first part is the legal core in most jurisdictions. The other two are growing, and they are where customer trust is won or lost.

EU AI Act: Article 50

Article 50 is the reference point for any company that serves European customers. The European Commission’s guidelines on transparency obligations state that providers must design systems intended to interact directly with people so that those people are explicitly informed they are interacting with AI. The obligations apply from 2 August 2026.

Who is covered

Article 50 reaches both providers and deployers of AI systems intended to interact directly with natural persons. Law firm analysis lists IT, customer support, marketing and communication systems among the covered uses. The same analysis stresses the split between the provider, who builds the system, and the deployer, who uses it. Duties are tailored to each role.

For a US company, the practical reading is simple. If the chatbot talks to people in the EU, the rules are relevant, wherever the company is based. The vendor may design the disclosure into the product. The company that deploys it must still make sure customers actually see it.

What the notice must look like

The text of Article 50 requires that the information be clear and distinguishable, accessible, and given no later than the time of the first interaction or exposure. Three consequences follow:

1. The notice appears at the start, not after several turns or in a footer.
2. It is readable by everyone, including users of assistive technology and users in the language of the conversation.
3. It is distinct from other content, not buried in terms and conditions.

Exceptions

Article 50 contains an exception when the AI nature is obvious to a reasonably well-informed, observant and circumspect person, given the circumstances and context of use. It also exempts certain systems authorized by law to detect, prevent, investigate or prosecute criminal offences.

The obviousness exception is narrower than it sounds. A branded assistant named “Robo” in a help widget may be obvious. A voice agent that handles a phone call with natural speech, or a chat that hands over to an unlabeled agent, is not. Teams that rely on the exception should document why a reasonable user would not be confused. Most do better by disclosing.

Timing: what changed in 2026

The Digital Omnibus on AI, now in force as Regulation (EU) 2026/1744, delayed the high-risk system deadlines. According to an analysis of the adopted text, Article 50 transparency obligations still apply from August 2026, with a grace period for AI-generated content marking (watermarking) that runs to 2 December 2026. The identity disclosure for chatbots is therefore not postponed.

Penalties

Legal analysis of the Act reports that non-compliance with transparency obligations can lead to fines of up to €15 million or 3% of worldwide annual turnover. Whichever national authority supervises the market will decide how to enforce, so the exact practice will differ by member state.

United States: no federal statute, a growing state patchwork

US transparency law for chatbots is assembled from several layers. None of them is a general federal “disclose your bot” rule, and the state layer keeps expanding. Always check current text before relying on a summary, including this one.

State laws

The pattern is consistent. Disclosure is triggered by the risk of a person being misled, and some laws add rules for minors, regulated professions or sensitive subjects. Utah’s rule differs in shape: for ordinary sellers it is a disclose-on-request duty, while regulated professionals must disclose up front. A customer service bot at a retailer and a companion app face different tests.

Other states have introduced or passed their own measures, and law firm commentary notes that specialized state laws are emerging on top of a constant federal baseline. Companies operating nationally should track state developments on a recurring schedule instead of treating one law as the standard.

FTC enforcement

The baseline is Section 5 of the FTC Act, which prohibits unfair or deceptive practices. In the DoNotPay matter, the FTC alleged that the company made unsubstantiated claims that its chatbot operated like a human lawyer. The final consent order materials show the order prohibits unsupported claims that a service can perform professional services like a human.

The lesson reaches beyond disclosure. Transparency covers what an AI agent says about itself and its abilities, as well as whether it says it is AI. Commentary on current penalty levels puts the FTC’s maximum civil penalty for violating a trade regulation rule or existing order at $53,088 per violation as of September 2026. Because the figure is indexed and adjusted, confirm it on the FTC’s site before quoting it internally.

Beyond the law: what a good transparency notice contains

Law sets the floor. Frameworks from regulators in other regions show where expectations are heading. Singapore’s IMDA transparency guidelines for generative AI chatbots are voluntary, but they strongly encourage “chatbot info cards” that cover capabilities, limitations, safety, data usage and reporting channels. The IMDA compares them to a medical label: one consolidated reference the consumer can check.

A strong notice for a customer service agent covers the following:

• A plain statement. “You are chatting with an AI assistant.” No euphemisms such as “virtual teammate.”
• Scope. What the agent can and cannot do, such as refunds, account changes or medical, legal and financial advice.
• A route to a person. How to reach a human agent, and what happens when the user asks.
• Data use. Whether the conversation is recorded, analyzed or used for training, with a link to the privacy notice.
• Accessibility. Text that works with screen readers and is available in the language the customer uses.

Sample wording for a chat widget: “You’re chatting with an AI assistant. It can help with orders and account questions. Type ‘agent’ at any time to reach a person.” Adjust it for voice, where the statement must be spoken at the start of the call, and for email or ticket replies, where it belongs in the message itself, not only in a signature.

Where disclosure fails in real deployments

Written policy and live behavior often diverge. The failures that matter for compliance are rarely about a missing banner. They appear in the conversation itself:

• Channel gaps. The web chat discloses, but the voice line, SMS, WhatsApp or email channel does not.
• Handover blind spots. The user asks for a human, and the agent deflects, loops or claims to be one.
• Persona drift. A named, human-sounding persona answers “Are you a real person?” evasively.
• Overclaiming. The agent states it can give advice, guarantees or diagnoses beyond its remit, which is the pattern behind the FTC’s DoNotPay case.
• Vendor updates. A model or prompt change by the vendor silently alters behavior that was previously tested.

Escalation is the most common weak point. Lexic’s own audits of conversational AI agents found that 85% of the agents assessed failed to escalate issues to a human representative appropriately. That finding is Lexic’s, based on its assessments, and it shows why a disclosure that says “ask for a human” must be verified against what happens when someone does.

How to implement and verify transparency

A workable program has six steps. It works for a single chatbot and scales to a portfolio of agents from several vendors.

1. Inventory every AI agent that talks to customers. Include chat, voice, email and ticket automation, and note the vendor, the channels and the markets served.
2. Assign roles. Decide whether the company is provider, deployer or both for each system under the EU framework. This determines who writes the notice and who verifies it.
3. Write the disclosure for each channel. Put it at the first interaction, in clear language, in each language served.
4. Define the exceptions you rely on. If a use is treated as obvious, record the reasoning and who approved it.
5. Test as a real user would. Start conversations on every channel. Ask whether the agent is human. Request a person. Raise a sensitive topic. Try it in each supported language and on each device type.
6. Keep evidence and repeat. Store the transcripts, timestamps and results. Repeat after every vendor release, prompt change or new market launch.

Step five is where most programs are thin. Vendor dashboards report on the vendor’s own metrics. They do not show what a customer actually experienced across channels, and they rarely test adversarial or edge-case behavior. Independent testing from the outside closes that gap, and a tamper-evident record makes the result usable in a dispute with a vendor or a regulator.

Perspective

Transparency obligations are often treated as a copywriting task: add a banner, publish a policy, move on. In our audits, the gap is almost never the banner. It is the behavior behind it.

An AI agent can disclose itself correctly in the first message and still fail the customer two turns later. It can refuse to hand over to a human, contradict the company’s policy, or claim abilities it does not have. Vendor-led monitoring tends to measure what the vendor built the agent to do. It does not measure what a real user encounters.

That is why we assess agents from the outside, interacting with them as real users do, across Customer Experience, Security, Technical Reliability and Regulatory Compliance. The result is evidence an organization can act on. Third-party cryptographic hashing supports the integrity and traceability of that evidence, which matters when a company needs to hold a vendor accountable or show a regulator what it checked and when.

Our view is that transparency is a continuous control, not a one-time launch task. Agents change, vendors update models, and new markets bring new rules. Companies that run independent checks on a regular cycle will know their position before a regulator or a customer tells them.

Sergio Llorens

How Lexic supports transparency checks

Lexic Compass is Lexic’s AI Agent Audit platform. It independently assesses conversational AI agents from any vendor by interacting with them as real users would, and it reports findings on customer disclosure, escalation handling, security, technical reliability and regulatory compliance. Engagement options, including Flash Preview, Audit Sprint and Enterprise Continuous Trust, are described on the Compass audit page.

For teams that also want to understand what customers say across calls, chats, emails and tickets, Lexic Pulse analyzes conversations for sentiment, churn and opportunity signals. Together, the two connect AI oversight with a clearer picture of customer needs and friction points.

A short checklist for US companies serving EU customers

• Confirm which agents interact with people in the EU and which channels they use.
• Verify that the identity disclosure appears no later than the first interaction on each channel.
• Check the disclosure in each language you serve, and for accessibility.
• Confirm that a request for a human reaches a human, and record what the agent says on the way.
• Review marketing and sales copy against what the agent can actually do, to avoid deceptive capability claims under US law.
• Track the state laws where your US customers live, and review them on a fixed schedule.
• Archive dated evidence of every test, and rerun after vendor changes.

FAQ

Do all chatbots have to say they are AI?

Not under every law, but the direction is clear. The EU AI Act requires that people be informed of AI interaction unless it is obvious to a reasonably well-informed person. US state laws such as Maine’s apply where a consumer could be misled into thinking they are talking to a human. Disclosing at the start of every interaction satisfies the intent of both approaches.

When do the EU chatbot transparency rules apply?

The Article 50 obligations apply from 2 August 2026. The 2026 Digital Omnibus delayed high-risk system deadlines, but not the chatbot identity disclosure. A separate grace period for marking AI-generated content runs to 2 December 2026.

Does a US company need to follow the EU AI Act?

If its AI system interacts with people in the EU, the Act’s transparency rules are relevant, wherever the company is headquartered. A deployer should confirm its role with legal counsel and check whether the vendor’s product already includes the disclosure. The company still needs to verify that customers see it.

What happens if a chatbot fails to disclose?

In the EU, reported penalties for transparency non-compliance reach €15 million or 3% of worldwide annual turnover, enforced through national authorities. In the US, exposure comes from state law and from the FTC, which can pursue deceptive practices. Oregon and some other states also provide for private lawsuits in specific chatbot laws, so check the statute that applies to your customers.

How can a company prove its chatbot discloses correctly?

By testing it as a user would, on every channel and language, and keeping dated records of the results. An independent assessment adds credibility because it does not rely on the vendor’s own reporting. Repeat the tests after every model or configuration change.

Sources

• EU Commission: Guidelines on transparency obligations for AI providers and deployers
• EU AI Act Service Desk: Article 50, transparency obligations
• Sorainen: Article 50 in practice
• Usercentrics: EU AI Act Digital Omnibus analysis
• Maine Title 10, §1500-DD
• Utah Code Title 13, Chapter 77
• California SB 243: Companion chatbots
• DLA Piper: AI disclosure laws on commercial chatbot interactions
• FTC: DoNotPay final consent materials
• Conferbot: AI chatbot disclosure laws by state
• Singapore IMDA: Transparency guidelines for generative AI chatbots