EU AI Act Chatbots: Article 50 Rules for US Companies

The EU AI Act requires any chatbot that talks directly with people in the EU to tell them they are dealing with AI, unless that is obvious. The duty has applied since 2 August 2026. It covers US companies whenever the system is placed on the EU market or its output is used in the EU. This guide explains who is covered, what a compliant chatbot must do, where companies most often fall short, and how to verify the result.

TL;DR

• Article 50 transparency duties for chatbots and other interactive AI have applied since 2 August 2026, and the Commission and national authorities have begun enforcing the Act.
• US providers and deployers are in scope when the system is placed on the EU market or its output is used in the EU.
• The “obvious interaction” exception is narrow. Default to an explicit disclosure at the start of every customer-facing conversation.
• Generative text, audio, image and video outputs need machine-readable markers. Systems already on the market before 2 August 2026 have until 2 December 2026.
• A written policy is not proof. Compliance has to be verified in real conversations, including how the agent behaves when a customer asks for a human.

Table of Contents

• What the EU AI Act says about chatbots
• When your chatbot triggers Article 50
• Does it apply to US companies?
• Key dates for 2026
• What a compliant chatbot does
• Common failure points
• Penalties and enforcement
• Perspective: why disclosure has to be verified, not declared
• A verification checklist for your chatbot
• How Lexic supports chatbot compliance
• Frequently asked questions
• Sources

What the EU AI Act says about chatbots

The AI Act (Regulation (EU) 2024/1689) sorts AI systems by risk. Most customer service chatbots are not “high-risk” in the Act’s sense. They fall under the transparency tier, set out in Article 50. The Commission’s overview of the Act and the high-level summary both describe this tiered structure.

The purpose of Article 50 is simple. The Commission states that the rules help people recognize when they are interacting with an AI system or are exposed to AI-generated content, as set out in its quick facts on transparency rules. The Commission frames transparency as a foundation of trustworthy AI, so that people can calibrate how much to trust what they see and hear, according to its announcement on enforcement starting 2 August.

Two separate duties matter for chatbots:

1. Disclosure of the interaction. People must be told they are talking to an AI.
2. Marking of generated content. Synthetic text, audio, image or video must carry machine-readable markers so it can be detected as artificially generated.

A third body of law runs in parallel. The GDPR applies in full to AI systems that process personal data. The European Data Protection Board’s 2024 annual report stresses accountability, transparency and data minimization for AI models, and warns that legitimate interest is not a blank check.

When your chatbot triggers Article 50

Not every AI system with a text box is covered. According to the Commission’s FAQ on Article 50, the disclosure duty in Article 50(1) applies when four criteria are all met:

Background systems and purely machine-to-machine exchanges are excluded. Voice agents, web chat, in-app assistants and messaging bots on WhatsApp or similar channels all meet the test when they respond directly to customers.

The “obvious interaction” exception

Article 50(1) does not require disclosure when the AI nature of the interaction is obvious to a reasonably observant person. Many teams read this as permission to skip the notice because the widget is called “Assistant” or has a robot icon.

That reading is risky. The exception is narrow, and a company relying on it would need to show that an informed, observant person would recognize the AI instantly without any label. A friendly name and a human-like avatar do the opposite. A synthetic voice that sounds natural on the phone is even harder to defend. The safer practice is an explicit statement at the start of each conversation, on every channel.

Does it apply to US companies?

Yes, in many cases. The Commission’s FAQ states that the obligation applies whether or not the provider is established in the EU, as long as the system is placed on the EU market or its output is used in the Union. A US company serving EU customers through a chatbot is therefore in scope, whether it is a provider (developing or commissioning the system) or a deployer (using it under its own authority).

The roles matter because duties differ:

• Providers must design the system so that people are informed they are interacting with AI, and so that generated outputs are marked in a machine-readable format.
• Deployers must make sure the disclosure actually reaches the customer in their own deployment, and handle content labeling duties that attach to their use.

Most companies are deployers of a vendor’s model, and many are also providers of their own configured agent. Contracts with a vendor can allocate cost and effort, but they do not move the regulatory duty away from the company facing the customer. The text of Article 50 and the Commission’s guidelines on transparency obligations are the starting point for working out which role applies to you.

A practical test for a US team: do EU residents ever reach the agent? If your site, app or phone line accepts EU visitors, or an EU-based customer’s support request lands in the same bot as US traffic, assume the rules apply to that conversation.

Key dates for 2026

The dates for enforcement and the grace period come from the Commission’s announcement and Article 50 FAQ. Content generated before 2 August 2026 does not need retroactive labeling, though the Commission encourages voluntary labeling where possible.

One point of confusion: the Digital Omnibus package postponed the high-risk (Annex III) obligations to December 2027, but a Cloud Security Alliance research note reports that Article 50 was left out of that deferral. Do not plan around the later high-risk date for a customer-facing chatbot.

What a compliant chatbot does

The legal text is short. Operational compliance is not. A chatbot that meets Article 50 in practice usually has these elements.

A clear disclosure at the start

Place the notice in the first message or before the conversation begins, in the language the customer is using. Plain wording works: the customer is chatting with an AI assistant, not a person. For voice, the agent should say so in the greeting. A footer link or a line buried in terms of service is not a disclosure that the customer will notice.

Consistency across channels

Companies often fix the website widget and forget the rest. Check the phone line, email auto-responders, in-app assistants, messaging channels and any AI-drafted replies that go out without human review. Each one is a separate place where the duty can fail.

Machine-readable marking for generated content

If the agent produces synthetic text, audio, images or video, the output needs technical markers that let tools detect it as AI-generated. Systems that were already on the market before 2 August 2026 have until 2 December 2026 to add them. New systems need them immediately. Ask your vendor in writing what marking method is used and how it can be verified.

Honest handling of “are you a human?”

Disclosure at the start is not enough if the agent later denies being AI or deflects when asked directly. A compliant agent answers the question truthfully every time, whatever the prompt, persona or script.

A path to a human

Article 50 does not itself contain a rule that every chatbot must hand off to a person. But escalation is where transparency problems and customer harm show up together: a customer who cannot reach a human, and is not sure whether they are talking to one, is the exact situation the Act’s trust objective targets. Good escalation design, such as the rules described in this guide to AI-to-human escalation rules, also reduces repeated explanations for the customer.

Data protection alongside transparency

A disclosure line does not settle GDPR questions. The EDPB’s report says models must be assessed case by case before anyone treats them as anonymous, and anonymity holds only if extraction of personal data or identification through queries is highly improbable. Companies that deploy conversational AI on customer data need documented answers on legal basis, retention and anonymization. A structured approach to AI data governance frameworks can help build that documentation.

Common failure points

The same gaps recur when conversational AI is reviewed in production rather than on paper.

• Disclosure exists in the design file but not in the live flow. A release, a channel change or a prompt update removes it.
• The persona overrides the notice. A branded character with a human name and a warm backstory creates a false impression that the disclosure line does not cure.
• Reliance on the obvious-interaction exception. Teams assume customers will know, with no evidence that they do.
• Escalation fails. In audits run on its platform, Lexic found that 85% of the audited agents did not properly escalate issues to human representatives. Customers who ask for a person are looped, deflected or handled by the AI beyond its competence.
• Vendor assurances stand in for evidence. The vendor says the model is compliant. Nobody has checked what the deployed agent says to a real customer on a Tuesday afternoon.
• No record. If a regulator asks how you know the agent discloses itself, a screenshot of the configuration is weak. Conversation-level evidence is stronger.

Penalties and enforcement

The Act gives authorities the power to impose administrative fines under the conditions and ceilings of Article 99, and the Commission’s FAQ confirms that non-compliance with Article 50 can lead to significant fines. From 2 August 2026, the AI Office and national authorities enforce the Act, per the Commission. Specific enforcement practice is still developing, so treat any claim about how strictly a particular authority will act with caution, and have legal counsel confirm the current ceiling applicable to your case.

For a US company, the practical exposure is not only the fine. It includes an investigation, the cost of producing evidence, contract friction with EU enterprise buyers who now ask for proof, and reputational damage if customers learn they were not told.

Perspective: why disclosure has to be verified, not declared

We audit conversational AI agents from any vendor, and one pattern holds across deployments: the policy and the behavior are different things. A company can have a sound disclosure standard and still ship an agent that skips it on one channel, or drops it after a model update.

That is why we treat independent verification as the core of AI assurance. We do not build or operate the agents we audit. That separation matters when a compliance team has to defend its position before a regulator, because the evidence comes from real conversations, not from vendor-supplied data.

Our audits look at disclosure, escalation, security vulnerabilities and customer experience together, because failures in one area tend to reveal failures in another. Our finding that 85% of audited agents fail to escalate properly is a useful illustration: the agent is technically live and answering, but the customer has no path to a person. Under the Act’s transparency logic, that is a trust failure, not a minor usability issue.

For US companies entering Europe, our advice is to sample actual conversations early, before launch in an EU market, and to repeat the sampling continuously. Chatbot behavior changes with prompts, models and integrations. A one-time review ages quickly.

— Sergio Llorens

A verification checklist for your chatbot

Use this list to check where you stand. Each item should produce evidence, not an opinion.

1. Inventory every customer-facing AI interaction. Include voice, chat, email, tickets and messaging channels, and note which reach EU residents.
2. Define your role. Decide whether you are a provider, a deployer or both for each agent, using the Commission’s guidelines.
3. Write the disclosure standard. Specify the wording, placement and languages for each channel.
4. Test it in production. Run real conversations, including ones that start mid-flow, switch language or ask “are you a person?”.
5. Test escalation. Ask for a human in several phrasings and confirm the agent actually transfers with context.
6. Check marking. Confirm in writing how generated content is marked and which deadline applies to each system.
7. Review data protection. Document the legal basis, retention and any anonymization claims, using the EDPB’s case-by-case approach.
8. Keep records. Store test results and dates so you can show a regulator what you checked and when.
9. Repeat. Re-test after every model, prompt or integration change.

How Lexic supports chatbot compliance

Lexic offers independent auditing and governance for conversational AI agents from any vendor. Lexic Compass verifies real-world agent behavior, including regulatory compliance, security vulnerabilities, escalation handling and customer disclosure. Audit engagements are available as a Flash Preview, an Audit Sprint, or Enterprise Continuous Trust for ongoing monitoring, described on the audit engagement page.

For teams that also want to learn from what customers say, Lexic Pulse analyzes 100% of customer conversations across calls, chats, emails and tickets, and produces sentiment, churn and opportunity insights for CX, Sales, Product, QA and other teams. Pricing is not published; the pages above explain the options.

Frequently asked questions

Do I have to tell customers they are talking to a chatbot?

Yes, in most cases. Article 50(1) requires that people interacting directly with an AI system are informed of it, unless it is obvious to a reasonably observant person. Because that exception is read narrowly, an explicit notice at the start of the conversation is the safer choice.

Does the AI Act apply if my company is based in the US?

It can. The Commission states that the obligation applies regardless of where the provider is established, if the system is placed on the EU market or its output is used in the EU. If EU residents use your chatbot, treat the rules as applicable to those conversations and confirm the details with counsel.

What is the deadline for chatbot transparency rules?

The disclosure duties have applied since 2 August 2026. For generative systems placed on the market before that date, the deadline to implement marking and detection of AI-generated output is 2 December 2026. Systems placed on the market after 2 August 2026 must comply from the start.

Is a chatbot with a robot icon exempt from disclosure?

Not reliably. An icon or a name may help, but you would need to show that an informed, observant person would instantly recognize the AI without a label. Voice agents and human-sounding personas make that hard to defend, so explicit disclosure remains the practical standard.

Does the AI Act require a handoff to a human agent?

Article 50 does not set a general handoff rule. Even so, a customer who cannot reach a person undermines the trust the transparency rules aim to protect, and other laws or sector rules may require human contact. Testing escalation is a sensible part of any chatbot compliance review.

Sources

• Transparency obligations under Article 50 of the AI Act (European Commission FAQ)
• Guidelines on transparency obligations for providers and deployers of certain AI systems (European Commission)
• Quick Facts: Transparency rules for AI systems (European Commission)
• Commission starts enforcing AI Act rules and new transparency requirements on 2 August
• Article 50: Transparency Obligations for Providers and Deployers of Certain AI Systems
• High-level summary of the AI Act
• Rules for trustworthy artificial intelligence in the EU (EUR-Lex)
• EDPB Annual Report 2024
• EU AI Act Article 50: Transparency Obligations Take Effect (Cloud Security Alliance)