EU AI Act Article 50: What Your Website Must Now Disclose

Article 50 of Regulation (EU) 2024/1689 - the EU AI Act - has applied since 2 August 2026. It requires that people can tell when they are talking to an AI system or looking at AI-generated content. For most business websites that comes down to three concrete questions: what your chat assistant has to show, what belongs under an AI-generated image, and when an AI-assisted blog article needs a note. The answers are narrower than most coverage of the rule suggests.

What applies, and since when

Under Article 113 of the Regulation, Article 50 has applied since 2 August 2026 - a date already behind us, so this is settled law, not an upcoming change. One exception runs longer: under Article 111(4), providers of AI systems already on the market before 2 August 2026 have until 2 December 2026 to retrofit the technical, machine-readable marking of their outputs required by Article 50(2). That deadline concerns the providers of image and text generators, not businesses that merely use them. Breaches of Article 50 can be fined under Article 99(4) with up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher - considerably less than for prohibited practices under Article 5, but not a sum to shrug off. Article 99(6) provides for reduced caps for small and medium-sized businesses.

Provider or deployer: who the duty falls on

Article 3 of the AI Act distinguishes between providers, who develop an AI system or have one developed and place it on the market under their own name, and deployers, who use an AI system under their own authority. Embed a ready-made chat tool from a provider into your site, and you are, as a rule, a deployer. Build your own branded assistant on top of it, and you may count as a provider for that product too. In practice this changes little: the disclosure has to be visible in your interface regardless of who is formally responsible for it - build on that assumption rather than on a legal label only a dispute would settle.

The chat window on your website

Article 50(1) requires that visitors know, from the start of a conversation, that they are talking to an AI, unless that is already obvious. The Regulation's recitals set the bar for "obvious" at a reasonably well-informed, observant and circumspect person - a standard you should not assume will work in your favour if it is ever tested. Do not rely on the exception; show the notice actively instead: one line at the start of the conversation is enough, as long as it is, per Article 50(5), clear and distinguishable - not buried in the terms and conditions, not a fleeting aside. That is a different duty from the privacy notice a chatbot also needs once it processes personal data - the data processing agreement, server location and retention period are covered in AI Chatbots: What They Can Actually Do. Both notices usually fit into the same welcome message, but they answer different questions: one tells visitors who processes their data, the other tells them a machine is answering at all.

AI images: a visible label only for deepfakes

For images, the visible disclosure duty is narrower than most people assume. Article 50(4) only obliges deployers to disclose when an image is a deepfake - a realistic, deceptive depiction of a real, identifiable person, place or event. A generic AI illustration for a blog post, an abstract header image, or an AI-assisted stock-style photo with no real subject behind it is not covered. The technical, machine-readable marking of such images is required separately, under Article 50(2) - but that duty sits with the providers of the image generators, who embed it invisibly in the file, not with you as the person using the tool.

AI-assisted articles: where the duty and the choice sit close together

For text, the duty is the least clearly drawn. Article 50(4) only requires disclosure for AI-generated text published to inform the public on matters of public interest - a category the Commission's guidance describes as covering political, economic, scientific and cultural developments, among others. Whether an ordinary how-to article for tradespeople or law firms falls under that is not settled, and there is no case law on it yet. In practice the question often does not matter, because a second condition still has to be met: even where a text would be covered, the duty falls away once it has been through human review and a person or business holds editorial responsibility for the publication. The Commission's guidelines on Article 50 - as of summer 2026 - spell this out further: what is required is a substantive review by someone with relevant expertise, not a merely formal or superficial pass.

This is exactly the point at which we could invoke the exception and label nothing - our editorial process, with a responsible review before every publication, would likely satisfy it. We do it anyway: every article on this blog carries a note when AI helped with research or a first draft, regardless of whether the law requires it. Why we use AI in the editorial process at all, and where a person keeps the final responsibility, is covered in AI-Written versus Edited Content.

What the EU AI Act does not require

• No disclosure for spellchecking, translation, or AI-assisted research that does not substantially change a text
• No prescribed wording - the law only requires the notice to be clear and distinguishable
• No separate consent or cookie banner specifically for AI disclosure, GDPR duties around data processing remain a separate check
• No requirement to name the specific AI provider or model you used
• No visible label for generic AI images that do not depict real people, places or events

What to do in the next 90 days

• Days 1-30: open your chat widget and check whether it visibly states, at the start of a conversation, that an AI system is answering - add it in the provider's backend if it is missing
• Days 31-60: review the last twelve months of published images for AI content depicting real, identifiable people or events, and label those retroactively; generic illustrations need nothing
• Days 61-90: write down your editorial process for AI-assisted text - who reviews it, who holds responsibility - and decide whether to add a visible note per article regardless

Conclusion

For most business websites, Article 50 amounts to three duties smaller than their reputation suggests: one visible line in the chat window, a label for deepfakes rather than for every AI image, and a text duty that a properly reviewed editorial process usually satisfies on its own. This article explains the legal position but is not legal advice for your specific case - if you are unsure whether you count as a provider or a deployer, a short conversation with a lawyer is worth it. What a GDPR-compliant website looks like in full is covered in The GDPR Website Check, and what we monitor on an ongoing basis as part of the website subscription is set out under GDPR and Privacy.