AI disclosure and chatbot regulation: a tracker for designers
What the EU AI Act now requires of chatbots and voice assistants, what was delayed and what was not, and a design checklist. Dated and sourced. Not legal advice.
Not legal advice
This page summarizes public sources so designers know what to ask their legal team. Laws change and apply differently to each company. Last verified: November 3, 2026, against law-firm and trade-press summaries published between July and October 2026. For exact wording, read the Official Journal text of Regulation (EU) 2024/1689 (the AI Act), Article 50, and the Digital Omnibus on AI.
What applies now: Article 50 of the EU AI Act
Article 50 sets transparency duties for certain AI systems. Summaries agree on four of them: tell people when they are interacting with an AI system, mark synthetic content in a machine-readable way, give notice when emotion recognition or biometric categorization is used, and label deepfakes and AI-generated text published to inform the public on matters of public interest.
| Duty | Who it mainly falls on | Applies from | What it means for a support assistant |
|---|---|---|---|
| Disclose that the person is talking to an AI, unless that is obvious from the circumstances | Providers design the system for it; deployers must make sure it shows on their channel | 2 August 2026 | Say so in the conversation. Do not rely on "it is obvious". |
| Machine-readable marking of AI-generated audio, image, video or text | Providers of generative AI systems | 2 August 2026; a grace period to 2 December 2026 for systems already on the market before 2 August | Mostly your model vendor's job. Check your contract. |
| Notice for emotion recognition or biometric categorization | Deployers | 2 August 2026 | If your voice analytics infers emotion, people must be told. |
| Label deepfakes and public-interest AI text | Deployers | 2 August 2026 | Relevant to campaigns and published content more than to chat. |
Reported points worth knowing:
- The disclosure duty had no grace period. The December 2026 transition covers only the machine-readable marking for systems already on the market.
- It reaches providers and deployers outside the EU when the system's output is used in the Union. A company with EU users is in scope without a European office.
- A company that commissions and brands a chatbot can be treated as its provider. Vendor contracts should say who handles each duty.
- Reported penalties for transparency breaches go up to EUR 15 million or 3% of worldwide annual turnover.
What was delayed, and what was not
The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026, as reported) postponed the high-risk rules: stand-alone high-risk systems listed in Annex III moved to 2 December 2027, and high-risk AI in regulated products to 2 August 2028. It did not move Article 50. Headlines that said "the EU delayed the AI Act" were true for high-risk systems, not for chatbot disclosure.
Design checklist: disclosure that works
This is design advice, not a legal reading.
- Say it early, in plain words. "You're chatting with an AI assistant. A person can join if you ask." Put it in the first message and keep a visible label while the chat is open.
- Say it in the user's language and in the channel they use (web chat, WhatsApp, SMS, email). A footer link is not a disclosure.
- Voice: say it in the first sentence and again when a call is transferred or resumed. Synthetic voices need it as much as text does.
- Do not imply a person. Avoid a human name, photo or "I'm Sam from support" unless it is clearly labeled as an AI.
- Announce the handoff. Tell users when a person joins, and how to ask for one (module 11).
- Record it. Log that the disclosure was shown, with the version of the wording (module 17).
- Check your vendor. If a configuration removes the vendor's built-in disclosure, you may have removed a legal duty.
- Outbound calls and messages: disclose at the start and follow consent rules (module 13, and the FCC case study on AI voices in robocalls).
Other places (verify locally)
- United States. A patchwork. California has had a bot-disclosure law since 2019, and states keep adding rules for AI in customer communication. The FCC ruled in 2024 that AI-generated voices count as "artificial" under the robocall law (see the case study). Check each state you serve.
- Brazil. The LGPD applies to personal data in conversations: a legal basis, transparency, and data-subject rights. Dedicated AI legislation has been under discussion; check its current status before relying on it.
- Everywhere. If a bot states a policy, you can be held to it. See the Air Canada case study and module 18.
What to do this week
- List every assistant and channel that reaches EU users.
- Check that each one tells the user it is an AI, in the first message or sentence.
- Ask each vendor in writing who handles disclosure and marking.
- Add the disclosure wording and its version to your test cases (module 15).
- Put a review date on this topic. It will change again.
Related modules
Sources
- Baker Botts: EU AI Act Article 50 transparency obligations go live (Sep 2026)
- CMSWire: Is your contact center ready for Europe's chatbot disclosure rules? (Oct 2026)
- Technology Org: EU AI Act deadlines after the Digital Omnibus (Oct 2026)
- Legalithm: The EU AI Act on 2 August 2026, what actually applies
- Praxikon: Article 50 AI Act, rules and checklist