A business chatbot that interacts directly with people will often need to make clear that it is an AI system. But the answer does not follow from the label “chatbot.” It depends on the system’s actual behaviour, the interaction, who legally provides it and whether an average user would already recognise the AI nature in context.
The answer depends on the system and the provider
Since 2 August 2026, Article 50(1) of the EU AI Act requires the provider of an AI system intended to interact directly with natural persons to design and develop it so those people are informed that they are interacting with AI—unless that fact is already obvious in the circumstances and context of use.
Where the rule applies, the information must be clear, distinguishable and accessible no later than the first interaction.
That does not mean every interface called a chatbot follows the same rule, or that the business operating it is automatically the provider. Before deciding what notice to display, establish:
- whether the interface is an AI system under the Act;
- whether it supports a genuine two-way exchange;
- whether the AI interacts directly with a natural person;
- who provides the system that is actually placed on the market or put into service;
- whether its AI nature is objectively obvious in context.
Follow the system, interaction and provider role before deciding what notice the first contact needs.
Is the interface an AI system?
Check the actual technical behaviour, not the product label.
Yes — continueDoes it support a genuine two-way exchange?
Fixed data collection or predefined replies may not meet this condition.
Yes — continueDoes the AI interact directly with a natural person?
Exclude machine-to-machine use and exchanges mediated by a person.
Yes — continueIs the provider of the interactive system identified?
Separate provider, deployer, model supplier and final system.
Yes — continueRole cue: Article 50(1) assigns the design duty to the provider. The business using the system should verify its real role, contract and implementation.
Is the AI nature objectively obvious in context?
Use the narrow exception only for a reasonably informed and observant person.
Yes — continueIs the notice clear, distinguishable and accessible by first interaction?
Test every channel, language, handover and voice state.
Yes — continue
Article 50(1) likely in scope
Obtain qualified review for the specific configuration. This map does not certify compliance.
This specific duty may be out of scope
Record why and check privacy, consumer, sectoral and other applicable rules.
Role or classification is unclear
Escalate with the technical facts, branding, contract and deployment model.
Decision support only — not legal advice or a compliance verdict.
The rule that applies from 2 August 2026
Article 50 of the AI Act contains several different transparency duties. Paragraph 1 covers AI systems intended to interact directly with people. Other paragraphs address synthetic-content marking, emotion recognition, biometric categorisation, deepfakes and certain public-interest text.
For an ordinary business chatbot, paragraph 1 is the starting point. It assigns the design duty to the provider. Paragraph 5 says the information required by paragraphs 1–4 must be clear and distinguishable, provided by the first interaction or exposure, and meet applicable accessibility requirements. Article 113 confirms the general application date of 2 August 2026.
The law does not prescribe one universal sentence. “You are interacting with an AI system” is direct, but final wording and presentation depend on language, channel, audience, accessibility and implementation. A specific notice may need qualified legal review.
Not every chatbot is the same system
The Commission’s Article 50 FAQ describes four cumulative conditions:
- the interface qualifies as an AI system;
- it is designed for a genuine two-way exchange, rather than only collecting data or returning fixed automated responses;
- the AI itself interacts directly with the person rather than through a human intermediary;
- the other party is a natural person.
Background systems, machine-to-machine communication and tools without direct contact with people fall outside this specific duty. A fully fixed decision tree may also fall outside the AI-system definition or the genuine-exchange criterion. The interface alone cannot settle that classification; the technical behaviour matters.
The distinction between scripted chat, an AI assistant and a tool-using agent is relevant only to this limited scope decision. The AI Agents service page explains the wider operational distinction without replacing legal analysis.
Provider or deployer: identify the legal role
Article 3 defines a provider as the person or organisation that develops or has an AI system developed and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority in a professional context.
A business activating a standard vendor service may be a deployer without automatically becoming the Article 50(1) provider. Custom development, white-labelling, own-name deployment or material changes can alter the analysis. Contracts, technical documentation, branding and actual control matter.
Do not guess the role:
- identify who developed or commissioned the interactive system;
- record whose name or trademark accompanies putting it into service;
- distinguish the provider of an underlying model from the provider of the final AI system;
- confirm what the deployer must configure and communicate;
- escalate ambiguous arrangements for qualified legal review.
Even when a vendor states that disclosure is built in, the business should verify what users actually encounter across its channels, languages and interaction states. That is M4TIC governance guidance, not a reassignment of the statutory duty.
When is the AI interaction already obvious?
Article 50(1) includes an exception where the AI nature is obvious to a reasonably well-informed, observant and circumspect person, taking account of the circumstances and context of use.
The Commission says the exception should be interpreted restrictively because it removes transparency. A robot icon, avatar, product name or “virtual assistant” label does not automatically pass or fail the test.
Assess the complete experience:
- the copy introducing the channel;
- any human name, voice or face;
- transitions between AI and a human operator;
- voice or embedded channels with no persistent visual label;
- the intended audience and its reasonable expectations;
- language, legibility and accessibility.
For a normal business implementation, relying on obviousness as a shortcut is more fragile than providing a simple, testable notice. That is M4TIC’s implementation judgement, not a legal conclusion for every case.
What a clear disclosure needs to achieve
The notice should allow a person to understand, before relying on the exchange, that the interaction is with an AI system.
In practice, verify that it:
- appears by the beginning of the first interaction rather than only in terms and conditions;
- is perceivable in the actual channel, including voice;
- survives embedding in a website, app or messaging platform;
- is not contradicted by a name, avatar or presentation suggesting a human;
- meets applicable accessibility requirements;
- keeps identity clear when the conversation moves between AI and a person.
One line of copy is not, by itself, proof of compliance. The implementation must be tested in the experience that will be released.
Identity, data and authority are separate questions
The M4TIC model separates three questions that often appear in the same interface but do not arise from the same legal rule.
Identity
Am I interacting with AI or a person? This is where Article 50(1) directly applies when its conditions are met.
Data
What happens to my messages, voice, files or identifiers? Where personal data is processed, GDPR transparency may require information about the controller, purposes, legal basis, recipients, retention, transfers and rights, according to the actual processing. An AI identity notice is not a privacy notice.
Private AI for business provides the broader map of where information travels, who can access it and how deployment choices change exposure.
Authority
What can the system decide or do, and when can a person intervene? Explaining material capability limits, connected actions, approval points and a usable human handover is M4TIC implementation guidance. Sectoral, consumer, contractual or data-protection rules may add duties, but Article 50(1) does not prescribe one universal capability-and-handover statement.
Identity disclosure is therefore necessary in many cases, but it is not a complete description of the system or proof of overall compliance.
Three scenarios that need different analysis
A fixed FAQ path
An interface offering only predefined choices and fixed answers may not meet the AI-system definition or genuine-exchange criterion. This particular Article 50(1) duty may be out of scope, while privacy, consumer law and good service design still need attention.
A third-party AI assistant
The vendor may be the provider while the business acts as deployer. Review the contract and product documentation, then verify that the notice actually appears in every channel and language. Do not assume the default widget covers a customised journey.
A custom or white-label action-taking agent
Provider status can become more complex when the system is commissioned, integrated under the business’s name, materially changed or put into service for its own use. Operational authority also expands: identity disclosure needs to sit alongside proportionate limits, approvals, logs and handover. Classification requires technical and contractual facts and may require legal advice.
What to verify before launch
Before approving the experience, record:
- what the system actually does and the evidence for the scope conclusion;
- provider, deployer and other relevant parties, with the supporting contract and documentation;
- notice wording, placement, timing and accessibility in every channel;
- the basis for any reliance on the obviousness exception;
- the correct privacy path for the data actually processed;
- capability limits and human handover information users need;
- test evidence for first contact, return visits, errors, handover and voice states.
Keeping that record is M4TIC governance guidance, not a statutory checklist or substitute for legal assessment.
How to test an AI agent before launch provides a wider method for checking outcomes, tools, escalation and recovery. Technical testing does not replace legal review, but it can show whether the approved disclosure experience exists in the released configuration.
The broader customer journey, knowledge boundary and human handover can be mapped through the customer assistant system.
When qualified legal review is necessary
Seek professional advice where provider status is unclear, the system is custom or white-label, it makes consequential decisions, operates in a regulated sector, interacts with children, handles sensitive data or combines several jurisdictions and channels.
GDPR application—including whether automated-decision rules are relevant—also depends on the facts. This guide does not determine legal basis, controller allocation, Article 22 applicability or the compliance of a particular implementation.
Useful transparency is not a legal sentence added at the end of a project. It makes the system’s identity, data handling and authority understandable at the moment a person decides whether to interact and trust it.
Sources and further reading
Primary guidance behind this article.
- Regulation (EU) 2024/1689 — consolidated textEUR-Lex
Consolidated AI Act text dated 27 July 2026.
- Article 50: Transparency obligationsEuropean Commission AI Act Service Desk
Consolidated text covering direct interaction, the exception, timing and accessibility.
- Article 3: DefinitionsEuropean Commission AI Act Service Desk
Definitions of AI system, provider, deployer and putting into service.
- Article 113: Entry into force and applicationEuropean Commission AI Act Service Desk
Confirms general application from 2 August 2026 and the consolidated timetable.
- Transparency obligations under Article 50 of the AI ActEuropean Commission
Official FAQ on cumulative criteria, roles, first interaction and the obviousness exception.
- Obligations for organisationsEuropean Commission
Official overview of GDPR transparency duties for organisations.