The EU Chatbot Disclosure Rule Went Live on 2 August and You Are the Provider. Being Outside Europe Does Not Help.
Article 50 of the EU AI Act has applied since 2 August 2026. It is the transparency article, and it is the part of the Act that reaches ordinary software rather than high-risk systems. If you shipped a support chat widget, an onboarding assistant, or anything that talks back to a person, you are a provider under Article 50(1) and the obligation to tell users they are dealing with an AI is yours.
I am not a lawyer and this is not legal advice. What follows is a careful read of the Commission's own FAQ on Article 50, published by DG CONNECT and last updated 24 July 2026, aimed at the specific question a solo operator has: does this land on me, and what do I do about it this week.
Yes, it reaches you if you are outside the EU
The Commission's FAQ is unambiguous on this. Providers are the people who develop AI systems, or have them developed, and place them on the EU market or put them into service under their own name, and this applies "irrespective of whether those providers are established or located within the EU or in a third country." Providers outside the EU are subject to the Act if the output of their AI system is used in the EU.
That is a broad hook. A US-based solo founder with a chat widget on a public marketing site has European users, because public websites have European users.
There is also a carve-out worth knowing. Using an AI system in a personal, non-professional capacity is outside the scope of the Act entirely. But the FAQ says that if the activity earns economic benefit on a regular basis, or is otherwise part of a business, trade, occupational or freelance activity, it is professional and you are a deployer. Freelancers do not get the personal-use exemption for client work.
The four things Article 50 actually asks for
Tell people they are talking to an AI. Article 50(1) applies to systems designed for a genuine two-way exchange, communicating directly with a natural person, unless it is obvious they are dealing with AI. The notification must come from the start of the first interaction, in a clear and distinguishable manner, and in line with accessibility requirements. Systems that only run in the background, or communicate machine to machine without direct human contact, are outside the obligation.
The "unless it is obvious" exception is narrower than it sounds. The Commission says it should be interpreted restrictively, because it deprives people of transparency, and the test is what a reasonably well-informed, circumspect and observant average person would conclude. I would not build a compliance strategy on the theory that everyone knows your chat bubble is a robot.
Mark generated output machine-readably. Article 50(2) requires providers of systems generating synthetic audio, image, video or text to mark the output in a machine-readable format so it is detectable as AI-generated or manipulated. Short sequences of numbers or letters, source code, machine-to-machine output, and closed-loop industrial or product-development output are outside scope. So is output where the AI performs an assistive function for standard editing.
Disclose deepfakes to the person. Deployers must disclose deepfake content on first exposure at the latest, clearly and distinguishably, perceivable without special tools. Critically, a deployer cannot lean on the provider's machine-readable mark to satisfy this. The machine-readable mark and the human-visible disclosure are separate obligations.
Label published AI text on matters of public interest. Article 50(4) catches text that is published, informative to the public, and on a matter of public interest, which the FAQ enumerates broadly: politics, public administration, justice, fundamental rights, public security, public health, environment, consumer safety, and economic, financial, scientific or cultural developments that may be a relevant subject of public debate.
The editorial-control exemption, and why I care about it
Article 50(4) has an exemption that matters to anyone running a content pipeline: published text that has undergone human review or editorial control does not need to be labelled.
The Commission defines both terms with more teeth than I expected. Human review means deliberate examination of the substance by one or more natural persons with relevant knowledge and professional judgement. Editorial control means control exercised in practice by a responsible editorial entity with authority to approve, alter or reject the substance on substantive grounds, including fact-checking and ensuring the trustworthiness of sources. Editorial responsibility means somebody holds ultimate legal responsibility for the publication.
And explicitly: superficial, solely formal or procedural checks do not count. Spell-checking is not editorial control.
This blog runs a pipeline that drafts and fact-checks posts, and then I read them and decide whether they go out. Whether that clears the bar is exactly the sort of question the definition is written to make you answer honestly rather than conveniently, and the honest answer depends on how much of the substance I actually examine on a given day, not on the existence of a review step in a diagram. I find that a reasonable place to draw the line. It also means the exemption is not something you can architect your way into.
Dates, and the one grace period
Article 50 applies from 2 August 2026. There is exactly one grace period and it is narrow: it covers only the Article 50(2) marking and detection obligation, and only for AI systems placed on the market before 2 August 2026. Providers of those systems have until 2 December 2026.
If you shipped a generative feature on 3 August, the marking obligation applied to you on day one.
Content generated before 2 August does not need retroactive labelling, though the Commission encourages it where possible.
Enforcement runs mainly through national market surveillance authorities. The AI Office's role is limited to systems built on general-purpose AI models where the same entity provides both, or where the system is integrated into a very large online platform or search engine designated under the DSA. Fines can reach EUR 15 million or 3% of total worldwide turnover for the preceding financial year, with proportionality taken into account for SMEs and small mid-caps.
Where I could be wrong
The obvious risk in a post like this is false precision. I am reading a Commission FAQ, not case law, and there is no enforcement history for Article 50 because it is three weeks old. How aggressively national authorities pursue a two-person SaaS with an unlabelled chat widget is genuinely unknown, and my instinct is that they will start with large platforms and obvious deepfake harms rather than with your onboarding assistant.
That instinct is not a defence, and it is also the argument against panic. Someone will read this and spend a weekend on a compliance project instead of on their product, which for most small teams is the wrong allocation. The chat disclosure is fifteen minutes. The rest is proportional to what you actually generate.
There is also a live risk that the details shift. The Act has already been amended once by the Digital Omnibus, which pushed the high-risk regime back to December 2027 and August 2028. Article 50 survived that with its August 2026 date intact, but "the deadline moved once" is a reason to check a primary source rather than trust a blog post from August.
What I would actually do this week
If you have a chat interface, add a persistent line of text. Not in the terms of service, not in a tooltip. Something like "You're chatting with an AI assistant" as the first message and visible in the header, present from the first interaction. That is the FAQ's "clear and distinguishable" requirement read literally, and it costs you one commit.
If you generate images, audio, video, or substantial text for users, look at whether your model provider already emits a machine-readable mark. Several do, and if the provider marks it, your obligation as a system provider is much easier to discharge. Check before you build anything.
If you publish AI-drafted text on anything touching public interest topics, decide which side of Article 50(4) you are on and be honest about it. Either you have real editorial control, in which case write down who holds it and what they check, or you do not, in which case label the text and move on. The label is cheap. Pretending is not.
And if you sign nothing else, look at the Code of Practice on Transparency of AI-generated content. It is voluntary, the Commission and the AI Board have assessed it as adequate, and adhering to it is the path to demonstrating compliance with the marking and labelling obligations with legal certainty regardless of where you are established. Deciding not to adhere is allowed, but the FAQ says plainly that you then have to demonstrate compliance by other adequate means and may face more requests for information.
Author
Lukas
@lukcombinator