AI chatbot disclosure under Article 50: a checklist

Since 2 August 2026, a chatbot on a website in the EU must tell visitors they are talking to an AI system, unless that is already obvious. This comes from Article 50 of the EU AI Act, and the Digital Omnibus of July 2026 did not postpone it. The disclosure must be clear, distinguishable and given at the latest at the first interaction, which in practice means in the chat window, before or with the first message.

Below is a checklist a Lithuanian business can work through item by item, with example wording in Lithuanian and English, a table of common situations, and a note on who is responsible when the chatbot comes from a vendor.

What does Article 50 require from a chatbot?

Article 50(1) requires that AI systems which interact directly with people are designed so that those people are informed they are interacting with an AI system, unless this is obvious to a reasonably well-informed, observant and circumspect person. Article 50(5) adds that the information must be clear and distinguishable, given at the latest at the first interaction, and meet accessibility requirements.

A chatbot here means any AI system that holds a conversation with a person: a chat widget, a voice agent on a phone line, a messaging bot or an AI that answers e-mails. A disclosure is the visible statement that the other side of the conversation is an AI.

Three details decide most cases:

• "Obvious" is judged from the visitor's point of view, not the owner's. A bot called "Laura" with a stock photo is designed to look human and is unlikely to meet the test.
• "At the latest at the first interaction" rules out disclosure that only appears after several messages, or only in a privacy policy.
• "Clear and distinguishable" rules out grey microtext that disappears when the chat is resized on a phone.

According to Mayer Brown, the European Commission adopted final guidelines on the Article 50 transparency obligations on 20 July 2026. They are the reference to check for detail beyond the text of the Act.

Is the website owner or the vendor responsible?

The Article 50(1) duty is placed on the provider, the company that develops the AI system and places it on the market or puts it into service under its own name. A business that installs a vendor's chatbot on its own site is a deployer. If you built the chatbot yourself, or had it built and run it under your name, you are the provider.

In practice the split matters less than it seems. The visitor sees one website, and if the widget on it does not disclose, the complaint lands with you. Check the widget yourself, and put the requirement in the contract: the vendor supplies an Article 50-compliant disclosure in Lithuanian and English, and tells you before changing it.

Deployers do carry their own Article 50 duties in three cases: publishing deepfake images, audio or video; publishing AI-generated text on matters of public interest without human editorial review; and using emotion recognition or biometric categorisation on people.

The Article 50 chatbot checklist

Work through each item on a desktop browser and on a phone. Take a dated screenshot of each result, because the screenshot is your evidence that the disclosure was in place.

1. The chat window says it is an AI before or with the first message. Put it in the header ("AI assistant"), in the greeting, or both.
2. The wording is plain. "AI assistant" or "automated assistant", not "virtual concierge" or a first name alone.
3. It is in the visitor's language. If the site is bilingual, the disclosure is bilingual. Lithuanian visitors should read it in Lithuanian.
4. It is visible on a phone without scrolling, expanding a tooltip or opening a menu.
5. It is accessible. Real text, not an image; readable by a screen reader; sufficient contrast against its background.
6. The bot does not pretend to be a person. No human name with a stock photo, no "I'll check with my colleague" when there is no colleague.
7. A person can be reached. A visible way to ask for a human, and a statement of what happens next (a call-back, an e-mail, an operator joining).
8. Hand-overs are announced. When a person joins, the chat says so. When the AI takes over again, the chat says that too.
9. Voice agents disclose at the start of the call, before collecting any information.
10. AI-written e-mails sent without review are marked as written by an AI assistant.
11. Generated images, audio and video are handled. Providers of generative systems need machine-readable marking; systems already on the market before 2 August 2026 have until 2 December 2026. Deepfakes you publish must be disclosed.
12. The privacy notice is updated separately. Article 50 is not a substitute for GDPR information about what the chat stores and for how long.
13. The vendor contract covers it, including notice before the wording or the widget changes.

Example wording and common situations

Good disclosure is short and says three things: this is an AI, what it answers from, and how to reach a person. Put it where the visitor looks first, which is the header and the first message. The examples below are starting points; adjust them to your business and your tone.

Lithuanian greeting: „Sveiki! Esu DI asistentas ir atsakau pagal šios svetainės informaciją. Jei norite kalbėti su žmogumi, spauskite „Susisiekti su žmogumi“.“

English greeting: "Hello! I'm an AI assistant and I answer from the information on this website. To talk to a person, press 'Talk to a human'."

As one example of the hand-over pattern, our own product Keliox, a multilingual chat for small businesses, keeps a "Talk to a human" button under the message box at all times. When an operator joins, the chat states that the visitor is now talking to a human operator; when the operator hands the chat back, it says so. The owner can review every conversation, and every admin action is recorded in a hash-chained audit log.

What are the penalties?

Breaches of Article 50 fall under the AI Act's tier for other obligations: fines up to €15 million or 3% of total worldwide annual turnover for the preceding year, whichever is higher. For SMEs, including start-ups, the cap is whichever of the two is lower. In Lithuania the market surveillance authority is the Communications Regulatory Authority (RRT).

Our view: for a small business, the fine is the less likely cost. The more likely one is a customer who feels misled on finding that "Laura" was never there. A clear disclosure is a line of text, and it sets honest expectations from the first message.

For the full timeline of which AI Act rules apply now and which moved to 2027 and 2028, see our article on EU AI Act dates after the Digital Omnibus.

Get your chatbot checked or built

We build customer chat that answers from your own content and hands over to a person, with the AI disclosure designed in; see customer chat and lead capture and AI governance and security. To have an existing chatbot reviewed against this checklist, a code review and security audit starts at €1,500. To talk it through, book a free 30-minute call.