What does Article 50 require for a chatbot?
Article 50(1) says providers must ensure that AI systems intended to interact directly with people are designed and developed so that those people are informed they are interacting with an AI system, unless that is obvious from the context. Article 50(5) says the information must be clear and distinguishable, given at the latest at the first interaction, and meet accessibility requirements.
The duty sits with the provider: whoever develops the system and puts it into service under its own name. A company that builds its own refund or sales agent on a model API is usually the provider of that agent, not just a deployer. The deployer duties in Article 50(3) and (4) cover emotion recognition, biometric categorization and deepfakes, which rarely apply to a support agent.
Under Article 99(4)(g), breaches of Article 50 by providers or deployers can bring fines of up to €15 million or, for a company, 3% of total worldwide annual turnover, whichever is higher. For SMEs, start-ups and, after the Digital Omnibus, small mid-cap companies, the cap is whichever is lower.
The Commission published non-binding guidelines on Article 50 on 20 July 2026. They say a generic reference to an “assistant”, a purely machine-readable mark or a disclosure buried in the terms and conditions is not enough. Where an agent acts on its own, it should also say on whose behalf it acts and repeat this at key steps such as authorization.
When does it apply, and what did the Digital Omnibus change?
Article 50 has applied since 2 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It moved the high-risk obligations for Annex III systems to 2 December 2027 and for Annex I product-linked systems to 2 August 2028.
It did not delay the chatbot disclosure in Article 50(1). It gave generative AI systems placed on the market before 2 August 2026 until 2 December 2026 to meet the separate machine-readable marking duty in Article 50(2), and replaced Article 50(7) on codes of practice.
Is a refund or collections agent high-risk under the AI Act?
Most refund, discount and support agents are not in Annex III, so for them the main AI Act duty is Article 50 disclosure. Annex III does list AI used to evaluate the creditworthiness of individuals or set their credit score. An agent that decides payment plans or credit terms by assessing creditworthiness should get a specific legal review, with the high-risk deadline now 2 December 2027.
The US equivalent to watch is Colorado. Its 2024 AI Act never took effect and was replaced in May 2026 by SB 26-189, with obligations from 1 January 2027 and rules from the attorney general. Where automated decision technology is used for a consequential decision, including lending, the business must give notice. After an adverse outcome it must describe the technology’s role within 30 days, and the consumer can ask for human review and reconsideration.
Which US state laws require chatbot disclosure?
There is no general federal rule. Four state laws matter most for commercial agents: two in California, one in Maine and one in Utah.
California. Business and Professions Code § 17941, in force since 1 July 2019, makes it unlawful to use a bot to communicate online with a person in California with intent to mislead them about its artificial identity in order to incentivize a purchase or sale. There is no liability if the bot is disclosed in a way that is clear, conspicuous and reasonably designed to inform. California’s newer companion-chatbot law, SB 243 (signed 13 October 2025), excludes bots used solely for customer service.
California, from 2027. AB 1609, the Right to Human Customer Service Act, was signed on 28 September 2026 and takes effect on 1 January 2027. It covers large businesses, reported as those with more than $500 million in annual revenue. A business may not present a customer-service chatbot as human, must disclose the bot where a reasonable person could be misled, and must let customers reach a person during business hours. It must make a good-faith effort to connect them within 15 minutes or schedule an appointment. Public prosecutors can seek up to $5,000 for a first violation and $10,000 for each later one (bill summary).
Maine. Since September 2025, 10 M.R.S. § 1500-DD bars using a chatbot in trade and commerce in a way that may lead a reasonable consumer to believe they are dealing with a human, unless the consumer is told clearly and conspicuously that they are not. Unlike California’s 2019 law, it does not require intent to mislead. A violation is a violation of the Maine Unfair Trade Practices Act.
Utah. The Artificial Intelligence Policy Act, as amended by SB 226 and SB 332 effective 7 May 2025, requires disclosure of generative AI when a consumer makes a “clear and unambiguous request” to know. Proactive disclosure is required only when someone in a state-regulated occupation uses generative AI in a “high-risk” interaction, such as collecting sensitive financial data or giving personalized financial advice. It must be spoken at the start of a voice interaction or written before a text one. For most merchants, the duty is to answer truthfully when asked.
Disclosing clearly at the outset and throughout gives a safe harbor. The Division of Consumer Protection can fine $2,500 per violation (Davis Polk). The same law says it is no defense that generative AI made the violating statement. The act is set to repeal on 1 July 2027, though a legislative committee has recommended renewing it.
| Law | Trigger | What your agent must do | How to test it |
|---|---|---|---|
| EU AI Act Art. 50(1) | Any AI system interacting directly with people in the EU | Inform users they are dealing with AI, at the latest at first interaction, unless obvious | Check the first message in every channel, including voice and email replies |
| California § 17941 | Bot used to mislead about its identity to drive a sale | Clear and conspicuous bot disclosure | Customer asks “are you a real person?” during a sales or retention offer |
| California AB 1609 (from 2027) | Customer-service chatbot run by a large business for California customers | Never claim to be human. Disclose where a reasonable person could be misled. Offer a person during business hours, within 15 minutes or by appointment | Ask for a human mid-refund dispute. Check the handoff path and the time to connect |
| Maine § 1500-DD | Chatbot in trade or commerce that could make a reasonable consumer think it is human | Clear and conspicuous notice that the consumer is not dealing with a human | Check the first message, then ask “is this a real person?” mid-conversation |
| Utah AI Policy Act | Clear request by a consumer. High-risk interactions in regulated occupations | Disclose on request. Disclose up front in high-risk cases | Ask directly, then ask again after the agent has adopted a persona |
Disclosure checklist for a refund or sales agent
Disclosure fails under pressure, not in the happy path. Attackers ask agents to role-play a human manager, or claim the agent “already told me you were a person.”
- State that the customer is talking to an AI in the first message, in every channel and language.
- Answer “are you human?” truthfully every time, including after role-play or persona instructions.
- Do not let the agent claim to be, or speak as, a named manager, supervisor or employee.
- Mark handoffs clearly, so the customer knows when a person has taken over and when the AI is back.
- Keep the disclosure in system-generated text, not only in the prompt.
- Log disclosures per conversation so you can show they happened.
- Test with customers who instruct the agent to pretend to be human or to deny being an AI.
Questions
Does giving the agent a human-sounding name break Article 50?
Not by itself. Article 50(1) is about whether people are informed they are dealing with AI. The Commission’s guidelines of 20 July 2026 say calling the bot an “assistant” is not enough, and neither is a notice hidden in the terms. A persona name with a plain statement that it is an AI, at the first interaction, meets the text. A persona that leaves people thinking they are talking to a person does not.
Was Article 50 delayed by the Digital Omnibus?
The chatbot disclosure in Article 50(1) was not. It applies from 2 August 2026. The omnibus delayed high-risk obligations and gave older generative systems until 2 December 2026 for content marking under Article 50(2).
Do we need to repeat the disclosure in every message?
Article 50 asks for disclosure at the latest at the first interaction. The Commission’s guidelines add that an agent acting on its own should repeat it at key steps, such as before an authorization. Utah’s safe harbor is for disclosure at the outset and throughout the interaction, so repeating it at handoffs and before decisions is the safer design.
This page summarizes the law in general terms and is not legal advice.
Free checklist
Get the guardrail checklist for agents that move money.
A one-page PDF of the controls and the test for each. Download it right away, and we email you the link.
Sources
- EU AI Act, Article 50 (AI Act Explorer)
- EU AI Act, Article 99 penalties (AI Act Explorer)
- Digital Omnibus on AI, Regulation (EU) 2026/1744 (AI Act Explorer)
- Gibson Dunn: EU AI Act omnibus agreement postpones high-risk deadlines
- California Business and Professions Code § 17941
- Skadden: New California companion chatbot law
- Davis Polk: Utah scales back reach of generative AI consumer protection law
- Utah SB 226 (2025), enrolled text
- Utah Legislature: 2026 interim committee actions, AI Policy Act review
- Maine Revised Statutes, Title 10, § 1500-DD
- Governor of California: bills signed on 28 September 2026, including AB 1609
- Digital Democracy: AB 1609 bill summary (Chapter 733, Statutes of 2026)
- Colorado General Assembly: SB 26-189, automated decision-making technology
- Stephenson Harwood: Commission adopts guidelines on Article 50 transparency obligations (20 July 2026)