AI Act: how to label chatbots and AI-generated content

01

Facts: what has applied since 2 August 2026?

Article 50 of Regulation (EU) 2024/1689 establishes transparency obligations for specified AI systems and AI-generated or manipulated content. The rules have applied since 2 August 2026. They cover direct human interaction with AI, technical marking of generative outputs, notice about emotion-recognition and biometric-categorisation systems, and disclosure of deepfakes and certain public-interest text.

The Commission identifies a limited transition until 2 December 2026 only for the machine-readable marking obligation in Article 50(2), where the system was placed on the market before 2 August 2026. It is not a general postponement of every transparency duty.

This article was checked on 5 October 2026. It provides general operational information rather than individual legal advice. The organisation’s role and the appropriate disclosure depend on the system, deployment model, content and audience; borderline cases should be reviewed with a lawyer experienced in technology regulation.

02

Facts: first determine whether the business is a provider or deployer

A provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority in a professional activity. A business using a ready-made third-party tool will commonly be a deployer, but own-brand use, substantial modification or the deployment model can change that assessment.

The roles lead to different tasks. A provider is responsible, among other things, for designing a direct interaction so that the person is informed that they are dealing with AI and for technical marking of generative outputs. A deployer is responsible, among other things, for disclosing deepfakes and specified text published to inform the public on matters of public interest.

An employee acting under the organisation’s instructions is not a separate deployer. Process responsibility remains with the organisation, including where a contractor creates content under its authority and control.

03

Facts: a chatbot should disclose that it is AI at the start

Where a system is designed for genuine, direct two-way interaction with a person — such as a chatbot, AI agent or avatar — the individual should be clearly informed that they are interacting with AI. The information must be provided by the start of the first interaction, be distinguishable and meet applicable accessibility requirements.

An exception applies where the AI nature of the interaction is obvious to a reasonably well-informed, observant person. The Commission Guidelines say this exception should be interpreted restrictively. A short, unambiguous message in the chat window, repeated in an audio channel where the user may not see a screen, is a safer operational approach.

Article 50(1) assigns this design duty to the provider. A business deploying a third-party chatbot should nevertheless check the configuration and contract to confirm that disclosure works across channels, languages and mobile views and does not disappear after an interface update.

04

Facts: provider metadata and a human-facing label are different controls

Providers of systems that generate synthetic text, image, audio or video must ensure that outputs are marked in a machine-readable format and detectable as AI-generated or manipulated, as far as technically feasible. The rule takes account of content type, technology limitations, cost and the state of the art, and includes exceptions such as assistive standard editing that does not substantially alter the input or its semantics.

Machine-readable marking may sit in metadata or another technical layer and is primarily a provider responsibility. It is not the same as information that a person can perceive. The Commission expressly explains that, for a deepfake, a deployer cannot rely only on the provider’s hidden technical mark.

A business using a generator should preserve provenance information, avoid automatically stripping available marks and test what happens after export, compression, editing or publication on a social platform. This is a technical recommendation that supports evidence of control; it does not replace the assessment of whether a visible disclosure is required.

05

Facts: when to label a deepfake and public-interest text

Under the AI Act, a deepfake is AI-generated or manipulated image, audio or video content resembling existing persons, objects, places, entities or events that would falsely appear authentic or truthful. A deployer should disclose that character by the first exposure at the latest, in a visible or audible way. Evidently artistic, creative, satirical, fictional or analogous works have a proportionate disclosure regime that should not hamper enjoyment of the work.

The deployer duty for text is narrower. It concerns AI-generated or manipulated text published for the purpose of informing the public on a matter of public interest — for example an important economic, financial, political, scientific, public-health or environmental development.

A label is not required on this basis where the text has undergone genuine human review or editorial control and a natural or legal person holds editorial responsibility for the publication. Spell-checking, stylistic correction or a formal approval click is not substantive review. The AI Act therefore does not create a single “label every AI-assisted text” rule; purpose, topic, review and responsibility all matter.

06

WEBee recommendation: add a simple decision matrix before publication

The process should not depend on one employee’s memory. Add a short form to the publishing tool or a checklist to the existing approval workflow. The content owner should answer a small number of questions before the material is made available.

The matrix need not automatically determine the legal outcome. Its role is to handle clear cases, retain evidence of review and route ambiguous situations to the person responsible for compliance or communications.

• Does the person interact directly with an AI system?
• Does the material depict an existing person, place, object or event in a way that may appear authentic?
• Is the text intended to inform the public about a matter of public interest?
• Did a competent person review substance, sources and conclusions rather than language alone?
• Who may approve, change or reject the publication, and who holds editorial responsibility?
• Does the file retain technical provenance information after editing and publication?
• Will the label be clear, accessible and visible by the first exposure?

07

WEBee recommendation: document the minimum process and test every channel

Create an inventory of generators, chatbots and agents in use. For each one, record the organisation’s role, business owner, supplier, channels, output types, disclosure settings, treatment of technical marks and approval path. A dedicated platform is not required initially; a controlled register connected to the publishing procedure can be enough.

Then run an end-to-end test: open the chat on a phone and computer, check it with a screen reader, download a sample image or video, perform the usual editing and confirm that the information remains understandable. For text, retain sources, the reviewer’s identity, the scope of changes and the approval date.

The voluntary EU Code of Practice can help signatories demonstrate compliance; it does not replace the AI Act or Commission Guidelines. Whether or not an organisation signs, its distinction between provider-side machine-readable marking and deployer-side human-facing labelling is a useful control map.

• appoint a process owner and deputy;
• approve short PL and EN label templates for each channel;
• record tool version, date, reviewer and review outcome;
• test visibility, audio, accessibility and metadata retention;
• add controls to supplier, agency and contractor agreements;
• review the process after a tool, channel or guidance change.