On 2 August 2026 (Regulation (EU) 2024/1689), the transparency obligations under Article 50 of the EU AI Act become applicable. For any company running a chat widget, an AI assistant, an AI-powered search or AI-generated content on its website, this means visitors must be able to tell that they are interacting with an AI system or looking at machine-generated content. It sounds like a heavyweight legal topic, but for the typical small or mid-sized company website it is a manageable, clearly dated piece of work: a clean notice in the first message, a label on the widget, an updated privacy notice and an honest inventory of which AI building blocks are actually in use. This article explains which website elements are covered, what the much-quoted exception „obvious from the circumstances“ really covers, how a notice looks technically and visually, how it interacts with the privacy notice and the consent banner, and what the distinction between provider and deployer means for your own duties. No scaremongering, but with an eye on the date.
What Applies From 2 August 2026
The EU AI Act, formally Regulation (EU) 2024/1689, entered into force on 1 August 2024 (Regulation (EU) 2024/1689) and becomes applicable in stages. The bans on particularly risky AI practices already apply, as do the rules for general-purpose AI models. The next milestone with a direct effect on entirely ordinary company websites is 2 August 2026 (Regulation (EU) 2024/1689): from that day, the transparency obligations in Article 50 apply. While the timetable for high-risk applications has been pushed back as part of the Digital Omnibus package, Article 50 keeps its original date (European Commission). Anyone waiting for a postponement is planning against the law as it currently stands.
Article 50 is not high-risk regulation and requires neither certification nor a conformity assessment procedure. Its core is simpler: people should not be deceived about whether they are talking to a machine or looking at machine-generated content. The provision covers four groups of cases. First, AI systems intended to interact directly with natural persons, meaning chatbots and voice assistants. Second, systems that generate synthetic audio, image, video or text content; their outputs must be marked in a machine-readable format and detectable as artificially generated. Third, emotion recognition and biometric categorisation. Fourth, deepfakes and AI-generated text published to inform the public on matters of public interest. For the typical company website, the first and second groups matter most, the fourth only in special cases.
The Key Facts at a Glance
Alongside the text itself, the European Commission has published two documents that make it workable. On 8 May 2026 (European Commission) the draft guidelines on implementing the transparency obligations appeared, with a consultation running until 3 June 2026 (European Commission); the final version is announced for the period before the date of application. On 10 June 2026 (European Commission) the Code of Practice on Transparency of AI-Generated Content followed. The code is voluntary and aimed primarily at providers of generative systems and at deployers who publish deepfakes or AI text. For a company with a chat widget on its website it is not required reading, but it is a useful benchmark for what counts as a clean implementation.
Which Website Elements Are Covered
The first honest question is not what the law demands but what on your own website is actually AI. That is less trivial than it sounds, because AI today often sits inside bought-in building blocks without being called that in the offer. 41 percent (Bitkom) of companies with 20 or more employees use AI, a year earlier it was 17 percent (Bitkom); the survey is based on interviews with 604 (Bitkom) companies. The jump shows how quickly AI components have moved into websites, shops and service channels, usually without anyone keeping a list.
Chat Widget and Website Assistant
The classic case under Article 50(1): a widget that answers questions freely is an AI system for direct interaction. The notice belongs on the element and in the first message.
Voicebot and Phone Assistant
The duty applies on the phone and via voice input too. Because no label is visible there, the notice has to come audibly at the start of the conversation, not at the end.
AI-Powered Search and Recommendations
A search that formulates answers instead of listing hits produces synthetic text. Plain sorting, filters or a full-text search without generated output are not covered.
AI-Generated Text
Blog posts, product copy or FAQs from a generator are synthetic content. The deployer disclosure duty, however, only bites for text on matters of public interest.
AI-Generated Images and Video
Generated or altered media must be marked machine-readably by the provider. Anyone recreating real people or events deceptively also has a deepfake disclosure duty.
Form and Booking Assistants
Assistants that pre-qualify enquiries or negotiate appointments interact directly with users. A contact form with fixed rule logic, by contrast, is not an AI system under the Regulation.
Not every automation is AI within the meaning of the Regulation. A form with fixed if-then rules, a classic search or a cookie banner stay outside it. Conversely, it does not help to call a widget a friendly assistant and hope nobody asks. If you want to keep the allocation clean, write a short list: element, system used, your own role, where the notice lives. From our project work (Projekterfahrung) this list is exactly the part that saves time later, because every follow-up question can be answered immediately. The opposite direction, by the way, is a different topic altogether: how AI systems use your content for their own answers is covered in our article on visibility in AI answers and AI Overviews. Here it is about duties for the AI running on your own site.
Provider or Deployer: Who Carries Which Duty
The Regulation distinguishes two roles, and what you have to do depends on it. A provider develops an AI system, or has it developed, and places it on the market under its own name or trademark. A deployer uses an AI system under its own authority. A trades business that embeds a ready-made chat widget is a deployer to begin with. The duty under Article 50(1) to build the interaction notice into the system formally lies with the provider. That relieves the deployer less than many hope: whoever embeds a widget on their site is responsible for what visitors experience there and should check whether the notice actually appears in live operation.
| Situation | Your role | What follows from it |
|---|---|---|
| Ready-made chat widget embedded, third-party brand stays visible | Deployer | Check whether the provider builds in the notice, and do not hide it in your own layout |
| Assistant under your own brand, technology bought in | Often provider as well | The interaction notice becomes your own duty, including wording and design |
| Own development on top of a language model | Provider | Notice under paragraph 1 and, for generated content, marking under paragraph 2 |
| Published AI text on matters of public interest | Deployer | Disclosure under paragraph 4, unless the text was reviewed with editorial responsibility |
| Deepfake image or video in marketing | Deployer | Disclosure that the content was artificially generated or manipulated |
The Role Follows From the Circumstances, Not From the Contract Alone
„Obvious From the Circumstances“: Where the Exception Holds
The most discussed passage in Article 50 is the exception from the notice. In its actual wording it is considerably narrower than summaries often suggest, and it does not turn on what the operator thinks but on how users perceive the situation.
Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use.
The benchmark is what matters: not what the operator considers obvious, but what a reasonably well-informed, observant and circumspect person recognises in the circumstances of the specific use. The Commission's draft guidelines suggest a two-step assessment for this (European Commission): first determine the actual target audience, then ask how an average member of that group perceives the situation. A test chat that feels obvious to developers says little about an audience with no AI experience. At the same time, the draft warns against leaning on the exception too readily and names examples of insufficient practice: tiny notices in the footer, faint labels and overlays that disappear after seconds (European Commission).
- The widget appears with a first name and a portrait photo and reads like a person
- The assistant writes in the first person and promises to take care of things personally
- The notice exists only in the privacy notice or the imprint
- The notice appears only after the user has already written several messages
- The label is so small or low in contrast that it disappears into the layout
- The audience is not tech-savvy, for example with offers aimed at older people
- The channel allows no visual perception, for example on the phone or via voice output
The Exception Is an Exception, Not the Default
What a Notice Looks Like Technically and Visually
A workable notice meets three conditions: it arrives early enough, it is perceivable, and it also reaches people who cannot see a screen. Article 50(5) requires the information at the latest at the time of the first interaction and explicitly demands that it conform to the applicable accessibility requirements (Regulation (EU) 2024/1689). The AI Act therefore lands squarely on a topic many companies have been working on since the German Accessibility Act. Anyone who has already implemented the duties under the Accessibility Act has little extra work here; anyone who has not can handle both in one go.
In practice a combination of three building blocks works well: a permanently visible label on the widget, a first message in the chat that makes clear in one sentence what you are dealing with, and a marking in the markup that screen readers read out. The notice does not have to sound like a legal warning. A sentence such as „You are chatting with an AI assistant. For a personal conversation, give us a call.“ meets the duty and works as a service offer at the same time.
<!-- Chat widget: labelling on the element and in the first message -->
<div class="chat" role="dialog" aria-label="AI assistant, not a human chat">
<header class="chat__head">
<span class="chat__title">Website assistant</span>
<span class="chat__badge">AI assistant</span>
</header>
<ol class="chat__log" aria-live="polite">
<li class="msg msg--bot">
Note: you are chatting with an AI assistant, not with a human.
Answers may contain mistakes. For a personal conversation,
call us on +49 5123 9579000.
</li>
</ol>
<form class="chat__form">
<label for="chat-input">Message to the AI assistant</label>
<input id="chat-input" name="message" type="text" autocomplete="off">
<button type="submit">Send</button>
</form>
</div>- The notice appears before or with the first message, not later
- It clearly names an AI system, not just a friendly assistant
- It is visually recognisable, high in contrast and visible without a time limit
- It is marked up, for example via an aria-label on the dialog
- It names a human route as an alternative, such as phone or form
- It stays recognisable even when the chat runs over many messages
- It exists in every language version of the website and is worded equivalently
For screen reader output, a label on the chat window is usually enough. What matters is that it carries the AI property and does not just say chat. If you want to go deeper, our article on WCAG 2.2 in practice covers the basics of roles, labels and focus; the matching service page for the implementation is accessible websites. And because the notice is ultimately text, the same rules apply to it as to all website copy that sells: short, concrete, free of filler.
Interplay With Data Protection and the Consent Banner
Article 50 is protection against deception, not data protection. The GDPR applies unchanged alongside it and raises its own questions: on what legal basis are chat histories processed, how long are they stored, who is the processor, is there a transfer to a third country? An AI notice answers none of that. Conversely, a paragraph in the privacy notice does not replace the notice in the chat. The two belong together but serve different purposes: the privacy notice needs its own section on the assistant, while the notice stays where the interaction happens. Our GDPR website checklist walks through the data protection side step by step.
With the consent banner, the most common confusion is treating the AI notice as consent. It is not. Nobody consents to being informed, and the duty exists regardless of whether anyone agrees. What is relevant in practice is the other direction: if the widget sets cookies or stores information in the browser that is not strictly necessary for the service the user asked for, that access needs consent under the German telecommunications and digital services data protection law. In that case the widget loads only after agreement, and the AI notice appears with the first chat window. How to build a banner cleanly without blocking the rest of the page is described in our article on the cookie banner that combines privacy and usability.
Three Places, Three Texts, No Contradictions
Sanctions, Supervision and What Realistically Happens
The sanction framework sits in Article 99. For breaches of the transparency obligations the Regulation provides for fines of up to 15 million euros (Regulation (EU) 2024/1689, Article 99) or up to 3 percent (Regulation (EU) 2024/1689, Article 99) of worldwide annual turnover, whichever is higher. That number makes headlines and unsettles small businesses unnecessarily, because for small and medium-sized enterprises and start-ups the lower of the two amounts applies (Regulation (EU) 2024/1689, Article 99). With an annual turnover of 2 million euros the arithmetic ceiling is therefore 60,000 euros (Regulation (EU) 2024/1689, Article 99), not 15 million. On top of that, fines have to be proportionate, and authorities take the nature, gravity and duration of a breach into account.
In Germany, supervision now has an address. The act implementing the AI Regulation, the AI market surveillance and innovation promotion act, passed the Bundestag on 11 June 2026 (Deutscher Bundestag) and the Bundesrat in early July 2026. The Bundesnetzagentur thereby becomes the central market surveillance and notifying authority, sets up a coordination and competence centre for the AI Regulation and runs an AI service desk explicitly intended as a low-threshold contact point for smaller companies and start-ups (Bundesnetzagentur). For an SME that means there is a place to ask before guessing.
What Realistically Happens and What Does Not
The Implementation Checklist for Your Website
A notice does not cost you enquiries. On the contrary: chatbot customer service convinces around 50 percent (Bitkom) of the users who have tried it, while 86 percent (Bitkom) are satisfied with a human contact. Labelling the bot as a bot and keeping the route to a human open therefore loses nothing and manages expectations. That is exactly why it pays to treat the implementation as a small project rather than a line of text somebody inserts shortly before the deadline.
1. Take Inventory
List every element that formulates answers, generates content or pre-qualifies enquiries: chat widget, search, assistants, text generators in the editorial process. This includes components that arrived on the page through plug-ins or embedded scripts.
- Every AI element on the website is recorded and named
- For each element, your own role as provider or deployer is clear
- The interaction notice appears at the latest with the first message
- The label on the widget is visible, high in contrast and permanent
- Screen readers convey the AI property, not just the word chat
- The privacy notice contains its own section on the assistant
- All language versions are maintained equally
- The implementation is documented and has a fixed review date
The effort is manageable when it is planned and annoying when it surfaces on 1 August 2026. If your website is looked after anyway, add the points to the running routine: with every release, check that the notices are still in place. Why that routine is more than cosmetics is described in our article on regular website maintenance; how we organise it is set out on the page for ongoing website care. Date-bound mandatory information is not a one-off, by the way: for retailers we have compiled the mandatory product information under GPSR and ProdSG, and anyone hiring at the same time will find pointers in our article on the careers page that attracts applicants. That clarity helps rather than hurts the enquiry is shown by the levers in conversion optimisation for more enquiries. An overview of our services and the technical basis in web design can also be found on this website.
Sources and Studies