Chatbot Labeling under Art. 50: 5 Practical Implementations

Obligation and recommendation: In this article, what is stated with a legal reference is an obligation — the content of the notice under Art. 50(1) as well as the timing and presentation under Art. 50(5). Which carrier fulfils these requirements in the respective channel is this article's own inference; everything else is marked as a practice recommendation.

Main article: Transparency Art. 50 EU AI Act — that article covers the paragraphs not examined in depth here: the carrier formats of machine-readable watermarking under paragraph 2 and deepfake labeling under paragraph 4.

Sources reviewed as of: The legal statements in this article are based on a source review of 2 May 2026, supplemented by the legal status as at 17 August 2026: the Digital Omnibus for the AI Act is in force as Regulation (EU) 2026/1744 since 27 July 2026; the date of application of Art. 50 continues to follow directly and unchanged from Art. 113 AI Act.

Who has to label — and when

Under Art. 50(1) AI Act, it is the provider who owes the labeling of a chatbot: it must ensure that an AI system intended to interact directly with natural persons informs those persons that they are interacting with an AI system — under Art. 50(5), that information is due at the latest at the time of the first interaction. Art. 50 distributes four transparency obligations across two roles — and that determines who within the company is responsible for the notice.

Under Art. 3 no. 3, a provider is whoever develops an AI system or places it on the market; under Art. 3 no. 4, a deployer is whoever uses it under its own authority. The role is not fixed: under Art. 25, a deployer moves into the provider role if it substantially modifies the purpose or functionality or places the system on the market under its own name; a white-label branded wrapper that you market under your own name falls under the second variant. Clarify this question for each system before you agree on wording — it decides whether you carry the obligation from paragraph 1 yourself or have to demand it from your supplier. If you do not carry it yourself, demanding it means in concrete terms: a check point in procurement as to whether the system issues the information under paragraph 1 on its own; a corresponding assurance in the contractual documentation for the system; acceptance testing of the first bot message before go-live; documented escalation to the provider if the notice is missing. These four steps are practice recommendations of this article.

What the notice must say as a minimum: In substance, paragraph 1 prescribes one piece of information — that the person is interacting with an AI system. Naming the counterpart as AI or a bot is therefore the core, and a sentence such as "You are talking to an AI" already carries it; everything beyond that (company name, escalation path, scope of functions) is a practice recommendation of this article. That is why the five example texts below differ in their wording — "AI assistant", "AI-based assistant", "AI bot", "AI-generated" — but all contain this core. Practice recommendation: wordings that merely hint at the AI reference ("digital assistant", "automated service", "virtual advisor") do not carry it visibly; before sign-off, check every greeting text for whether the AI reference is present in the text itself.

When and how the information has to be given is governed by Art. 50(5) AI Act: the information referred to in paragraphs 1 to 4 is provided to the natural persons concerned at the latest at the time of the first interaction or exposure, in a clear and distinguishable manner, and must conform to the applicable accessibility requirements. This fixes the timing, and the presentation is not left open: a notice that only hints at the AI reference or conveys it only graphically does not meet the requirement of being "clear and distinguishable".

The five implementations at a glance

The five channels do not differ in the obligation, but in the carrier of the notice and in the trap that the channel sets. The trigger is the same everywhere: the first interaction (Art. 50(5)).

Review of existing systems (practice recommendation): If the bot is already live, review it in four steps regardless of channel: (1) open the channel and secure the first bot output as a screenshot or recording; (2) check whether the AI reference is present in that first output — not only after a follow-up question, not only in the profile, not only in the privacy notice; (3) reconcile the system's role (provider or deployer) in the AI inventory against the contractual position; (4) record the result with a date and the unit granting sign-off.

1. Web chat (live chat widget)

In web chat, in practice only the bot's first message in the visible UI meets the requirement of Art. 50(5) to provide the information at the latest at the time of the first interaction, clearly and distinguishably — a tooltip and the privacy notice do not reach the user at that point in time.

First bot message: "Hi! I am the AI assistant of [company]. I answer your questions — if I cannot help, I will hand you over to a member of staff."

The sentence achieves two things: the information under Art. 50(1) and a visible path to a human — the latter is, like the additionally recommended permanent label in the widget header that keeps the notice in view even after extensive scrolling, a practice recommendation of this article. Because Art. 50(5) additionally requires the information to be provided in a clear and distinguishable manner and in accordance with the applicable accessibility requirements, the AI reference belongs in the message and in the label as text that can be read out: a chip that conveys it solely through an icon, colour or graphic is not read out by a screen reader. Readable text is the minimum condition from this article's point of view; which accessibility regime applies in detail to the respective service is not covered by this article.

Data protection side note (Germany): If the widget stores information in the terminal equipment or accesses information already stored there, this is permitted under § 25(1) TDDDG only with prior, informed consent on the basis of clear and comprehensive information. Without consent it is possible only where the sole purpose is the transmission of a message, or where the access is strictly necessary in order to provide the digital service expressly requested by the user (§ 25(2) TDDDG). Practice recommendation: record for each widget whether it sets or reads entries in the terminal equipment before the chat is opened. If you base that access on the exception in paragraph 2, document the assessment in writing; otherwise, list the widget in the consent tool as a separate category and load it only after consent. The AI notice itself is unaffected by the outcome of that assessment — § 25 TDDDG governs storage in and access to terminal equipment, not the text of the first bot message. For Austria, the corresponding national rule on access to terminal equipment is not covered in this article — review it separately before transferring this approach to an Austrian operation.

2. Voice bot (telephone IVR)

With a telephone bot, the spoken greeting carries the information — the channel has no visible UI into which it could be shifted.

Greeting: "You are speaking with an AI assistant of [company]. Say 'human' at any time to reach an advisor."

Art. 50(1) excludes situations in which the AI interaction is obvious from the context — for example a voice that is recognisably synthetic. This exception is to be applied cautiously; we advise speaking the notice explicitly rather than relying on it.

If the voice bot infers emotions from the voice, a second obligation is added: under Art. 50(3) AI Act, the deployer of emotion recognition or biometric categorisation systems informs the persons concerned. Emotion recognition in the workplace and in education institutions is moreover prohibited under Art. 5(1)(f) AI Act — such an infringement falls within the highest fine bracket of up to EUR 35 million or 7% of the total worldwide annual turnover of the preceding financial year (Art. 99(3)).

3. Discord/Slack bot

In team messengers, the first response block carries the information under paragraph 1; the bot profile can accompany it permanently — the trigger is the first interaction with the bot (paragraph 5), not the one-off installation of the bot.

Bot profile with a ⚡ symbol — the symbol is decoration and does not carry the notice, what counts is the bio text —, bio: "AI-based assistant. Answers are AI-generated." First response block with the prefix "[AI notice]:", spelled out for example as: "[AI notice]: This answer is AI-generated. For a response from a human, please contact the support team."

We recommend the path to a human in this channel too — it then simply points to a responsible team instead of a hand-over within the chat. Because people join an ongoing conversation mid-way in open channels, place the notice prefix, as a practice recommendation, on the first response in each new thread, instead of relying on the profile entry alone.

If the bot evaluates employees — for example in a performance context or with recommendations on promotion and dismissal —, the high-risk classification under Annex III no. 4 AI Act has to be assessed in addition — the obligations attached to it under Chapter III Sections 1 to 3 apply to Annex III systems from 2 December 2027 (Art. 113(3)(c)(i) AI Act as amended by Regulation (EU) 2026/1744). A pure FAQ bot does not fall under this; the delimitation is set out further below.

4. WhatsApp Business AI

In the messenger, the notice belongs in the bot's first outgoing message, before the first substantive answer is sent.

On first contact: "Welcome to [company]. You are chatting with an AI bot. For a human: send 'human'."

The particularity of this channel is the continuous history: if a customer resumes the conversation weeks later, the original notice sits far up in the history and is in practice no longer present. Practice recommendation: label again if more than 24 hours have passed since the last message — with a short bot message before the first substantive answer. The same form carries the refresh in the other channels as well: a short system or bot message before the substantive answer is sent.

If the messaging service provider processes personal data on your behalf, the cooperation must be governed by contract with the statutory minimum content under Art. 28(1) and (3) GDPR; the processing itself requires a legal basis under Art. 6(1) GDPR.

5. In-app chat

In your own app, the notice can be anchored twice — as a permanent UI element and as the first message.

First bubble (recommended version): "You are chatting with the AI assistant of [company]. Type 'support' if you would like to reach a member of staff." Short form that likewise carries the mandatory core: "AI-generated. Escalate to support if needed." In addition, the permanent UI label "AI assistant" with a bot icon.

In the app too, the notice belongs in the bubble and in the label as text that can be read out: Art. 50(5) requires provision that is clear, distinguishable and in accordance with the applicable accessibility requirements, which a purely graphical bot icon does not deliver. For conversations lasting more than 30 minutes we recommend refreshing the notice; the obligation itself attaches to the first interaction. In any case, the sensible trigger is not the clock alone, but the change of context: app restart, new thread, hand-over between bot and human.

The app variant has the sharpest question of role — and it brings a second obligation with it. Whoever places the assistant on the market under their own name, or substantially modifies its purpose or functionality, moves into the provider role under Art. 25. As a result, they carry not only the notice under paragraph 1 themselves, but also Art. 50(2) AI Act: providers generating synthetic audio, image, video or text content must mark the outputs in a machine-readable format as artificially generated or manipulated. That obligation does not apply to the extent that the system performs only an assistive function for standard editing or does not substantially alter the input data provided by the deployer or the semantics thereof. The next step lies with the model provider: clarify whether and in which format it marks the outputs in a machine-readable way, and record the answer in the AI inventory alongside the system concerned — without that information, the obligation under paragraph 2 can neither be fulfilled nor evidenced. Which carrier formats come into consideration for this is covered by the main article.

Delimitation: labeling is not risk classification

The AI notice under Art. 50 neither turns a system into a high-risk system nor exempts it from the high-risk assessment — both are separate layers of the same risk-based approach. Recital 26 of the AI Act expressly distinguishes between prohibited practices (Art. 5), requirements for high-risk AI systems (Art. 6 et seq.) and transparency obligations for certain AI systems (Art. 50); Art. 50(6) additionally clarifies that paragraphs 1 to 4 leave the requirements of Chapter III unaffected.

The exception in Art. 6(3) can only be applied narrowly: as soon as the system generates recommendations or evaluations that are capable of materially influencing human decisions, it remains high-risk. In case of doubt, we recommend the higher classification — the price is compliance effort, whereas the price of classifying too low is a risk of fines under Art. 99(4). The labeling obligation under paragraph 1 applies regardless of the outcome of the classification: a chatbot that is not to be classified as a high-risk system also remains subject to labeling.

Interplay with the GDPR information obligations

The AI notice under Art. 50 does not fulfil any information obligation under the GDPR — and GDPR-compliant processing does not exempt you from the AI notice. Art. 50 knows no exception for "lawful data processing"; on the contrary, paragraph 3 expressly requires processing in accordance with the GDPR for emotion recognition. The two regimes run alongside each other with their own fine brackets: Art. 99(4) AI Act on the one side, up to EUR 20 million or 4% of the total worldwide annual turnover of the preceding financial year under Art. 83(5) GDPR on the other.

Supervision, too, has to be thought of separately: for the GDPR, in Germany the authorities competent under Land law supervise non-public bodies and the Federal Commissioner for Data Protection (BfDI) supervises the public bodies of the Federation, while in Austria it is the Austrian Data Protection Authority (Datenschutzbehörde). For the AI Act, each Member State designates at least one market surveillance authority and, among them, a single point of contact; the designation has to be communicated to the European Commission and made publicly available (Art. 70(1) and (2)). In Germany, the Federal Network Agency (Bundesnetzagentur) has been the market surveillance authority since 29 July 2026 (§ 2(1) of the German AI Market Surveillance and Innovation Promotion Act (KI-MIG)), in so far as sectoral authorities — such as BaFin — are not competent; as at the date of this article (17 August 2026), Austria has not designated a market surveillance authority under Art. 70 AI Act — the AI service point of RTR is an information and advisory body without supervisory powers.

Deadlines and dates of application

Under Art. 113, the AI Act applies in principle from 2 August 2026; Art. 50 is among the obligations that take effect on that date — the chatbot notice has therefore been applicable since 2 August 2026. Regulation (EU) 2026/1744 (Digital Omnibus AI), in force since 27 July 2026, leaves the general date of application of 2 August 2026 unaffected.

Two points are regularly overlooked here. First: under Art. 4 AI Act in the version applicable since 27 July 2026, providers and deployers must take measures to support the development of AI literacy among their staff — a particular level of competence is not owed; in substance, the transparency obligations are part of it: whoever looks after the chatbot should be able to explain why the notice is placed where it is and what it does not achieve. Art. 4 does not prescribe a certificate; internal training records are recommended as evidence of the measures taken (practice recommendation). Second: the AI Act is a directly applicable EU regulation and applies in Germany and Austria with identical wording. Only the competent authorities under Art. 70 and the penalty regime within the framework of Art. 99(1) are governed nationally; a reworking of the legal references for Austria is not necessary for Art. 50. Divergences only arise in the accompanying national law — for example with access to terminal equipment, where § 25 TDDDG is German law.