Got a chatbot on your site? From August it has to say it is a machine

From 2 August 2026 the transparency obligations of Article 50 of Regulation (EU) 2024/1689 — the AI Act — apply. The part that catches companies out is that they do not only cover those who build artificial intelligence systems: they cover those who merely use them.

What it says, in four lines

• A system that converses with a person must declare that it is automated, clearly, at the first exchange at the latest — unless it is already obvious from context.
• Content produced by a generative system must be marked in a machine-readable format.
• Anyone publishing a deepfake must declare that the content is generated or manipulated.
• Anyone using emotion recognition or biometric categorisation systems must inform the people affected.

The two dates that matter

If the system was switched on after 2 August 2026, the obligation applies immediately. If it was already running before, there is until 2 December 2026 to bring it into line.

The obligations on high-risk systems — the Annex III ones, such as recruitment screening or credit scoring — arrive later: 2 December 2027.

And in Italy?

There is also Law 132 of 23 September 2025, which requires businesses and professionals to declare their use of artificial intelligence tools in the services they provide, and employers to inform staff when AI enters personnel management. AgID and ACN supervise.

What to do, in practice

Take an inventory of what is switched on

Not only what you bought. The commonest surprise is what somebody enabled inside a tool you already had: automatic replies in the ticket system, description generators in the shop, automatic summaries in the inbox.

Write the sentence, and decide where it appears

“You are chatting with an automated assistant.” At the first message, not the third, and not at the bottom of the terms page. Phrased well it costs one line and puts nobody off: what puts people off far more is finding out afterwards.

Mark what you generate

This is the most technical part, and the one that never gets done unless someone sets it up once. The metadata goes inside the files, and it has to survive the file being re-uploaded somewhere else.

Put it all in a document

Who is answerable for what, which systems exist, what was decided. It is for you more than for an inspection: in six months nobody will remember why that choice was made.

The penalties

Breaching the transparency obligations reaches 15 million euro or 3% of worldwide annual turnover, whichever is higher, with reduced caps for small and medium enterprises.

That said: the fine is the small risk. The big one is a customer working out for themselves that they were talking to a machine while believing they were talking to a person.

This article is not legal advice: it sets out the rules with their dates. The concrete position changes considerably depending on whether you are a provider or a deployer of a system, and that distinction turns on the specific case.