EU AI Act Article 50, for chatbots and voice agents.

What Article 50 is

The EU AI Act (Regulation (EU) 2024/1689) sorts AI by risk. Most attention goes to banned uses and to high-risk AI such as hiring and credit scoring. But the duties most likely to affect a company running a chatbot, voice agent or content generator sit in one article: Article 50, on transparency. They apply from 2 August 2026. The 2026 Digital Omnibus, which pushed back the high-risk rules, kept that date, adding only a short grace period for marking content.

Article 50 splits the work between two roles. The provider develops an AI system, or has it developed, and offers it under its own name; a company that builds a chatbot on top of someone else’s model is usually the provider of that chatbot. The deployer uses an AI system in its own work. One company is often both.

Does it reach an Indian company?

It can, in two common situations. If you offer an AI system in the EU, such as a chatbot product sold to European customers, you are a provider placing it on the EU market, wherever your company is based. And under Article 2, the Act also reaches providers and deployers outside the EU when the output of their AI system is used in the EU, such as chatbot answers your platform gives to an EU client’s customers. If neither applies, you are probably out of scope, though European clients may still ask you to meet these rules by contract. Our EU AI Act guide covers scope, risk tiers and dates in full.

The four duties, in plain words

1. Say it is an AI (Article 50(1))

Providers must design AI systems that interact directly with people so that those people are told they are dealing with an AI, unless that is obvious to a reasonably well-informed, observant person in the circumstances. Relying on “obvious” is risky: a chatbot with a human name and a friendly photo is not obviously an AI. A clear line at the start, such as “You’re chatting with our AI assistant”, removes the doubt.

2. Mark generated content (Article 50(2))

Providers of AI systems that generate synthetic audio, images, video or text must make sure the output is marked in a machine-readable format and can be detected as AI-generated or manipulated. The marking must be effective, interoperable, robust and reliable, as far as technically feasible for each type of content. Watermarks, metadata and provenance records are the usual tools. Assistive features that only edit what the user provided, without substantially changing it, are exempt. Systems placed on the market before 2 August 2026 have until 2 December 2026; newer systems must comply already.

3. Tell people about emotion recognition (Article 50(3))

Deployers of emotion recognition or biometric categorisation systems must tell the people exposed to them, and handle the personal data under the GDPR. Emotion recognition is also on the high-risk list, and using it on employees or students is banned outright, with narrow medical and safety exceptions. That matters for call-centre voice analytics that claims to read moods: reading your own agents’ emotions is banned, while reading customers’ needs a notice and brings high-risk duties from December 2027.

4. Disclose deepfakes and AI-written news (Article 50(4))

Deployers that use AI to generate or manipulate image, audio or video content that is a deepfake must disclose that it is artificial. For evidently artistic, creative, satirical or fictional work, the disclosure can be made in a way that does not spoil the work. Deployers that publish AI-generated or manipulated text to inform the public on matters of public interest must disclose that too, unless a person has reviewed it and someone holds editorial responsibility.

All of this must be given clearly, at the latest at the first interaction or exposure, and must meet accessibility requirements (Article 50(5)).

The disclosure has to survive a jailbreak

This is the part most teams miss. A chatbot that says “I’m an AI assistant” in its welcome message can still be talked out of it. Users ask “are you a real person?”, or set up a role-play in which the bot plays a human agent, and many bots play along. A voice agent can be prompted to adopt a human name and deny being an AI. A content tool can be steered into producing output that slips past its own marking.

The duty sits with the provider, so it pays to test that your disclosures hold up under pressure, the same way you test that your bot does not leak data. An LLM red teaming or voice agent red teaming engagement can include checks such as:

• Does the bot ever claim to be human, under direct questions, role-play or long conversations?
• Does the disclosure appear in every channel and language you support, including WhatsApp and phone calls?
• Does generated content keep its marking through your own pipeline, such as resizing, compression and transcoding?
• Can a user make the system produce a realistic fake of a real person, and is it labelled when that happens?

Fines, and the rules next door

Breaking the Article 50 duties can bring fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher; for small and medium-sized companies, including start-ups, whichever is lower. Article 50 also sits alongside other rules: a chatbot used in hiring, credit or insurance pricing can be high-risk, with much heavier duties from 2 December 2027, and any personal data it handles falls under the GDPR as well.

A checklist for chatbots and voice agents

1. Check whether your AI is offered in the EU, or its output is used there.
2. For each AI system, decide whether you are the provider, the deployer or both.
3. Add a clear AI disclosure at the first interaction, in every channel and language.
4. Make sure the bot never claims to be human, and test that under pressure.
5. Mark generated audio, images, video and text in a machine-readable way, and check the marks survive your pipeline.
6. If you use emotion recognition, tell people, and make sure it is never used on staff or students.
7. Label deepfakes, and AI-written public-interest text you publish.
8. Check whether any use is high-risk, such as hiring or credit decisions.
9. Keep records of what you disclosed, where, and since when.