Does this apply to a small company in Finland or Sweden?

Yes. Article 50 has no size threshold. A five-person firm with a chat widget on its website carries the same duty as a bank. Fines are scaled for small firms, because the lower of the two figures applies to them, but the duty itself is identical. Finland spread supervision across the authorities that already watch each sector, and the national powers took effect on 1 January 2026.

Do I need the visitor to agree before the chatbot answers?

No. Article 50 asks you to inform, not to collect consent. The visitor has to know a machine is answering, at the latest when the first reply appears. There is no tick box and no separate approval step. Consent questions come from GDPR instead, and they attach to the personal data the chat collects rather than to the fact that AI wrote the reply.

Is a sentence in the privacy policy enough on its own?

No. The Act asks for the information in a clear and distinguishable form, at the latest at the first interaction. A privacy page nobody opens does not meet that. Put the line where the conversation happens: in the greeting message and in the header of the chat window. The privacy page is a useful second home for it, never the only one.

What if the chatbot comes from an American vendor?

The Act follows the market, not the head office. If the output reaches people in the EU, the rules bite. A US vendor selling into Europe carries the provider duties, and you carry the duties of the company running the tool. Ask for their Article 50 statement in writing before renewal. If they cannot produce one, that answer tells you plenty about the product.

Does the rule cover chat on WhatsApp or Facebook Messenger?

Yes. The duty attaches to the AI system talking to a person, not to the window it appears in. An AI answering your company WhatsApp needs the same notice as the widget on your website. Put it in the welcome message and in the automated first reply. Channels where you cannot edit the greeting are a reason to change channel, not a way out.

Do I have to keep a log of what the chatbot said?

Article 50 does not ask for chat logs. Keeping them is still sensible, because a complaint is much easier to answer when you can show the exact conversation and the notice the visitor saw. Store only what you need, set a deletion date, and mention the logs in your privacy page. GDPR governs that part, so treat it as a data question.

How long does it take to fix a chat widget for this?

For most sites, under an hour. You edit the greeting message, edit the header text of the chat window, and add a short paragraph to the privacy page. The slow part is the email to your vendor asking how their tool marks AI-generated output, because that answer can take weeks to arrive. Send that email first and do the wording while you wait.

EU AI Act chatbot disclosure from 2 August 2026: what to change on your site

From 2 August 2026 your site chat has to say it is AI. One clear line, shown before the first reply. That is the whole rule.

The rest of this page is the wording, the risk, and the parts most vendors quietly skip.

What do the EU AI Act chatbot disclosure rules 2026 say?

Article 50 of the EU AI Act says people must know when they talk to a machine. The chat has to tell them. The line has to be clear and easy to spot. It has to show up at the first reply at the latest. The duty starts on 2 August 2026.

The text of Article 50(1) asks providers to design systems so that people are informed they are interacting with an AI system. Article 50(5) adds the timing: clear and distinguishable, at the latest at the first interaction, in an accessible form.

Read those two together and you get a short brief. Say it plainly. Say it early. Say it where the visitor is looking.

Does the 2 August 2026 date still hold?

Yes. The Digital Omnibus deal of June 2026 moved the high-risk rules to December 2027 and August 2028. It left Article 50 alone. Chat notices, deepfake labels and content marks all start on 2 August 2026. One narrow piece shifted, and only for tools sold before that date.

This is where a lot of advice went wrong. Headlines said the AI Act was delayed, and plenty of owners filed the whole thing under next year.

What actually moved was the high-risk list. Law firms tracking the deal, including Jones Walker and Gibson Dunn, say the transparency duties stayed put. The official timeline lines up with that.

Date	What applies	Moved by the Omnibus?
2 Feb 2025	Banned uses, staff AI know-how	No
2 Aug 2025	Rules for the big model makers	No
2 Aug 2026	Chat notice, deepfake label, AI content marks	No
2 Dec 2026	Marking duty for tools sold before August	Yes, new grace window
2 Dec 2027	High-risk uses on the Annex III list	Yes, moved from 2026
2 Aug 2028	High-risk uses inside regulated products	Yes, moved from 2026

The grace window is narrow. It covers marking of AI-made content in tools already on the market. It does not cover the chat notice, and it does nothing for a bot you switch on after August.

Who has to do this, you or your chatbot vendor?

Both, in different ways. The vendor builds the notice into the tool. You run the bot on your own site, so you own what your buyer sees. If the tool ships with no notice, that is still your page. Ask your vendor in writing and keep the reply.

Most owners find out their widget has no notice at all. The greeting says "Hi, how can I help?" and nothing else. That was fine in 2024 and it is not fine now.

When we build a chat for a client site, the line goes in the greeting on day one, before anyone argues about tone. It is one sentence. Nobody has ever lost a sale over it. You can see how that fits the rest of the work on our services page.

What do you actually put on the page?

One short line, in the chat window, before the first reply. Plain words beat legal words here. Something like: Hi, I am an AI assistant, and I can get you a human. Put it in the greeting and in the header of the chat box.

Three wordings that hold up:

Hi, I am an AI assistant. Ask me anything, and I can pass you to a person.
You are chatting with an AI. A human takes over any time you ask.
AI assistant. Answers come from our own material, and a person is one click away.

Each one does the job in under 20 words. Each one names the machine. None of them reads like a lawyer wrote it.

Then add two sentences to your privacy page saying the site uses an AI assistant and what it stores. That part overlaps with GDPR work you have probably already done.

When is the AI obvious enough to skip the line?

Rarely. The Act lets you skip the line when the AI is obvious to a well-informed person. A chat bubble on a company site is not obvious. Plenty of buyers still think a person is typing. If you have to argue the point, write the line and move on.

The exemption exists for cases where the whole product is the AI. A tool called AI Assistant, opened by a user who signed up for AI, does not need a banner saying so.

A support widget in the corner of a plumbing company's website is the opposite case. The visitor has no idea. Write the line.

Do you have to label AI text on the rest of the site?

Sometimes. Article 50 asks for a mark on AI-made images, audio, video and text. Text about public matters needs a note, unless a person checked it and takes the blame for it. Product copy that a human edited and signed off sits outside that duty.

The marking part is technical, and it belongs to whoever built the model. Your job is to ask the question and file the answer.

The human-review part is yours. If a person edits the piece and puts their name behind it, the note is not needed. That is a good habit anyway. We wrote about the wider picture in our plain-language guide to the AI Act.

What happens if you skip it?

A fine of up to 15 million euro or 3% of worldwide yearly sales, whichever is higher, per Article 99. That is the band for Article 50 breaches. For a small firm the lower of the two applies. A first case is more likely to start with an order to fix the page.

Finland did not build one new AI regulator. Supervision was spread across the authorities that already watch each sector, and the national powers took effect on 1 January 2026.

Which means the practical risk for a mid-sized Finnish firm is not a headline fine. It is a customer complaint, a letter, and a scramble. Cheap to avoid, annoying to answer.

What should you change on your site?

Five changes. Put an AI line in the chat greeting. Put the same line in the header of the chat box. Add a short note to your privacy page. Get the marking answer from your bot vendor in writing. Give people one clear way to reach a human.

The fifth one is the sleeper. The Act does not demand a human handover. Buyers do, and a bot that traps them is worse for you than any regulator.

Budget an hour for the whole job on a normal site. The vendor email is the slow part, so send it first. If you want someone to run through your setup with you, that is what our website chatbot work covers.

Where does this go wrong in practice?

Two places. Firms bury the notice in a cookie banner or a long policy page, where nobody reads it. And they ask the vendor nothing, then learn the tool has no marking at all. A tiny grey line under the chat box counts as burying it.

There is a bigger reason this drags. Across the EU, 53.6% of firms that looked at AI and walked away blamed unclear legal consequences, ahead of data worries and cost, according to Eurostat. Fear of the law is now the top brake on AI in Europe.

House rules are thin too. Only 15% of Finnish firms have written guidance on AI use, up 4 points in a year, says Statistics Finland. So the chat line often lands in a company with nothing else written down.

Here is my honest read. This rule is the easiest one in the whole Act, and it is being treated as the scary one. An hour of work clears it. Hiding the bot was never good business either, because buyers work it out by the third reply and trust drops when they do.

What is the short version?

Your chat says it is AI, in plain words, before the first reply. That line has to be live on 2 August 2026. Your vendor handles the marking of AI-made content. You handle what the buyer sees on the page. Write both down, then get on with the week.

If your chat still opens with a bare hello, that is today's ten-minute job.

And if the bigger question is whether the bot earns its keep at all, we put the numbers side by side in the real cost of a website chatbot and in our chatbot ROI write-up. The rest of what we build sits on the services page.