You pay for the click. A customer in Berlin taps your Google ad at 11pm, lands on your site, and your AI agent answers in four seconds — which is exactly why you bought it. Since 2 August 2026, that answer also carries a legal duty in the European Union: Article 50 of the EU AI Act requires that people be told they are dealing with an AI, and non-compliance is fined at up to €15,000,000 or 3% of total worldwide annual turnover, whichever is higher (EU AI Act Service Desk, Article 99, 2026). The part that catches most owners by surprise is the reach: the obligation follows the customer, not your company registration, so a Hong Kong, Singapore or US business selling into the EU is in scope.
This article covers what Article 50 actually asks you to disclose, who is caught, what the penalties really look like for a small company, what a compliant disclosure line looks like inside the chat window, and how the EU rule compares with Hong Kong, Singapore and US guidance.
What does EU AI Act Article 50 require your AI chat to disclose?
Article 50 requires that a person interacting directly with an AI system be informed that they are interacting with an AI — unless that is already obvious to a reasonably well-informed person. That is the whole of the core duty for a customer-service or sales agent. There is no mandated wording, no registration, and no approval process. There is a single expectation: the customer must know.
The Act splits the duty by role. The provider — whoever develops and places the AI system on the market — must design the system so that people are informed they are interacting with an AI (Article 50(1)) and must mark AI-generated audio, image, video and text in a machine-readable format (Article 50(2)) (European Commission digital-strategy FAQ, 2026). The deployer — you, the business running the agent on your site or WhatsApp number — carries the labelling duties for deepfakes (Article 50(4)) and for AI-generated text published to inform the public on matters of public interest, unless a human reviewed it and took editorial responsibility.
For a business running an AI agent on a website or WhatsApp, the practical split is simpler than the legal one. Your vendor is responsible for building a system that can disclose. You are responsible for making sure the disclosure is actually switched on and visible in the conversation your customer sees. A vendor can hand you a compliant product and you can still deploy it badly.
Here is the full set of Article 50 duties, with dates and the penalty band attached to each:
| Duty | Provider or deployer | What has to be disclosed | Applies from | Penalty ceiling (Art. 99) |
|---|---|---|---|---|
| AI-interaction notice (Art. 50(1)) | Provider designs it; deployer confirms it is shown | That the person is interacting with an AI, unless obvious | 2 August 2026 | €15M or 3% of worldwide turnover |
| Machine-readable marking of synthetic content (Art. 50(2)) | Provider | AI-generated audio, image, video or text marked machine-readably | 2 August 2026 (systems already on the market: 2 December 2026) | €15M or 3% |
| Deepfake labelling (Art. 50(4)) | Deployer | That the content is artificially generated or manipulated | 2 August 2026 | €15M or 3% |
| Public-interest AI text | Deployer | That published text is AI-generated, unless human-reviewed with editorial responsibility | 2 August 2026 | €15M or 3% |
(Source: EUR-Lex / EU AI Act Articles 50 and 99; EU AI Act Service Desk, 2026.)
The "unless it is obvious" carve-out in Article 50(1) is genuine, but it is a weak thing to build a compliance position on. If your agent has a human first name, a headshot and a conversational style deliberately designed to feel like a person, the obviousness argument gets thin fast. One sentence at the top of the conversation costs you nothing and removes the argument entirely.
Does the EU AI Act apply to a business in Hong Kong, Singapore or the United States?
Yes, if the output of your AI system is used in the EU. Article 2 extends the Act to providers outside the EU where they place AI systems on the EU market, and to providers and deployers outside the EU where the system's output is used inside the EU (EUR-Lex, Article 2; aiactbase.eu, 2026). A non-EU AI agent that answers EU customers is caught. There is no revenue threshold and no employee-count threshold to hide behind.
This is the point most coverage skips, and it is the one that matters for the businesses I work with. A Hong Kong clinic that runs English-language Google ads and books the occasional European client is in scope for those conversations. A Singapore software company with EU trial users is in scope. A US shop taking EU orders is in scope. The trigger is where the customer is, not where the company is registered, so the practical test is simple: does your AI agent talk to anyone in the EU? If the answer is yes, or you cannot say no with confidence, you are inside Article 50.
The good news is the compliance cost here is close to zero. Unlike the high-risk regime — with its conformity assessments, technical documentation and post-market monitoring — Article 50 asks for a sentence. The risk is not the difficulty of complying; it is that the requirement is so small it never gets scheduled, and then a competitor, a customer or a regulator notices that your agent is presenting itself as a person named "Emily."
What are the penalties for getting AI disclosure wrong?
Non-compliance with Article 50 sits in the middle penalty tier: administrative fines of up to €15,000,000 or 3% of total worldwide annual turnover, whichever is higher — and for smaller companies and start-ups, the Act applies the lower of the two figures rather than the higher (EU AI Act Service Desk, Article 99, 2026). That last clause is the only piece of proportionality in the ceiling, and it is worth knowing: a small company is not exposed to a €15M theoretical maximum on a turnover of a few million.
For context on how the tiers are structured, prohibited practices under Article 5 — the banned uses, not the transparency duties — carry the top band at €35,000,000 or 7% of worldwide annual turnover (EU AI Act Service Desk, 2026). Transparency failures are treated as serious but not as the worst category. Ceilings are also not tariffs: these are maximums set for national market surveillance authorities, which weigh the nature of the infringement, its duration and the size of the operator.
The honest read for an owner-operator is this. The realistic near-term risk from a missing disclosure line is not a headline fine. It is a complaint, an inquiry from a national authority, and the cost of dealing with both — plus the reputational damage of having been the business that let customers think a machine was a person. The fine ceiling is what makes legal teams pay attention; the operational nuisance is what should make you fix it this week.
Did the Digital Omnibus delay the Article 50 deadline?
No. The Digital Omnibus — Regulation (EU) 2026/1744, in force 27 July 2026 — deferred the high-risk regime, pushing Annex III obligations to 2 December 2027 and Annex I obligations to 2 August 2028, but it did not amend Article 50 (Gibson Dunn, 2026; Morgan Lewis, 2026). The transparency duties landed on schedule on 2 August 2026 and are live now.
There is exactly one Article 50 concession in the Omnibus, and it is narrow: providers of generative systems already on the market before 2 August 2026 get a grace period to 2 December 2026 for the Article 50(2) machine-readable marking obligation (Gibson Dunn, 2026). That is a supplier-side deadline for content marking, not a delay to the "tell people it is an AI" duty, and it expires this December.
I flag the Omnibus specifically because it produced a wave of "the EU AI Act has been delayed" headlines in mid-2026 that were true of the high-risk rules and false of everything a customer-service deployment touches. If someone on your team read one of those and closed the tab, this is the correction: the part that applies to your chat window was never postponed.
What does a compliant AI disclosure actually look like in the chat?
It looks like a plain sentence the customer sees inside the conversation itself. Draft Commission guidelines issued under Article 96(1)(d) make the standard explicit: the disclosure must be perceivable in the interaction itself — not buried in terms and conditions, not satisfied by a metadata watermark alone, and not discharged by a vague label like "assistant" (bratby.law summarising the draft guidelines, 2026). The consultation on those guidelines closed on 3 June 2026 and no final version had been adopted as of the check date, so treat them as the regulator's clearly-signalled direction rather than settled text.
Read against that standard, here is the kind of opening line that does the job:
"Hi — I'm the AI agent for [Business Name]. I can answer questions about pricing and availability and book you in. Say 'human' any time and I'll pass you to the team. See our [Privacy Policy] for how we handle your details."
Four things are doing work in that sentence, and each maps to a specific expectation:
- It names the AI plainly, in the first message. "AI agent" or "automated assistant" both work. A human first name with no qualifier does not.
- It is inside the chat, not in a policy page. The draft guidance is unambiguous that the T&Cs do not count as the place a person is informed.
- It offers a human handoff. Not an Article 50 requirement, but it is the single feature that converts a disclosure from a legal notice into something customers actually appreciate.
- It links the privacy notice at the point of collection. Article 50 is a transparency rule, not a data-protection rule — but the same chat is generating personal data, and GDPR duties run alongside it.
Three patterns to avoid, all of them common in the wild: a bot with a human name and a stock-photo avatar and no disclosure anywhere; a disclosure that appears only after the customer asks "am I talking to a person?"; and a disclosure that lives in a footer link nobody clicks. Each of those is a plausible complaint under the draft standard, and none of them buys you anything commercially. In my experience customers do not churn because an AI answered — they churn because they felt handled.
One practical note on implementation: set this once at the platform level rather than per campaign. If your agent runs on a website widget and on WhatsApp, the disclosure needs to appear in both places, and the easiest way to keep that true is a single opening-message setting that every channel inherits. Our guide to AI governance for a small business covers the surrounding controls — human accountability, documented escalation, retention — that make this more than a one-line fix.
How do Hong Kong, Singapore and US rules compare?
They do not impose an equivalent duty. The binding "you must tell people it is an AI" rule is European; Hong Kong and Singapore run on voluntary governance frameworks, and the US is a state-by-state patchwork. Anyone telling you the region has caught up is overstating it.
Hong Kong: the PCPD published the "Artificial Intelligence: Model Personal Data Protection Framework" on 11 June 2024, building on its 2021 ethical AI guidance, and followed with a 2025 checklist on employee use of generative AI (PCPD, 2024; PCPD, 2025). These are best-practice frameworks under the PDPO. They set expectations on governance, data handling and human oversight — they do not create an EU-style chatbot-disclosure mandate. The HKMA has separate generative-AI guidance for banks, which again is sector supervision rather than a general disclosure duty.
Singapore: IMDA's Model AI Governance Framework, its Model AI Governance Framework for Generative AI (2024) and its agentic-AI guidance are voluntary and best-practice (IMDA, 2024). Singapore's binding obligations for an AI agent come from the PDPA on the data side, not from a transparency statute — which is a different question, and one we cover in what the PDPA requires before you point AI at customer data.
United States: disclosure law is patchy and state-driven — California's SB 1001 bot-deception rule and SB 243 companion-chatbot law, Utah's AI Policy Act and Maine's chatbot disclosure rule are the main markers. We covered that landscape in detail in US chatbot disclosure laws and what a small business must actually say, so this article does not repeat it. The short version: no federal mandate, narrow state rules, and a clear direction of travel toward more disclosure.
The operational conclusion from all three is the same, and it is convenient. If you build to the EU standard — one plain disclosure line, visible in the chat, on every channel — you are compliant in the EU and ahead of the voluntary frameworks everywhere else. There is no version of this where you need a different agent for different markets.
What else changed for AI chat on WhatsApp in 2026?
The channel rules moved too, and they are frequently misreported. Meta's WhatsApp Business Solution Terms now bar AI Providers from making a general-purpose AI assistant the primary function on WhatsApp — applying to new accounts from 15 October 2025 and enforced for existing accounts from 15 January 2026 (Meta, WhatsApp Business Solution Terms, 2026). ChatGPT, Copilot and Perplexity left the platform as a result.
What that rule did not do is ban business AI. Business-specific AI — customer service, sales, booking and order handling for a business's own products — is expressly permitted, and Meta's own language describes helping businesses provide customer support and send relevant updates. If someone told you WhatsApp banned bots in January 2026, they read a headline about general-purpose assistants and applied it to the wrong category.
The other date to have in your budget is 1 October 2026, when WhatsApp service messages — replies inside the 24-hour customer-service window — became billable at the utility rate after the first 1,000 free per business number per month (Meta developer documentation, 2026). Hong Kong and Singapore also became standalone rate-card markets on 1 July 2026, with higher utility and authentication rates than the regional bucket they came from. None of that is an Article 50 question, but it lands on the same line of your P&L, and an AI agent that answers well inside the free window is now worth measurably more than one that does not.
If you want to see what a disclosed, honest opening message feels like on your own site rather than in a template, paste your URL on the Omago homepage and ask the agent a question your customers actually ask — Omago runs on website and WhatsApp at a flat US$49–99 per month, with the full pricing published rather than quoted. For the tool-by-tool view in this region, our comparison of AI customer service tools for Singapore businesses sets out who is grant-eligible and who is not.
Frequently asked questions
Do I have to tell EU customers they are chatting with an AI?
Yes, from 2 August 2026. Article 50(1) of the EU AI Act requires that people interacting directly with an AI system be informed of that, unless it is obvious to a reasonably well-informed person (EUR-Lex; European Commission digital-strategy FAQ, 2026). There is no prescribed wording — a plain sentence at the start of the conversation satisfies it — but draft Commission guidelines say the disclosure must be perceivable in the interaction itself, not buried in terms and conditions (bratby.law, 2026).
Does the EU AI Act apply to my Hong Kong or Singapore company?
It can. Article 2 extends the Act to providers and deployers established outside the EU where the AI system's output is used in the EU (EUR-Lex, Article 2). If your AI agent answers customers located in the EU, Article 50 applies to those interactions regardless of where your company is registered. There is no size or revenue threshold that exempts you.
What is the fine for missing AI disclosure?
Up to €15,000,000 or 3% of total worldwide annual turnover, whichever is higher — and for smaller companies and start-ups the Act applies the lower figure (EU AI Act Service Desk, Article 99, 2026). That is the middle penalty tier; prohibited practices under Article 5 carry the top band of €35,000,000 or 7%. These are maximums applied by national authorities in proportion to the infringement, not standard charges.
Did the Digital Omnibus push Article 50 back to 2027?
No. Regulation (EU) 2026/1744, in force 27 July 2026, deferred high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I), but left Article 50 untouched (Gibson Dunn, 2026; Morgan Lewis, 2026). The only related concession is a grace period to 2 December 2026 for machine-readable marking of generative systems already on the market before 2 August 2026.
Do Hong Kong and Singapore require the same disclosure?
Not currently. Hong Kong's PCPD Model Personal Data Protection Framework (11 June 2024) and Singapore's IMDA Model AI Governance frameworks (2024) are voluntary best-practice guidance under their respective data-protection regimes, with no EU-style mandatory "you are talking to an AI" duty (PCPD, 2024; IMDA, 2024). Building to the EU standard covers both.
Sources: EUR-Lex / EU AI Act Articles 2, 5, 50 and 99 (2026), European Commission AI Act Service Desk — Article 99 (2026), European Commission digital-strategy AI Act FAQ (2026), Regulation (EU) 2026/1744 "Digital Omnibus" (2026), Gibson Dunn (2026), Morgan Lewis (2026), bratby.law summarising draft Article 50 guidelines (2026), aiactbase.eu (2026), Hong Kong PCPD Model Personal Data Protection Framework (2024) and generative-AI checklist (2025), IMDA Singapore Model AI Governance Framework for Generative AI (2024), Meta WhatsApp Business Solution Terms and developer documentation (2026). Legal text and guidance checked 2026-09-21; this is general information, not legal advice — take your own advice on your specific position.