EU AI Act Article 50 for Websites: What Actually Applies
Since 2 August 2026, the EU AI Act's transparency rules have been enforceable — and a lot of website owners have read the headlines about "AI disclosure" and "watermarking" and quietly panicked. Most of that panic is misplaced. Article 50 has four obligations, and for the overwhelming majority of ordinary websites, only one of them applies — and it's straightforward. This is the plain-English guide to which part is actually your job, what "disclosure" has to look like, and, just as importantly, what isn't your responsibility.
Key takeaways
- Article 50 has four obligations, not one. They apply to different situations. Most websites are only touched by the first: disclosing AI interactions.
- If your site has a chatbot, AI search, or an AI assistant, you must tell EU visitors they're interacting with AI — clearly, at the point of interaction, not buried in your terms.
- The disclosure duty is yours even if you didn't build the AI. It falls on the deployer — the business running the tool on its site.
- Content watermarking is a different obligation, and usually not yours. Marking AI-generated media is the AI provider's job, not a consent-layer task.
- It reaches non-EU businesses. If your site serves EU visitors and uses AI they interact with, Article 50 applies regardless of where you're based.
What Article 50 is
Article 50 is the transparency section of the EU AI Act (Regulation (EU) 2024/1689). While much of the AI Act deals with "high-risk" AI systems and phases in over several years, Article 50 is about something simpler and more universal: making sure people know when they're dealing with AI. Its obligations became enforceable on 2 August 2026, and violations sit in the penalty tier of up to €15 million or 3% of worldwide annual turnover, whichever is higher.
Here's the reassuring part, and the reason this article exists: Article 50 is often described as if it's a sweeping new compliance burden, but for a normal business website it's usually one clear, doable task. The trick is knowing which of its four obligations applies to you — because most of them don't.
The four obligations, decoded
Article 50 contains four distinct transparency duties. They apply to different actors and different situations. Read them as a filter — most sites stop at the first row.
| Article 50 obligation | Applies when… | Whose job | Most sites? |
|---|---|---|---|
| 50(1) — AI interaction disclosure | Your site has AI that visitors interact with (chatbot, AI search, AI assistant) | The deployer (you) | ✅ Usually yes |
| 50(2) — AI content marking | You provide a generative-AI system that produces synthetic media/text | The AI provider | ✗ Rarely |
| 50(3) — Emotion / biometric disclosure | You run emotion-recognition or biometric-categorization AI | The deployer | ✗ Niche |
| 50(4) — Deepfake / public-interest labeling | You publish AI-generated deepfakes or AI text on matters of public interest | The deployer | ✗ Media mostly |
The pattern is clear once you see it laid out: 50(1) is the one that touches ordinary websites, and it's the one that behaves like a consent-layer task — surface a disclosure, at the right moment, and (ideally) keep proof you did. The other three are either for AI providers (companies that build generative-AI systems) or for specific niches like media publishing and biometric systems.
Which one applies to your site
Run yourself through this quickly:
For the large majority of business websites — e-commerce, SaaS, services, healthcare, professional sites — the honest answer is: only 50(1), and only if you run an AI feature visitors interact with. If you don't run any such feature, Article 50 may not require anything of you at all right now (though that can change the moment you add a chatbot).
What counts as "AI you interact with"
Since 50(1) is the obligation that matters for most sites, it's worth being concrete about what triggers it. The duty applies when a visitor directly interacts with an AI system. In website terms, that typically means:
- AI chatbots and assistants — the support widget that answers in natural language, an AI concierge, an AI-powered help agent.
- AI-powered live chat — where an AI handles or drafts responses, whether or not a human is also involved.
- AI search — a search box that uses AI to interpret queries and generate answers rather than just matching keywords.
- AI recommendations a visitor engages with — interactive recommendation features that respond to what the visitor does.
The unifying test is interaction: the visitor is communicating with, or actively engaging, an AI system. There's a sensible exception written into the law — disclosure isn't required where it would be obvious from the context that the person is dealing with AI. But "obvious" is a high bar and a risky thing to assume; a modern chatbot can feel human enough that visitors genuinely don't know, which is exactly the situation the rule exists for.
What the disclosure must look like
The law doesn't hand you exact wording, but it does set a standard. The disclosure must be clear, distinguishable, and provided at the latest at the time of the first interaction. Unpacking that into practical requirements:
The "not buried in the terms" point is the one sites get wrong most often. It mirrors a principle that runs through privacy law generally: a disclosure a visitor has to go hunting for isn't really a disclosure. (We make the same argument in a different context in your privacy policy is not a consent banner — a policy tucked in the footer can't do a job that has to happen at the moment of interaction.)
What isn't your job — the watermarking line
This is the part that saves most site owners the most worry, so it's worth stating plainly. Article 50(2) — the content-marking / watermarking obligation — is the one behind scary headlines about "labeling all AI content." For an ordinary website, it is almost certainly not your obligation.
Here's why. 50(2) requires that synthetic content (AI-generated images, audio, video, text) be marked in a machine-readable format so it can be detected as artificial. But that duty falls on the provider of the generative-AI system — the company that built the model — not on you for using it. If you generate a blog image with an AI tool, marking that output is the tool-maker's engineering problem, embedded in how the tool works. It's a product and editorial matter, not a consent-layer or website-owner task.
So the clean mental model is: disclosing that a visitor is interacting with AI is your job (50(1)); watermarking AI-generated content is the AI vendor's job (50(2)). Keeping those two separate is most of what it takes to not over-worry about Article 50.
Non-EU sites and the GDPR overlap
Two final things that surprise people.
Article 50 reaches beyond the EU. The AI Act applies to providers placing AI systems on the EU market and to deployers whose AI outputs are used in the EU — regardless of where the business is established. A US, UK, or Australian company whose website is used by EU visitors and runs an AI feature those visitors interact with falls within scope. You can't escape it purely by being based elsewhere, the same way CIPA reaches sites outside California when Californians visit.
Article 50 sits on top of the GDPR, it doesn't replace it. When your AI processes personal data, the GDPR's usual requirements still apply — a lawful basis for the processing, and its transparency rules (Articles 12–14). So an AI chatbot that collects personal data can trigger both an Article 50 disclosure duty (tell them it's AI) and a GDPR consent-or-lawful-basis question (may we process this data). They're two duties at one moment, which is exactly the kind of thing AI-aware consent is meant to handle in one place.
Start by seeing what your site actually does
Article 50 turns on what's running on your site. Scan your site to see the trackers and third-party tools firing on your pages — the visibility that makes disclosure decisions concrete rather than guesswork. About 10 seconds, no account.
Scan your site free →Frequently asked questions
Does Article 50 apply to my website?
Article 50(1) applies if your website uses an AI system that interacts directly with visitors — such as an AI chatbot, AI-powered search, an AI assistant, or interactive AI recommendations — and you have EU visitors. If you run any of those, you must disclose to EU visitors that they're interacting with AI, and this has been enforceable since 2 August 2026. The other three obligations (content marking, emotion/biometric disclosure, deepfake labeling) apply mainly to AI providers, biometric systems, and media publishers. If you don't run a visitor-facing AI feature, Article 50 may not require anything of you right now. This is general information, not legal advice.
Do I have to disclose an AI chatbot to visitors?
If EU visitors interact with it, yes — under Article 50(1). You must inform them they are interacting with AI, clearly and at the latest at the time of the first interaction. A disclosure buried in your Terms & Conditions or privacy policy does not satisfy this; it needs to be where and when the interaction happens. There's an exception where it would be obvious from context that the person is dealing with AI, but that's a high bar — modern chatbots often feel human enough that visitors genuinely can't tell, which is the situation the rule addresses.
Do I need to watermark AI-generated content on my site?
Almost certainly not, as an ordinary website. The content-marking obligation under Article 50(2) requires synthetic content — AI-generated images, audio, video, text — to be marked in a machine-readable format, but that duty falls on the provider of the generative-AI system that made it, not on you for using the tool. Marking is an engineering feature built into the AI tool. It's a product and editorial matter, not a website-owner or consent-layer task. Your job is disclosing AI interactions (50(1)), not watermarking AI content (50(2)).
What are the penalties for an Article 50 violation?
Article 50 violations sit in the penalty tier of up to €15 million or 3% of worldwide annual turnover, whichever is higher, under the EU AI Act's penalty provisions. National market surveillance authorities have had enforcement power since 2 August 2026. Transparency obligations are among the easiest for regulators to verify — they can simply use your website and check whether the disclosure exists — which makes practical enforcement risk visible and real rather than theoretical. This is general information, not legal advice; consult qualified counsel for your situation.
Does Article 50 apply to non-EU businesses?
Yes, if your AI outputs are used in the EU. The AI Act applies to providers placing AI systems on the EU market and to deployers whose systems' outputs are used in the EU, regardless of where the business is established. A US, UK, or Australian company whose website serves EU visitors and runs an AI feature those visitors interact with falls within scope. Being based outside the EU doesn't remove the obligation — much as CIPA can reach websites outside California when California residents visit them.
How does Article 50 relate to the GDPR?
They stack — Article 50 doesn't replace the GDPR. Article 50 is about transparency: telling people when they're dealing with AI. The GDPR governs the personal data itself: you still need a lawful basis to process it and must meet the GDPR's transparency requirements. So an AI chatbot that collects personal data can trigger both an Article 50 disclosure duty and a GDPR consent-or-lawful-basis question at the same moment. Handling both together — the AI disclosure and the data-processing consent — is the practical challenge, and it's what AI-aware consent is designed to address.
The bottom line
Article 50 of the EU AI Act sounds bigger than it usually is for an ordinary website. It has four obligations, but for most business sites only one is in play: if visitors interact with AI on your site, tell them — clearly, at the moment of interaction, not buried in your terms. That's 50(1), it's been enforceable since 2 August 2026, and it behaves like a consent-layer task.
The obligations that generate the scariest headlines — watermarking AI content — mostly aren't yours; they fall on the companies that build generative-AI tools, not on you for using them. Keeping "disclose AI interactions" (your job) separate from "watermark AI content" (the vendor's job) resolves most of the confusion.
So the practical path is short: work out whether visitors interact with AI on your site, and if they do, make sure the disclosure appears clearly and on time. Do that, and you've handled the part of Article 50 that actually applies to you.
Handle the disclosure the right way
ConsentPixel surfaces the Article 50(1) AI-interaction disclosure inside your consent banner — shown to EU visitors, at first interaction, with wording you configure. See how it fits alongside your tracker consent, from one pixel.
Scan your site free →Information, not legal advice. This article summarizes Article 50 of the EU AI Act (Regulation (EU) 2024/1689) for general educational purposes and does not constitute legal advice or create an attorney–client relationship. Obligations depend on your role (provider vs deployer), your specific AI use, and your visitors, and the surrounding guidance continues to develop. Dates and thresholds reflect publicly reported information as of September 2026; verify current requirements and consult qualified counsel for your situation. ConsentPixel — Privacy · Verified is not a law firm, and no single tool by itself makes a website compliant with any law.