If Your Chatbot Talks to Anyone in Europe, It Now Has to Confess
On August 2, while much of the tech industry was watching other deadlines, a rule quietly took effect in the European Union that touches nearly every company with a customer-facing website: if your chatbot talks to a person, it now has to identify itself as a chatbot. Not eventually and not buried in the terms of service, but at the first interaction with every new person who encounters it. The obligation is one of several transparency requirements under Article 50 of the EU's AI Act that the European Commission's AI Office and national regulators began enforcing on August 2, marking the point when Europe's sprawling AI law stopped being a compliance calendar and became a bill.
The requirements themselves read less like technology policy than basic etiquette codified into law. Interactive AI must identify itself unless the fact is obvious to a reasonably observant person — a carve-out that quietly turns product design into a legal question, since a bot that is obviously a bot needs no label. Synthetic images, audio and video must carry machine-readable markings so software can detect their origin. Deepfakes need visible labels, and when an AI system analyzes someone's emotions or sorts them into biometric categories, the person must be told that it is happening.
What makes this a business story rather than simply a European one is the law's reach. The Act applies to providers and deployers anywhere when the output is used in the EU, and "used in the EU" is broad enough to encompass a public website, an open podcast feed or a YouTube upload. A Kansas City software firm with a support bot and European visitors is potentially in scope.
Europe has run this play before. GDPR, the sweeping data-privacy law passed in 2018, technically protects people in the EU, but building one compliant product is usually cheaper than maintaining a European version and an everyone-else version. Its rules therefore became the default for websites around the world. The AI Act is likely to follow the same path — which is how a European regulation becomes, in practice, everyone's regulation. The cookie consent banner followed exactly this route, for better and, as anyone who has clicked through six of them before breakfast can attest, for worse.
The teeth are real. Violations of the transparency obligations carry fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher, meaning the potential penalty scales with the size of the company that ignores it. Readiness, meanwhile, is not keeping pace: one industry survey found 78% of organizations in scope had not begun meaningful compliance work when the deadline arrived. That gap between obligation and preparation is where enforcement actions tend to emerge, and regulators looking for early examples rarely choose companies that made a serious effort to comply.
There is also a message in what Brussels chose not to delay. The transparency rules are only one part of the AI Act; the law also imposes much heavier requirements on AI used for high-stakes decisions such as hiring, credit scoring and medical care, including formal risk assessments and reviews before deployment. Under industry pressure, the EU postponed that heavier tier until December 2027. The disclosure rules, however, kept their original date. Audits can wait, in other words, but the right to know you're talking to a machine cannot. For companies deciding where to spend a limited compliance budget, that is about as clear a signal of regulatory priority as Brussels is likely to send.
The disclosure itself costs almost nothing: a line of copy, an icon or an opening sentence. The more interesting cost falls on businesses whose products were quietly worth more when the machine could pass as a person — the AI sales representative working leads, outbound service calls and companion apps sold partly on intimacy. That premium is now illegal to collect in Europe, and the price of ignoring the rule can reach three percent of global revenue. Honesty was always a virtue. As of August 2, it is also a compliance requirement.