agent-view activeallowed: GPTBot · ClaudeBot · PerplexityBot · Google-Extended +17llms.txt: presentJSON-LD: @graphlang: en-GB

Guide · 6-minute read

AI disclosure rules: what to do now.

Not every use of AI has to be disclosed. The rules cover the cases where people could be deceived.

By Manuel Bubori, Studio BUBORILast reviewed

For businesses that produce advertising with AI, or have it produced for them.

Since 2 August 2026, new transparency rules for AI have applied across the EU. This article shows which cases are affected and how to put the obligation into practice.

What this is about

The basis is Article 50 of the European AI Act, Regulation (EU) 2024/1689. It has applied since 2 August 2026. The regulation itself has been in force since August 2024, and some parts have applied since 2025.

Disclosure is required above all where people cannot tell that they are communicating with an AI or looking at AI-generated content. There is no general obligation to label every piece of content that AI helped produce.

Chatbots and other interactive systems

People must be told when they are talking to an AI system rather than a human being. This covers chatbots on websites, digital assistants, AI-driven service or phone bots and AI avatars.

The information must be clearly recognisable at the first interaction at the latest. A plain sentence is enough:

You are communicating with an AI assistant.

No additional disclosure is needed where it is obvious to a reasonably well-informed person that they are dealing with an AI.

Legally, this obligation is addressed to the provider of the system. Anyone who puts a chatbot into service under their own name can be the provider themselves. Either way, the notice belongs on the page.

Deepfakes

Images, video and audio must be labelled as AI-generated where they were generated or substantially altered by AI and resemble real people, places, objects or events closely enough to appear authentic.

Four typical cases: a person says something in a video they never said. A real voice is synthesised. A person is realistically placed into an image after the fact. An event that never happened is shown as if it were a real recording.

This content was generated or altered using artificial intelligence.

For art, satire and fiction the disclosure may be made in a way that does not unduly hamper the work. It still has to be recognisable.

AI text on matters of public interest

Where AI-generated or substantially AI-edited text is published to inform the public on a matter of public interest, disclosure is required. That covers politics and elections, health and safety, environment and climate, social or economic developments, decisions by public authorities and public events.

This text was produced with the help of artificial intelligence.

The important exception: the notice is generally not required where a human has reviewed the text for substance before publication and takes editorial responsibility for it. A natural or legal person has to assume that responsibility.

Skimming does not count, and an automatic spell check certainly does not. A sensible review covers content, facts, sources, tone and possible errors.

Emotion recognition and biometric categorisation

People must be informed where an AI system is used to recognise their emotions or to categorise them biometrically, as far as such use is permitted at all.

This affects systems that infer mood, stress or other personal characteristics from face, voice or behaviour, for example.

What normally does not have to be disclosed

Where AI is used only as a tool, Article 50 does not usually apply. That includes:

  • spell and grammar checking
  • translation of text (AI dubbing with a synthesised voice counts as a deepfake)
  • ideas and outlines
  • internal summaries
  • minor image corrections
  • formatting
  • drafts that are then reviewed for substance and edited
  • internal content that is not published

Other rules may still apply, such as copyright, data protection, competition law, personal rights or the rules of the sector concerned.

What applies to providers of AI systems?

Anyone who develops AI systems themselves or offers them under their own name carries additional technical obligations. AI-generated or manipulated text, images, video and audio must in principle also be marked in a machine-readable format and be detectable technically.

A visible label alone does not satisfy this obligation. Exceptions are possible where the AI performs only an assistive function for standard editing, or does not substantially alter the input data or its meaning.

For systems already on the market before 2 August 2026, the marking obligation applies only from 2 December 2026. This transition period comes from the Digital Omnibus on the AI Act and concerns providers only. Deployers get no deferral.

Anyone who merely uses somebody else’s AI tool is normally a deployer and not a provider. Anyone who markets a system under their own name or substantially modifies it can become a provider themselves.

Eight steps for putting it into practice

  1. Record where AI is used. Note which departments use AI and what content comes out of it.
  2. Classify the use cases. Check whether chatbots, deepfakes, public information texts or biometric systems are involved.
  3. Assign responsibility. For every published piece it must be clear who reviews and who signs off.
  4. Define the wording. Consistent, clearly visible notices for website, social media, video, audio and documents.
  5. Disclose on the content itself. Not only in the legal notice or the terms of use.
  6. Document the review. Keep a traceable record of who checked what and when.
  7. Check your suppliers. Do the systems in use support the technical markings required?
  8. Train your people. Everyone involved needs to know when disclosure is necessary.

The notices must be clear, perceptible and accessible. They must appear at the first interaction, or at the first presentation of the content, at the latest.

What a breach can cost

Breaches of the transparency obligations can attract fines of up to 15 million euros or, for companies, up to three per cent of worldwide annual turnover. Whichever is higher applies. For small and medium-sized enterprises, including start-ups, the lower of the two applies instead.

On top of that come reputational damage, complaints and possible consequences under data protection, competition or personal rights.

Sources

This article offers general guidance and does not replace legal advice on your specific case.

Frequently asked questions

No. Article 50 does not require general labelling. Anyone who uses AI as a tool, for proofreading, translation or a draft, and then reviews the text for substance and takes responsibility for it, generally needs no notice.

At the first interaction at the latest. One sentence is enough: “You are communicating with an AI assistant.” The notice can be omitted only where it is obvious to a reasonably well-informed person that a machine is answering.

An image, video or audio file generated or substantially altered by AI that resembles real people, places, objects or events closely enough to appear authentic. What matters is the risk of confusion with a real recording.

Up to 15 million euros or, for companies, up to three per cent of worldwide annual turnover, whichever is higher. For small and medium-sized enterprises, the lower of the two amounts applies.

Anyone using somebody else’s AI tool is normally a deployer. A provider is whoever develops a system, or has it developed, and places it on the market or puts it into service under their own name. Providers additionally carry the obligation to mark content in a machine-readable format.

Questions about your specific case?

In a free 30-minute brand check we go through your situation together. No sales pitch, no obligation.

agent-view

What an answer engine reads from this page

A search engine returns ten links and the human picks. A language model returns one paragraph and names two or three companies in it. That is the difference between being found and being named. This page is built for the second case.

Retrieval

asked: Do I have to disclose every text that AI helped with?
read: /llms.txt · /robots.txt · JSON-LD @graph · this page

answered: No. Article 50 does not require general labelling. Anyone who uses AI as a tool, for proofreading, translation or a draft, and then reviews the text for substance and takes responsibility for it, generally needs no notice.

Allowed agents (21)

OpenAI: GPTBot · OAI-SearchBot · ChatGPT-User · OAI-AdsBot
Anthropic: ClaudeBot · Claude-User · Claude-SearchBot
Perplexity: PerplexityBot · Perplexity-User
Google: Google-Extended · Googlebot
Microsoft: Bingbot
Apple: Applebot-Extended · Applebot
Meta: Meta-WebIndexer · meta-externalfetcher · meta-externalagent
Mistral AI: MistralAI-Index · MistralAI-User · MistralAI-Training
DuckDuckGo: DuckAssistBot
rule: Allow: / · source: https://www.bubori.studio/robots.txt

Entity

name: Studio BUBORI · legalName: BUBORI GmbH
url: https://www.bubori.studio/en/guide/ai-disclosure-rules
inLanguage: en-GB
alternate: de-DE · https://www.bubori.studio/ratgeber/ki-kennzeichnungspflicht
@type: Article
updated: 2026-10-31

Questions this page answers

Do I have to disclose every text that AI helped with?
No. Article 50 does not require general labelling. Anyone who uses AI as a tool, for proofreading, translation or a draft, and then reviews the text for substance and takes responsibility for it, generally needs no notice.
When does a chatbot have to be identifiable as AI?
At the first interaction at the latest. One sentence is enough: “You are communicating with an AI assistant.” The notice can be omitted only where it is obvious to a reasonably well-informed person that a machine is answering.
What exactly is a deepfake under the regulation?
An image, video or audio file generated or substantially altered by AI that resembles real people, places, objects or events closely enough to appear authentic. What matters is the risk of confusion with a real recording.
Is a note in the legal notice enough?
No. The disclosure belongs on the content itself, visible at the first interaction. A sentence in the terms of use or the legal notice does not satisfy the obligation.
What does a breach cost?
Up to 15 million euros or, for companies, up to three per cent of worldwide annual turnover, whichever is higher. For small and medium-sized enterprises, the lower of the two amounts applies.
Are we a provider or a deployer?
Anyone using somebody else’s AI tool is normally a deployer. A provider is whoever develops a system, or has it developed, and places it on the market or puts it into service under their own name. Providers additionally carry the obligation to mark content in a machine-readable format.

Contact

telephone: +49 7721 697 24-70
email: hello@bubori.com
address: Industriestraße 3, 78052 Villingen-Schwenningen, Baden-Württemberg
geo: 48.0916, 8.5046

Machine-readable entry points

llms.txt: https://www.bubori.studio/llms.txt
sitemap: https://www.bubori.studio/sitemap.xml
JSON-LD: in the head of this page

Ten links leave the choice to the human. One paragraph has already made the choice. A company that does not appear in that answer is not on the list being chosen from.

discipline: AEO / GEO · https://www.bubori.studio/en/ai-visibility

Statistics · optional

May we see what reaches you?

We would like to know which pages get read. With your consent we use Google Analytics for this. Without consent none of it loads. Privacy policy (German)

What exactly is collected
Provider
Google Ireland Limited, Dublin
Purpose
Measuring reach, improving content. No advertising.
Data
Pages viewed, referrer, device, approximate location. Google Analytics does not store IP addresses.
Cookies
_ga and _ga_…, up to two years
Third country
Transfer to the USA possible, covered by the EU-US Data Privacy Framework
Withdrawal
Any time via “Cookie settings” in the page footer