DEV Community

mdodeja
mdodeja

Posted on Originally published at mdodeja.github.io

AI chatbots in mobile apps: where the Article 50 disclosure goes

#ai #legal #compliance #webdev

This guide was drafted by an AI agent from the primary sources linked at the bottom, and has not been reviewed by a lawyer. It is general information, not legal advice. The original is at https://mdodeja.github.io/eu-ai-act-article-50-guide/guides/mobile-app-chatbot-ai-disclosure.html.

Short answer. An AI chat inside an app needs the same Article 50 disclosure as one on a website, at the latest at the first interaction. In an app the first interaction is often not the chat screen. It can be a push notification written by the AI, or a deep link that drops the user into a conversation, so the disclosure has to go where the user first meets the AI's words. Apple separately requires apps to disclose, and get explicit permission, before sending personal data to third-party AI, and Google Play requires apps built around AI chat to offer an in-app way to report offensive output.

Where the first interaction happens in an app

Article 50(1) requires users to be informed that they are interacting with an AI system, and Article 50(5) says that has to happen "at the latest at the time of the first interaction". On a website the first interaction is usually the chat window opening. Apps have more entry points:

Entry point Where the user first meets the AI Where the disclosure goes
User opens the support or assistant tab First message in the chat screen Opening message, and a persistent label in the chat header
Push notification written by the AI ("Your order is late, want me to rebook?") The notification itself In the notification text, or in the first line the user sees after tapping, before any further AI reply
Deep link from email or SMS straight into a running conversation The conversation screen, mid-thread A header label, plus the disclosure repeated as the first visible message, since earlier messages may be off screen
In-app message or banner generated by AI The banner A short "AI" label on the banner where it makes a statement to the user
Voice assistant in the app First spoken reply Spoken, plus on screen

A push notification is short, so a full sentence may not fit. Two workable options: start the text with "AI assistant:" or keep the notification neutral ("Update on your order") and put the disclosure at the top of the screen it opens. The second is safer only if the notification itself contains nothing the AI wrote to the user.

The "obvious from the context" exception in Article 50(1) is read narrowly. A tab called "Assistant" with a sparkle icon is not obviously an AI to every user. Say it in words.

For wording, see the disclosure wording guide. For assistants that only staff use, see the staff-only assistants guide.

Persistent labels help in apps

Apps keep conversations for weeks, users come back to them from notifications, and screens get shared as screenshots. A small "AI assistant" label in the chat header, always visible, covers the cases where the opening message has scrolled away. Article 50 does not require a persistent label, but it is a cheap way to keep the disclosure true at every return visit.

When a person takes over the chat, change the header to show it, and change it back when the bot returns. The WhatsApp and Messenger guide covers handover in more detail.

Apple: sending personal data to third-party AI

Apple's App Review Guideline 5.1.2(i) says: "You must clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so." The AI-specific wording was added in November 2025 (reported by TechCrunch).

For an in-app chatbot built on an outside model provider, that means a consent step before the first message containing personal data is sent to that provider. It is a separate thing from the Article 50 disclosure:

  • Article 50(1): tells the user they are talking to an AI.
  • Apple 5.1.2(i): tells the user their data goes to a third-party AI and asks permission.

One screen can do both ("You're chatting with an AI assistant. Your messages are sent to [provider] to generate replies. Continue?"), but the permission part needs a real choice. Apple's guidelines do not define "third-party AI" in detail, so where the model runs on your own servers or on the device, check the current text.

Google Play: reporting offensive AI output

Google Play's AI-Generated Content policy requires apps that generate content with AI to "contain in-app user reporting or flagging features that allow users to report or flag offensive content to developers without needing to exit the app". Google's explainer lists "text-to-text AI chatbot apps, in which the AI generated chatbot interaction is a central feature of the app" among the covered apps. A support bot tucked inside a shopping or banking app may fall outside that wording; an assistant app or a companion app is inside it. Either way, a "Report this reply" option on each AI message meets the rule, and the reports should feed the app's content filtering.

This is a store rule, not an EU law, but it overlaps with what an EU business would want anyway: a way to catch wrong or harmful answers.

Checklist for an in-app AI chat

  • [ ] Disclosure in the first AI message, whatever screen the user arrives on.
  • [ ] AI-written push notifications either say "AI" or open to a screen that does before anything else.
  • [ ] Persistent "AI assistant" label in the chat header.
  • [ ] Handover to a person shown in the header.
  • [ ] iOS: consent screen before personal data goes to a third-party AI provider.
  • [ ] Android: in-app "report" option on AI replies (required where the chat is a central feature, sensible everywhere).
  • [ ] Privacy policy names the AI provider and what is sent.

Sources

Top comments (0)