Tahir Almas

Posted on Aug 12 • Originally published at ictdesk.net

The EU Now Requires Your Live Support Software to Admit It's AI

Originally published at ictdesk.net

On 2 August 2026, Article 50 of the EU AI Act became applicable. If your live support software answers customers with an AI system, you now have to tell them, and you have to tell them at the first interaction rather than somewhere in your terms. This is one of the shortest obligations in the whole regulation and one of the easiest to satisfy. It's also the one most chat widgets currently fail, because the disclosure exists on a settings page nobody reads instead of in the conversation.

The fix is roughly a sentence of copy and a label on your transcripts. The cost of skipping it is set out in Article 99. So this is worth twenty minutes of your afternoon.

What the text actually says

Article 50(1) puts the duty on providers of AI systems intended to interact directly with people: design them so the person is informed they're dealing with an AI system, unless that's obvious to a reasonably well-informed and observant person given the circumstances.

Article 50(5) adds the timing. The information has to be provided at the latest at the time of the first interaction or exposure. Not on request. Not after the fact. First interaction.

That's the whole thing as it applies to a support chat. There's no template wording mandated, no logo you have to display, no filing with anyone. You just have to say it, clearly, at the top.

The Act phases in over three years. Chatbot transparency is the milestone that landed this month, which is why it's suddenly everyone's problem.

The exemption people over-read

That "unless it's obvious" clause is doing a lot of work in a lot of internal legal memos right now, and I think most of them are reading it too generously.

The test isn't whether a technically literate person could infer it. It's whether it's obvious to a reasonably well-informed and observant person in the circumstances. A widget labelled "Chat with us" that opens with "Hi, how can I help today?" and then writes three fluent paragraphs about your refund policy is not obviously a machine. In 2020 it might have been. That's precisely what changed.

If your bot is a decision tree that offers four buttons and nothing else, you have a decent argument. If it generates prose, you don't, and betting a fine on that reading to save one line of text is a strange trade.

What it costs to get wrong

Article 99(4)(g) covers non-compliance with the transparency obligations: administrative fines up to 15 million euro or up to 3 percent of total worldwide annual turnover for the preceding financial year, whichever is higher.

Realistically, a first enforcement action against a mid-sized SaaS company over a missing chat disclosure is not going to land at 15 million. Regulators have discretion and Article 99 tells them to weigh the nature and gravity of the infringement. But the ceiling exists, and the underlying point is that the EU has classified this as a transparency failure rather than a UX quibble. Once a rule has a fine attached, "we were going to get to it" stops being an answer.

Three places disclosure has to appear

Most teams do the first one and miss the other two.

The middle one is where most implementations break. A visitor who doesn't notice the handoff has been told once, at the start, and then quietly told nothing.

The first reply. Before the visitor types anything worth reading, the assistant identifies itself. Something like "Hi, I'm an AI assistant. I can hand you to a person any time you ask." That second sentence isn't required by Article 50, but it turns a legal notice into something the customer is glad to read, which is a better outcome than technical compliance.

The handoff. When a human agent takes the conversation, say so, with the agent's name. When the conversation goes back to the assistant, say that too. This is the gap in most deployments: the widget discloses once at session start and then switches silently between an AI and a person for the next twenty minutes. The visitor was informed at first interaction and misinformed for the rest of it.

The transcript. Whatever you store, and whatever you email the customer afterwards, keeps the same labels the live chat had. If a regulator or a customer ever asks how you complied, the transcript is the evidence. A policy page saying you disclose is a claim. A transcript with "AI assistant" on four lines and "Sana, agent" on the next four is a record.

How ICTDesk handles it

Our AI agent chat identifies itself in its opening message and marks the switch in both directions when a conversation moves between the assistant and a human agent. Those labels persist into the stored ticket, so the ticket history shows who said what without anyone having to reconstruct it later.

Being straight about the limits: the opening line is editable, which means you can edit the disclosure out of it. That's deliberate, because you might be running the widget in a jurisdiction with different wording requirements, or you might want to phrase it in your own voice. But if you're serving EU visitors, don't remove it. If you've customised that greeting at any point in the last year, go and look at what it says now.

The bit that isn't about compliance

There's a version of this article that stops at the fine. Here's the part I think matters more.

Customers work out they're talking to a bot within about two exchanges. They always have. What they resent isn't the bot, it's the two minutes spent trying to establish what they're dealing with, and the feeling that a company hoped they wouldn't notice. Disclosure removes that. It also lets you write a better bot, because an assistant that has admitted what it is can say "I don't have access to your billing record, let me get someone who does" without breaking character.

The teams I've seen do this well tend to report that their handoff rates go down, not up, which is the opposite of what people expect when they first add the line. My read is that clear framing sets a realistic expectation and people stop testing the bot to see if it's real.

A short checklist

Open your own widget as a visitor, in an incognito window, and check four things. Does the first message say it's AI? When you ask for a human, does the transition announce itself? Does the emailed transcript keep the labels? And if you run more than one widget, on a docs site or a pricing page or in-app, does every one of them do all three?

That last one catches people. The main site widget gets configured carefully and the one embedded in the help centre inherits a default greeting from 2024.

Frequently asked questions

Does this apply if my company isn't in the EU?

The Act reaches providers and deployers placing AI systems on the EU market or whose output is used in the EU, so a US-based SaaS with EU customers is in scope. Geo-gating the disclosure to EU IPs is technically possible and, in my view, a bad idea: you'd be maintaining two behaviours to avoid writing one sentence, and the sentence is good for every visitor anyway.

Is a notice in our privacy policy enough?

No. Article 50(5) requires the information at the latest at the time of the first interaction. A privacy policy is neither the first interaction nor something anyone reads. The disclosure has to be in the chat.

What about AI that only helps the agent, like reply suggestions?

Article 50(1) covers systems intended to interact directly with natural persons. If a human agent reviews and sends every message, the customer is interacting with the agent. The situation gets murkier when suggestions are auto-sent without review, and if that's your setup, treat it as an AI interaction and disclose.

Do we need to disclose on every message, or just once?

Once at the start satisfies the timing rule. But disclose again at every change of speaker, because a session that silently alternates between AI and human leaves the customer without accurate information for most of it. The regulation sets a floor. Handoff labelling is what makes the floor honest.

Is there mandatory wording we have to use?

No. Article 50 requires the person be informed, clearly and distinguishably, and leaves the words to you. Plain language beats legal language here. "I'm an AI assistant" does the job better than a formal notice most people skim past.

What about voice bots on the phone?

Same obligation, same timing. The AI has to identify itself in its opening turn, before it asks the caller anything. Voice makes the "obvious to a reasonable person" exemption even harder to rely on, since current synthesis is good enough that callers regularly can't tell.

DEV Community