A 15-minute Article 50 audit for a client website (free checklist)
Run this once per client. For each AI touchpoint you end up with a scope decision, a role, and an action.
Step 1: Can people in the EU reach it?
Article 50 turns on where the people are, not where the company is. If any of these is true, the client is in scope and you should continue:
- The website or app is available to and used by people in the EU.
- The client sells or ships to EU customers.
- The chatbot, forms or support channels can be reached from the EU. If you don't geo-block, assume yes.
- The client publishes content such as a blog, social posts or a newsletter that people in the EU can read.
A US-only business whose chatbot talks to EU visitors is in scope on that basis alone. If none of the boxes apply, record the property as out of scope with the reason, and look again when the client's market changes.
Step 2: List every AI touchpoint
Write each one down, with where it lives and who built or runs it.
- Customer-facing chatbots and virtual assistants
- Voice agents and AI phone answering
- AI-written blog posts, product copy and newsletters
- AI-generated or AI-edited images, video and audio
- AI avatars and synthetic spokespeople
- Emotion recognition or biometric categorisation. This is rare, and if you find it, take it to a lawyer straight away.
Step 3: For each touchpoint, find the duty and the role
Article 50 divides duties between providers and deployers, and an agency can be either. The guide to chatbots you build for clients explains how to work out which.
Chatbots and voice agents, Article 50(1). Does the user know from the first interaction that it is an AI? Disclosure in the footer or the terms does not count. It has to be in the widget. Fix it with the wording examples, and log the copy you used with a screenshot.
AI-generated content, Article 50(2). Are synthetic outputs marked in machine-readable form, such as metadata or a watermark? If AI is only doing assistive editing such as grammar, the marking duty does not apply. Otherwise see the marking guide.
Realistic synthetic media, Article 50(4). Is every piece that realistically depicts people, places or events visibly disclosed as AI-generated? Artistic, satirical and fictional works get a lighter disclosure, but not none.
AI-written public-interest text, Article 50(4). Is it disclosed as AI-generated, or does a named human editor hold editorial responsibility? See the labelling guide.
Emotion recognition or biometric categorisation, Article 50(3). People must be informed when they are first exposed. This also raises high-risk classification questions, so do not use a template for it.
Step 4: Write it down
Keep one row per touchpoint with these columns:
| Column | What to put |
|---|---|
| Client and property | Name and URL |
| Touchpoint | What the AI does |
| Obligation | 50(1), 50(2), 50(3) or 50(4) |
| Your role | Provider, deployer, or unclear |
| Exception claimed | If any, and why |
| Fix applied | What changed |
| Date | When |
| Evidence | Link or screenshot |
If a client's lawyer or a regulator asks later, that table answers in minutes. Sending the client a short note about what you changed also shows them the work was done.
Sources
- Article 50 text at artificialintelligenceact.eu
- Regulation (EU) 2024/1689 on EUR-Lex, in particular Article 2 on scope
- European Commission: Code of Practice on Transparency of AI-generated Content