Article 50 Guide for Agencies

Does the EU AI Act apply to chatbots you build for clients?

Last reviewed 13 October 2026

Short answer. Probably yes, if people in the EU can use the chatbot, wherever you and the client are based. Which duties are yours depends on whether you count as the provider (you built or supplied the system) or the deployer (you run it).

Where the rule reaches

The AI Act is not limited to companies based in the EU. Article 2 extends it to providers and deployers outside the EU when a system is placed on the EU market or when its output is used in the EU. A chatbot on a US client's website that visitors from Germany or France can open and use is a realistic example.

Whether a given site counts as offered in the EU can be a judgment call. If you don't geo-block and the site accepts EU visitors, the safe assumption is that it is in scope.

Provider or deployer?

Article 50 splits its duties between two roles, so the first job is working out which one you are. Article 3 defines them:

Here is how that tends to play out for agencies.

What you did Likely role Worth knowing
Embedded and configured a vendor's chatbot on a client site, under the vendor's name Deployer. The vendor is the provider. You still control the widget text, so check what the vendor shows by default.
Built a bot with your own code on top of a model API and handed it to the client Possibly the provider of that chatbot The model company is the provider of the underlying model. The chatbot you built on top can be a separate system with you as its provider.
Took a vendor's white-label bot and sold it under your agency's brand Possibly a provider Putting your own name or trademark on a system is part of the definition.
Run a client's existing bot day to day Deployer, or an operator acting for one Your contract should say who is responsible for what.

These are common readings, not settled answers. Article 3 gives the definitions, but how they fit agency arrangements is still being worked out. When your role is unclear, treat yourself as responsible for the disclosure.

What Article 50 asks of a chatbot

Article 50(1) says AI systems meant to interact directly with people must be designed so that those people are told they are dealing with an AI system. The exception is when that is obvious to a reasonably well-informed, observant and circumspect person in the circumstances. Article 50(5) adds that the information has to be clear, distinguishable, and given at the latest at the first interaction.

The 50(1) duty sits with the provider. Deployers have their own duties in 50(3) (emotion recognition and biometric categorisation) and 50(4) (deepfakes and certain AI-written text).

So if you only deploy someone else's bot, the legal duty to build disclosure in belongs mainly to the vendor. In practice the widget header and the welcome message are settings you control, and a client's lawyer will ask you why they are missing, not the vendor. That is why most agencies are better off adding the disclosure themselves than waiting on a vendor.

What to do this week

  1. List every chatbot and voice agent you run for a client, and note whether people in the EU can reach it.
  2. For each one, write down your role: provider, deployer, or unclear.
  3. Put the disclosure in the widget header and in the bot's first message. The wording guide has examples.
  4. If a vendor supplies the bot, ask them in writing what they do to meet Article 50(1). Keep the answer.
  5. Take a dated screenshot of the live widget.

Penalties

Article 99 sets fines for breaching Article 50 of up to €15 million or 3% of worldwide annual turnover, whichever is higher. For small and medium-sized businesses the cap is whichever of the two is lower. National authorities enforce the Act and the practice is new, so nobody can say yet how strictly Article 50 will be policed.

Sources