EU AI Act Article 50: Your WordPress Chatbot Must Say It Is AI by August 2
The transparency rules become enforceable this Sunday. They reach well outside the EU — and almost no WordPress chatbot plugin complies out of the box, including ours.
On 2 August 2026 — this Sunday — the transparency obligations in Article 50 of the EU AI Act become enforceable. If your WordPress site runs an AI chatbot and people in the EU can use it, the rule that matters to you is short: the person on the other end has to know they are talking to a machine.
That is a settings change, not a project. The reason it is worth twenty minutes of your Saturday is that most chat plugins ship a friendly, human-sounding greeting by default, and a friendly, human-sounding greeting is precisely the thing the article is aimed at. We checked our own chatbot before writing this, and as configured it would not have satisfied the requirement either. More on that below.
The short version
- Deadline: 2 August 2026. No transition period for Article 50(1).
- Requirement: people must be informed they are interacting with an AI system, at or before the first interaction.
- Reach: extraterritorial. Being based in the US or UK does not take you out of scope.
- Penalty tier: up to €15 million or 3% of worldwide annual turnover — not the €35 million / 7% figure being widely repeated.
- Effort: for most WordPress owners, one line of text in a plugin setting.
What Article 50 actually says
It is worth reading the operative sentence rather than a summary of it, because the exact wording decides several arguments people are currently having. Article 50(1):
Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use.
And Article 50(5), which sets the timing and the standard of presentation:
The information referred to in paragraphs 1 to 4 shall be provided to the natural persons concerned in a clear and distinguishable manner at the latest at the time of the first interaction or exposure.
Two things follow immediately. First, “at the latest at the time of the first interaction” means the disclosure cannot live in your terms of service, your privacy policy, or a page the visitor would have to go looking for. It has to be in front of them when the conversation starts. Second, “clear and distinguishable” is a presentation standard, not just a content standard — grey six-point text under the send button is not a good-faith reading of it.
The penalty figure most coverage is getting wrong
You will see €35 million or 7% of global turnover attached to this deadline in a lot of write-ups. That is the AI Act’s top penalty tier, and it does not attach to Article 50. Transparency breaches sit in the lower band: up to €15 million, or 3% of total worldwide annual turnover, whichever is higher.
This is not a reason to relax. For most WordPress businesses the practical exposure was never going to be a headline fine anyway — it is a complaint from a user, a procurement questionnaire you cannot answer, or an enterprise customer’s legal team asking for evidence. But if you are budgeting attention, it helps to know which number is real. Quoting the wrong tier at your own board is an avoidable way to lose credibility.
Why this reaches WordPress sites outside the EU
The AI Act applies to providers placing AI systems on the EU market, and it also reaches non-EU providers where the use of the system’s output in the EU is foreseeable. A public chat widget on a public website is about as foreseeable as it gets: you are not choosing who visits.
The practical test is not where your company is registered. It is whether EU residents can reach your chatbot. If your site is publicly accessible, sells to the EU, has EU customers, or simply gets EU traffic, assume you are in scope. Geo-blocking the widget for EU visitors is technically an answer, but it is a worse one than adding a sentence.
Are you the “provider” or the “deployer”? The part most guides skip
Article 50(1) binds providers. Most WordPress site owners running an off-the-shelf plugin are, on the face of it, deployers. That distinction gets glossed over constantly, and it deserves a straight answer.
| Role | Definition (Article 3) | Typical WordPress case |
|---|---|---|
| Provider | Develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, for payment or free of charge. | The plugin vendor. Also, arguably, you — if you white-label the widget under your own brand. |
| Deployer | Uses an AI system under its authority, except in the course of a personal, non-professional activity. | A business running a chatbot plugin on its site under the vendor’s branding. |
A point worth being precise about, because it is misreported: Article 25 — the provision that converts a deployer into a provider when they put their name on a system or substantially modify it — is scoped to high-risk AI systems. A customer-support chatbot is not high-risk; it is a transparency-obligation system. So Article 25 does not automatically make you a provider just because you renamed the widget.
That said, three things make the distinction a weak place to plant your flag. The definition of provider in Article 3(3) turns on putting a system into service under your own name or trademark, and that is exactly what renaming the widget “Acme Assistant” looks like. Deployers carry their own transparency duties under Article 50(4) for AI-generated content published to the public. And most decisively: the vendor cannot comply on your behalf. The plugin can ship a sensible default, but you are the one who edits the greeting, and if you replace it with something that reads as a person, no amount of upstream design saves it.
If your compliance strategy is a definitional argument about which noun you are, you are spending more on the argument than the fix costs.
“But it is obviously a bot” is a weaker defence than it sounds
Article 50(1) does carve out cases where AI involvement is obvious to a reasonably well-informed, observant and circumspect person, taking into account the circumstances and the context of use. People read that clause and conclude that everyone knows website chat widgets are bots.
Consider what the exemption is actually asking. Your widget probably carries your company’s name, opens with a warm first-person greeting, and may show an avatar. Many of them offer to fetch a human. That design exists to feel personal, which is the opposite of making machine involvement obvious — and the models behind them in 2026 hold a casual conversation well enough that the old tells are gone. A support widget that answers in fluent, contextual prose is a poor candidate for “obvious.”
There is also an asymmetry worth noticing. If you rely on the exemption and you are right, you saved one sentence. If you rely on it and you are wrong, you are defending a judgement call about your own users’ sophistication. That is a bad trade at that price. Our own view is that if you are weighing whether the exemption covers you, that hesitation is the answer.
We checked our own chatbot first, and it would have failed
Before publishing advice, we pulled the live configuration of the chatbot on this site. Here is what it was actually serving:
| Surface | What it said | Discloses AI? |
|---|---|---|
| Opening message | “Hi there! I’m here to help with all things MxChat — from discounts and product info to technical questions and setup guidance!” | No |
| Pre-chat bubble | “Hey! Want 15% OFF? Just ask me for it — seriously, that’s it!” | No |
| Widget header | “MxChat” | No — a brand name is not a disclosure |
| Privacy notice | “By chatting, you agree to our privacy policy.” | No — that is a data-protection notice, a different obligation |
Four surfaces, four opportunities to say “this is an AI assistant,” and none of them did. The privacy notice is the instructive one: it is enabled, it renders before the conversation, and it is doing a completely different job. Having a notice is not the same as having this notice.
The factory defaults are no better, and this is the part that generalises beyond us. A fresh install ships intro_message as “Hello! How can I assist you today?” — a sentence with no machine in it — and the privacy-notice toggle defaults to off, so a brand-new install displays no standing notice at all until someone turns it on.
That is not a criticism aimed at one plugin. It is roughly what every chat plugin ships, because until this Sunday there was no reason to ship anything else, and a greeting that sounds like a person tests better. The conclusion for site owners is the one that matters: “I installed a reputable plugin” is not a compliance position. Nobody’s defaults were written against this deadline. Go and look at yours.
The fix, concretely
In order of reliability:
- Put it in the opening message. This is the strongest placement because it renders before the visitor types anything, which is exactly the Article 50(5) timing test, and it survives theme changes and mobile layouts.
- Add it to the widget header. Persistent, visible for the whole conversation, and useful for anyone who scrolls back. Weak on its own — a header is easy to overlook — but good reinforcement.
- Turn on the pre-chat notice and make it carry the disclosure, not just a privacy-policy link. If you already display a notice for data protection, extend it; do not assume it counts as-is.
For MxChat specifically, the relevant settings are these:
| Setting | Ships as | Suggested change |
|---|---|---|
intro_message | “Hello! How can I assist you today?” | “Hi — you’re chatting with an AI assistant. How can I help?” |
top_bar_title | Your brand name | “<Brand> AI Assistant” |
privacy_toggle | off | on |
privacy_text | Privacy-policy link only | Lead with the AI disclosure, keep the policy link after it |
Whatever plugin you run, the names will differ but the surfaces will not: there is a first message, a header, and usually a notice slot. If you are still choosing a plugin, this is now a reasonable thing to evaluate them on — see our comparison of WordPress chatbot plugins, and the MxChat core documentation for where these settings live.
What a compliant disclosure looks like
| Works | Does not work |
|---|---|
| “You’re chatting with an AI assistant.” | “Powered by advanced technology.” |
| “This is an automated AI chat. Ask for a human any time.” | A disclosure that appears only after the user’s first message. |
| Named bots that stay honest: “I’m Ada, an AI assistant.” | A human first name and photo with no other signal. |
| Disclosure in the visitor’s language on a multilingual site. | Disclosure in your terms of service or privacy policy only. |
You do not need legal register. “You’re chatting with an AI assistant” is clearer than any paragraph a lawyer would draft, and clarity is the actual standard. Nothing stops you from adding useful context — what it can do, how to reach a person — and users tend to prefer bots that are upfront, which is the rare case where the compliant version is also the better product. If you are weighing that trade-off seriously, our piece on AI chatbots versus human agents covers where the handoff belongs.
Clear, distinguishable — and accessible
Article 50(5)’s “clear and distinguishable” standard comes with accessibility expectations, and this is the part that gets skipped. A disclosure only counts if it is perceivable by the person it is aimed at:
- Meet normal contrast ratios — do not style it as de-emphasised fine print.
- Do not rely on colour or an icon alone. A small robot glyph is not a statement.
- Keep it in the accessibility tree. If the disclosure is decorative markup or hidden with
aria-hidden, a screen-reader user never receives it. - Translate it. If your site serves multiple languages, an English-only disclosure is not clear to a French visitor — and the EU is the jurisdiction in question.
If accessibility is already on your list this year, the two efforts overlap; our guide to ADA compliance plugins for WordPress covers the tooling.
Your checklist before Sunday
- Open your site in a private window and start a chat as a visitor would. Read what it actually says — not what you remember configuring.
- Add an AI disclosure to the opening message. This is the one that matters.
- Rename the widget header to include “AI” if it currently reads as a person or a bare brand name.
- Check whether your pre-chat notice is enabled, and whether it says anything about AI as opposed to data protection.
- Test on mobile, where truncation quietly removes text you assumed was visible.
- Check any second chatbot — a WooCommerce assistant, a docs bot, a support widget on a subdomain. Each is a separate surface.
- Screenshot the result and date it. If anyone asks later what you did and when, that file is the answer.
Two later dates are worth diarising while this is in front of you: 2 December 2026, when Article 50(2) marking obligations extend to systems already on the market, and 2 February 2027, the watermark-interoperability date for signatories to the associated Code of Practice. Neither changes what you should do this week.
If you are still budgeting a chatbot rather than adjusting one, our breakdown of what a chatbot actually costs is the companion piece — and if you are wondering whether WordPress core’s new AI layer changes the picture, we covered that in WordPress 7.0 put AI in core.
One sentence, one afternoon
Article 50 is the rare regulation whose core requirement is smaller than the effort of reading about it. Open your chatbot settings, put “you’re chatting with an AI assistant” where a visitor sees it first, and you have addressed the substance. We have filed the change for ours.
See how MxChat works on WordPressThis is practical guidance from a WordPress plugin team, not legal advice; if your exposure is significant, have counsel review your specific setup.
Disclosure is not the only deadline on the calendar. OpenAI shuts down two more chat models on 10 August 2026 — here is how to check whether your chatbot is pointed at one of them.
