- A chatbot, summariser or copilot in a SaaS product mostly falls under Article 50 transparency rules, which apply from 2 August 2026 and were not delayed.
- The heavy high-risk obligations only hit you if the feature sits in an Annex III area such as hiring, credit scoring, education or biometrics, and that deadline is now 2 December 2027.
- Three things to build in: a clear AI disclosure in the interface, machine-readable marking of generated content, and a documented check of which risk category your feature falls into.
Before you ship an AI feature in a SaaS product, the EU AI Act requires you to work out which risk category the feature belongs to, and then meet the duties for that category. For most chatbots, summarisers and copilots, that means transparency obligations under Article 50: tell people they are dealing with AI, and mark generated content so it can be detected as AI-made. The heavier high-risk rules apply only when the feature is used in a listed sensitive area.
This article walks through what applies to each common feature type, the dates that matter, the fines, and a practical checklist. It is a plain-language engineering guide, not legal advice. Have a lawyer confirm your specific case.
Where the Act stands today
The Commission's own page says the AI Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with some exceptions. From that date, the AI Office and Member State authorities are responsible for implementing, supervising and enforcing it.
Some deadlines moved. The Digital Omnibus on AI is Regulation (EU) 2026/1744. Parliament approved it on 16 June 2026, the Council gave final adoption on 29 June 2026, and it entered into force on 27 July 2026. The same source gives the new high-risk dates: 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.
The key point for SaaS teams: Article 50 transparency was not delayed. Chatbot disclosure and deepfake labelling duties for systems launched from 2 August 2026 stay on that schedule.
Step one: decide which category your feature is in
The annex a feature falls under decides the deadline. Annex III covers biometrics, hiring tools, credit-scoring and education platforms, due 2 December 2027. A chatbot or content-generation feature alone mainly faces Article 50 transparency, which is far lighter.
In practice, look at what the feature is used for. A summariser that condenses meeting notes is a transparency question. A tool that ranks job applicants is a hiring tool, which is an Annex III area. If your customers can point your feature at a sensitive decision, think about that early and write down your reasoning.
What Article 50 actually asks for
Tell people they are talking to AI (Article 50(1))
Per the text of Article 50, providers must design systems that interact directly with people so users are informed they are dealing with an AI system, unless this is obvious to a reasonably well-informed person.
Do not lean on the "obvious" exception. The Commission's FAQ says it should be read restrictively. The same FAQ says that systems working only in the background, through machine-to-machine communication or with no direct contact with people, fall outside the duty. The Commission published guidelines on Article 50 on 20 July 2026, so read those before finalising your wording.
Mark generated content (Article 50(2))
Providers of systems generating synthetic audio, image, video or text must mark outputs in a machine-readable format so they are detectable as artificially generated or manipulated (same Article 50 text).
There is a grace period. Article 50(2) applies from 2 December 2026 instead of 2 August 2026 for systems already on the market at 2 August 2026. New systems must comply when they are placed on the market. If you are launching a new feature, plan for marking from day one.
The human-review carve-out
The Article 50(4) text-disclosure duty does not apply where AI-generated content has undergone human review or editorial control and a person holds editorial responsibility for publication. This matters for features that draft text which a human then edits and publishes. If you want to rely on it, make sure a named person actually holds that editorial responsibility.
The voluntary Code of Practice
In a press release on 10 June 2026, the Commission said the final Code of Practice on marking and labelling AI-generated content is voluntary. It helps providers and deployers of generative AI meet the transparency obligations that apply from 2 August 2026. It is a useful reference for your implementation, even though following it is optional.
What applies to a chatbot, summariser or copilot
The table below is a working guide based on the Article 50 text and the Commission's FAQ. Where the answer depends on the facts, it says so.
| Feature | Art. 50(1) AI disclosure | Art. 50(2) output marking | High-risk rules |
|---|---|---|---|
| Customer-facing chatbot | Yes, users talk to it directly | Yes, if it generates text | Only if used in an Annex III area |
| Summariser shown to users | Judgement call, check the Commission's guidelines | Yes, if it generates text | Only if used in an Annex III area |
| In-app copilot that drafts content | Yes, it interacts directly with users | Yes, if it generates synthetic content | Only if used in an Annex III area |
| Background classifier or tagger with no user contact | No, outside the duty | Depends on whether it generates synthetic content | Only if used in an Annex III area |
| Candidate ranking, credit scoring, exam grading | Only if users interact with it directly | Depends on whether it generates synthetic content | Yes, due 2 December 2027 |
The summariser row is a judgement call, which is why it is worth documenting. The test in the text is direct interaction and whether the AI nature is obvious. Write down why you chose the wording you did and which parts of the guidelines you relied on.
When the heavy rules do apply
If your SaaS serves hiring, credit, education or biometric use cases, you are in Annex III territory, and the deadline is 2 December 2027. Start early if the product will need risk management, documentation and human oversight built in.
One duty stayed intact through the Omnibus changes. For high-risk systems, the duty to train staff for human oversight (Article 26) is unchanged, per the Article 4 and 26 summary.
AI literacy: softened, not removed
The Omnibus kept the AI literacy duty but removed any requirement to guarantee a specific level of literacy for any individual. In practice, keep doing basic training for the people who build, configure and support AI features, and keep a short record of what you did.
What breaking the rules costs
Fines have three tiers, per this breakdown:
- Prohibited practices (Article 5): up to EUR 35 million or 7%.
- Article 99(4) obligations: up to EUR 15 million or 3%.
- Supplying incorrect, incomplete or misleading information to authorities: up to EUR 7.5 million or 1%.
Article 50 transparency breaches fall in the middle tier. That tier is EUR 15 million or 3%, whichever is higher, but the lower figure applies to SMEs and small mid-caps. If you are an SME, the lower figure is the one that applies to you.
A pre-launch checklist
- Classify the feature. Write one paragraph: what it does, who uses it, and why it is or is not in Annex III.
- Add the disclosure. A visible label or first-message notice in any chat or copilot interface. Do not rely on it being "obvious".
- Mark outputs. Add machine-readable markers to generated text, images, audio or video. Check the voluntary Code of Practice for guidance on marking and labelling.
- Set up human review if you want the Article 50(4) carve-out for published text, with a person who holds editorial responsibility.
- Log your decisions. Keep a record of how you classified the feature and why. Incorrect or misleading answers to authorities carry their own fine tier.
- Train the team on how the feature works and where it can fail.
- Re-check the Commission's Article 50 guidelines against your final wording.
How this plays out in a build
A disclosure string, an output marker and a classification note are small tasks to include early. Adding them after launch means touching the interface, the API and the documentation at once.
If you are planning an AI feature, see our AI development page. Our project planner can help you scope it, and our software development page covers the wider build.
FAQ
Do I have to label a chatbot as AI?
Yes, if it interacts directly with people, unless it is obvious to a reasonably well-informed person that they are dealing with AI. The Commission says that exception should be read restrictively, so label it. Systems with no direct contact with people fall outside the duty.
Was Article 50 delayed by the Digital Omnibus?
No. Chatbot disclosure and deepfake labelling duties for systems launched from 2 August 2026 stay on schedule. The only grace period is for output marking under Article 50(2): systems already on the market at 2 August 2026 have until 2 December 2026. New systems must comply when placed on the market.
Is my AI copilot high-risk?
Only if it is used in an Annex III area such as biometrics, hiring, credit scoring or education. A copilot that drafts emails or summarises documents mainly faces Article 50 transparency. If customers can use it for hiring or credit decisions, treat that as a flag and assess it before launch.
