AI disclosure notices for your website under EU AI Act Article 50

Short answer: Since 2 August 2026, any website serving visitors in the EU that runs an AI chatbot, publishes AI-generated or manipulated images, audio, video or public-interest text, or uses emotion recognition must inform those visitors clearly, at the first interaction, in a form they can perceive. CookieTrace's AI Disclosure Module delivers that notice from the same script as your cookie banner, in the visitor's language, and records every display as a timestamped event alongside your consent logs. It covers the disclosure duty; it does not watermark content — that remains the duty of the AI provider whose model you use.

What Article 50 asks of a website operator

  • Article 50(1) — AI chatbots and assistants: visitors must be told they are interacting with an AI system, unless this is obvious to a reasonably informed person. The duty sits with the provider of the system, but as the operator of the site you are the one who decides whether the notice is actually visible to your visitors.
  • Article 50(3) — emotion recognition and biometric categorisation: people exposed to such systems must be informed of their operation.
  • Article 50(4) — deepfakes and AI-generated text: image, audio or video content that is artificially generated or manipulated must be disclosed as such; AI-generated text published to inform the public on matters of public interest must be disclosed unless it has been through human editorial review.
  • Article 50(2) — machine-readable marking: providers of generative AI systems must mark their outputs in a machine-readable format. Under the Digital Omnibus package, systems placed on the market before 2 August 2026 have until 2 December 2026 for this marking duty. This is the AI vendor's obligation; CookieTrace does not perform watermarking.

Dates that matter

  • 2 August 2026 — Article 50(1), 50(3) and 50(4) apply; the Commission's Article 50 guidelines and the voluntary Code of Practice on transparency are in force.
  • 2 December 2026 — end of the grace period for machine-readable marking (Article 50(2)) for generative systems already on the market before 2 August 2026.
  • Penalties for transparency breaches: up to EUR 15 million or 3% of worldwide annual turnover, with proportionality for SMEs.

What the AI Disclosure Module does

  • Shows a disclosure notice for three situations: an AI chatbot or assistant on the page, AI-generated or manipulated media, and emotion-recognition features.
  • Displays the notice in the visitor's language (the same languages as your CookieTrace banner) at the first interaction, with wording you can edit.
  • Logs every display as a timestamped event in the same audit trail as your consent records, so you can show when, where and in which language a visitor was informed.
  • Runs from the existing CookieTrace script — no additional vendor tag, no change to your Consent Mode v2 setup.
  • Keeps an AI inventory in the dashboard: which pages use which AI feature, and which notice is attached to it.

What it does not do

  • It does not apply machine-readable marks or watermarks to generated content (Article 50(2)); your AI provider is responsible for that.
  • It does not classify your AI system as high-risk or assess Annex III obligations.
  • It is a technical control that documents disclosure; it is not legal advice. Whether a specific use is in scope of Article 50 is a question for your counsel.

Set-up in three steps

  1. In the dashboard, list the AI features on your site (chatbot, generated media, emotion recognition) and the pages or paths where they appear.
  2. Choose or edit the notice text for each language your site serves.
  3. Publish. The notice is delivered by the CookieTrace script already installed; each display is logged automatically.

Who is in scope — including outside the EU

Article 50 applies to AI systems placed on the EU market and to deployers whose output is used in the EU. A company in Türkiye, the UAE or Saudi Arabia that serves EU visitors with an AI chatbot or AI-generated content is therefore within scope, in the same way GDPR already applies to its EU visitors. CookieTrace runs the AI disclosure notice and the cookie consent banner from one script, so KVKK, GDPR and Article 50 obligations are handled on the same page with one audit trail.

Frequently asked questions

Does Article 50 apply if my chatbot is clearly labelled "AI assistant"?

If it is obvious to a reasonably informed person that they are talking to an AI, the Article 50(1) duty is considered met. Many operators still show an explicit notice at the first message to remove doubt and to have a logged record.

Do I need to label every image created with AI?

Images, audio or video that are artificially generated or manipulated and could be mistaken for real must be disclosed as AI-generated. Obvious creative or satirical uses have limited disclosure duties. Content generated before 2 August 2026 does not require retroactive labelling.

Is CookieTrace responsible for watermarking?

No. Machine-readable marking (Article 50(2)) is the duty of the provider of the generative model. CookieTrace provides the visible disclosure to the visitor and the record that it was shown.

Does the module need a separate script?

No. It runs from the CookieTrace script that already serves your consent banner.

Are the disclosure events stored with my consent records?

Yes. Each display is logged with timestamp, page, language and notice version, in the same audit trail used for consent, and can be exported.

Which plans include the AI Disclosure Module?

It is available on all CookieTrace plans; see plans and pricing below.

Plans and pricing

The AI Disclosure Module is available on every CookieTrace plan.

  • Pro — $39/month; 10 domains
  • Premium — $79/month; 100 domains
  • Enterprise — Custom pricing; Unlimited domains

Sources