The EU AI Act's chatbot rule started five days ago. My own plugin was breaking it.

I sell a WordPress chatbot plugin. Its default welcome message was:

Hello! How can I help you today?

On 2 August 2026, Article 50 of the EU AI Act — Regulation (EU) 2024/1689 — started applying. It requires that a person interacting with an AI system be informed that they are, before or at the very beginning of the interaction.

"Hello! How can I help you today?" informs nobody of anything. I shipped the fix five days late, which is five days better than I would have managed if I had not been reading the regulation for a different reason.

Here is what the rule actually says, the exemption everyone is about to reach for, and the part of it that nobody mentions.

What Article 50(1) requires

The text is short. Providers of AI systems intended to interact directly with natural persons must design and develop them so that those persons are informed they are interacting with an AI system — unless that is obvious to a reasonably well-informed, observant and circumspect person.

Two things in that sentence are easy to skim past.

It is a design obligation, not a disclosure form. The duty is to build the system so the person is informed. That is a different instruction from "put a notice somewhere". For anyone shipping software that other people deploy, it points at the default rather than the settings screen.

It falls on the provider. Who counts as the provider of the AI system in a chain that runs from a model vendor through a plugin to a site owner is a real question with a real answer, and I am not qualified to give it for your case. What I can say is the engineering consequence, which does not depend on the answer: if the obligation lands anywhere in that chain, the cheapest place to satisfy it is the default that ships.

Article 50(5) adds that the information must be provided in a clear and distinguishable manner at the latest at the time of the first interaction. Not in the terms of service. Not two turns in.

Penalties for the transparency obligations reach €15 million or 3% of total worldwide annual turnover, whichever is higher.

The exemption, and why it is narrower than it sounds

"Unless this is obvious" is doing a lot of work, and it is where most people will stop reading.

The test is not whether you think it is obvious. It is whether it is obvious to a reasonably well-informed, observant and circumspect person — a standard that assumes ordinary attention, not expertise. A widget labelled "AI Assistant" in a header probably clears it. A round purple bubble in the corner of a shop, which greets you by name and answers in fluent prose, probably does not: half the point of building it well was that it does not feel like a robot.

I kept the exemption available in the plugin, because it is real and it is the site owner's judgement to make. But I made the settings screen say what it costs to be wrong, and I did not present it as an ordinary preference sitting next to the colour picker.

The part nobody mentions

Article 50(5) also says the information shall conform to the applicable accessibility requirements.

So the notice telling someone they are talking to an AI has itself to be perceivable by that someone. A grey-on-grey line at 3:1 contrast, or a visual badge with no accessible name, technically discloses and practically does not.

I make an accessibility scanner as well, which is the only reason I noticed. I measured the contrast of my own disclosure rather than eyeballing it: 6.92:1 against the panel, where the requirement is 4.5:1. That took two minutes and it is the kind of thing that is embarrassing to skip in exactly this context.

What it actually took to ship

The disclosure itself is four lines of markup. The decisions around it were the work, and three of them are the sort of thing you only find by getting them wrong first.

It renders outside the message log. My first instinct was to make it the first chat bubble. Two reasons that is wrong. The message area carries role="log" with aria-live, so anything inside it is announced as conversation — the disclosure would arrive as though the bot had said it, which is precisely the framing that makes it not a disclosure. And the log scrolls, so after four exchanges the notice is gone. It now sits between the header and the log: outside the live region, outside the scroll.

The launcher carries it too. A screen reader user meets the button before anything else, and aria-label="Open chat" tells them nothing about what they are about to open. It now reads "Open chat with the AI assistant". If the disclosure is switched off, so is that wording — the two should never disagree.

It is on by default for sites that merely update. This is the one I nearly shipped broken. Updating a WordPress plugin does not fire the activation hook, so the routine that seeds default options never runs for an existing install. A new option would have been absent, read as falsy, and the disclosure would have been silently off for every existing customer — the exact population most likely to have the plugin already running on a live EU storefront. Both accessors now default to showing it, and an empty custom text falls back rather than rendering nothing. I verified it by deleting both options and reloading the front end.

The switch is a <select>, not a checkbox. An unchecked checkbox is absent from the POST body entirely. register_setting never sees the key, so the stored option keeps its previous value: turning the disclosure off would have appeared to work and silently not. Every other boolean on that screen was already a select, for exactly this reason, and I had forgotten why.

If you run a chatbot on a site

Four things worth checking this week, none of which require you to trust my reading of the regulation.

Open your own chat widget as a visitor. Read the first thing it says. If it does not tell you it is an AI, nothing else in your setup does either.

Check the button that opens it, not just the panel. That is where a screen reader user makes the decision.

Check whether the notice survives the conversation. If it scrolls away with the first few messages, it satisfies "at the beginning" and nothing more — which may be enough, but decide that deliberately.

Check its contrast. 50(5) is explicit about accessibility, and this is the one part of the obligation with a number attached to it.

What I am not telling you

Whether the obligation reaches you at all. That depends on where you operate, who your visitors are, and where you sit in the chain between a model and a conversation. I am a developer who read the regulation because it broke my own product; I am not a lawyer, and this is not legal advice.

What I am reasonably confident about is narrower: a default greeting that says "Hello! How can I help you today?" does not inform anyone that they are talking to a machine, and no reading of Article 50 makes that sentence sufficient.

Mine said it for two days after the rule applied. Yours might still.