A physiotherapy clinic adds a chat window to its booking page. A language school makes a short promotional video with an AI voice. A training company puts a striking photo of a full classroom on its homepage, and nobody mentions that the classroom never existed. Each of these takes an afternoon with today's tools, and each now sits under a European rule that many owners have only half heard about.
The rule is Article 50 of the EU AI Act. It is about one simple thing: people should know when they are talking to a machine, and when a picture, a voice or a video that looks real was made or changed by AI. Most of what is written about it comes from people selling a compliance tool, so the result is a mix of panic and shrugging. Some owners now put "made with AI" on every caption. Others assume a law about artificial intelligence is only for the companies that build it.
This article puts real situations side by side: what using AI without thinking about the rule looks like, and what the same thing looks like done well. It is not legal advice, and a lawyer in your country gives the final word on a borderline case. It is a practical map, so you know where you stand and what to change this month.
What the rule actually says
The AI Act is an EU Regulation, Regulation (EU) 2024/1689, so it applies directly in every member state. Its Article 50 sets out what the Act calls transparency obligations. According to the European Commission's own summary, they apply from 2 August 2026.
There are four of them, and two different people carry them:
- The companies that build AI systems (the Act calls them providers) must design a chatbot so people are told they are interacting with AI, and must mark AI-generated audio, images, video and text in a machine-readable way, so software can detect it.
- The businesses that use AI systems (the Act calls them deployers) must disclose deepfakes, must label AI-written text published to inform the public on matters of public interest when no person reviewed it and took editorial responsibility, and must tell people when they are exposed to emotion recognition or biometric categorisation.
An update to the Act, Regulation (EU) 2026/1744, gave providers of generative systems already on the market before 2 August 2026 until 2 December 2026 to add the machine-readable marking. That extra time is for the companies behind the tools. It does not move the duties of the businesses that use them.
Provider or deployer: which one you are
Most small businesses are deployers. If you write with ChatGPT, make images in an image generator, or produce a voice-over with a speech tool, the company behind the tool is the provider, and you are the business using it.
A chatbot is the case worth a closer look. If you switch on a ready-made assistant from your booking or helpdesk software, its maker is the provider and has to make sure people are told it is AI. If you have a chatbot built for your own site and run it under your own name, you may well count as its provider yourself. Either way the practical answer is the same, and it is cheap: make it plain from the first message that the person is talking to an AI assistant.
The Commission's guidelines on Article 50, published in July 2026, go through who is in scope and give worked examples. They are the right document to open when your own case is close to the line.
Before and after: the chatbot on the booking page
Before. The clinic's chat window opens with "Hi, I'm Anna from reception, how can I help?" and a friendly photo. Anna answers in seconds at three in the morning, never misspells a word and occasionally gives a confident answer about which treatments the clinic offers that is simply wrong. A patient who later discovers Anna was software feels misled, and with good reason.
After. The same assistant opens with "Hello, I'm the clinic's AI assistant. I can help you find a time and answer common questions; for anything about your treatment, I'll pass you to the team." It has a name if you like, and a clear label next to it. It hands over to a person for anything medical, and the hand-over is one tap away.
The second version is what Article 50 asks for, and it also works better. People adjust how they ask when they know it is a machine, and they trust the answers more because nothing was hidden. Article 50 also says the information must be given at the latest at the first interaction, clearly, and in an accessible way. A note buried in the privacy policy does not meet that. I wrote more about what such an assistant should and should not do in an AI assistant that answers your customers.
Before and after: the photo of a class that never happened
Before. A training company needs a homepage image. A generator produces a convincing photo: a bright room, twenty attentive adults, a trainer at a whiteboard with the company's logo on the wall. It goes live with no comment. Visitors take it for a photo of a real course.
After. The company asks one question first: would a reasonable visitor believe this shows a real event? Here the answer is yes, so the image is either replaced with a real photo from a real session or published with a clear "AI-generated image" label on the image itself.
This is the heart of the deepfake duty. The Act defines a deepfake as AI-generated or manipulated image, audio or video that resembles real people, objects, places, entities or events and would falsely appear to be authentic. It is not limited to faking a politician. A realistic picture of a workshop, a team or a finished job that never happened can meet the definition. An obvious illustration, a drawn icon or a stylised background does not pretend to be real, and generally falls outside it.
Before and after: the voice that is not the director's
Before. A language school makes a video in which the director's voice, cloned with a speech tool, welcomes new students in four languages the director does not speak. It is impressive, and every viewer assumes the director recorded it.
After. The school makes the same video and adds a short line on screen at the start: "Voice generated with AI." The video loses none of its charm. Viewers who care can see it straight away, and the director's real voice stays something people can trust.
Where content is part of an evidently creative, satirical or fictional work, such as a cartoon advert or a clearly playful sketch, the Act still asks for disclosure, but in a way that does not spoil the work. A clear credit may be enough there. A realistic message from a real person is not that case, and deserves the plain label.
Before and after: the article nobody read before it went out
Before. A service company publishes a weekly news post for its clients about rule changes in its sector. An AI tool writes it from a few links, and it goes out automatically every Monday without anyone reading it.
After. A named person at the company reads every post before it goes out, corrects it and decides whether it is published. That is the condition the Act gives for this duty: AI-written text published to inform the public on matters of public interest needs a label unless it went through human review or editorial control and someone holds editorial responsibility for it.
So the cheapest way to meet this part is also the right one: keep a person in charge of what goes out under your name. That protects you from more than a regulator. It protects you from publishing something confidently wrong about a rule your clients rely on.
What the Commission has published to help
The Commission has published three things that make this easier. The Code of Practice on marking and labelling AI-generated content, published on 10 June 2026, is voluntary and sets out practical steps for providers and deployers. The Commission has also published free EU icons for labelling AI-generated content, so you do not need to design your own badge. And the guidelines on Article 50 explain the scope with examples.
None of them requires a paid tool. For a small business, a consistent short label and a habit of asking "would someone take this for real?" covers most of the ground.
What does not need a label
Plenty of everyday AI use needs no label under Article 50:
- Ordinary editing. Fixing grammar, tidying a paragraph, brightening a photo or removing a background generally does not create a deepfake or change the meaning.
- AI-assisted text you review. A service description, an e-mail or a blog post that a person reads, edits and takes responsibility for does not need a label under the public-interest text rule.
- Illustrations that do not pretend to be real. An icon, a drawing or an obviously artificial background is not presented as authentic.
- Content from before 2 August 2026. The Commission says there is no mandatory retroactive labelling, although it encourages it for deepfakes.
Labelling everything is not more honest; it only teaches people to ignore the label. Keep it for the cases where it tells them something.
Where the label goes, and when
Article 50 asks for the information to be clear and distinguishable and given at the first interaction or exposure. In practice:
- On an image, put the label on the image itself rather than only in a caption, so it survives when the image is shared or cropped from the post.
- In a video or audio clip, say it at the start, on screen or in the first seconds, not only in the description underneath.
- In a chat, say it in the first message and keep a small label visible next to the assistant's name.
- For everyone, make the label readable: enough contrast, real text a screen reader can announce, and wording a person understands at a glance.
That last point connects to the European Accessibility Act, which I wrote about in a site and app everyone can use. A label that some visitors cannot see does not do its job.
Keep the marks the tools add
The companies behind image, video, voice and text tools are required to add hidden, machine-readable marks to what their tools produce. Those marks help platforms and readers recognise AI content later. Keep your original files, avoid tools whose whole purpose is to strip that information, and when a designer or an agency makes content for you, ask which parts were generated and keep that answer with the file.
A simple folder habit helps more than any software: the original AI output, the edited version you published, and a one-line note of which tool made it. If a client, a partner or an authority ever asks, you can answer in a minute.
One page of rules for your own team
The rule becomes easy once a few decisions are written down, so nobody has to guess on a busy afternoon. One page is enough:
- which AI tools the business uses, and for what;
- the wording of your labels for images, video, voice and chat;
- who reads AI-written text before it goes out under the company's name;
- what never goes out without a person checking it: anything about health, money, contracts or legal rights.
The same page fits naturally next to the rules on which company data may go into AI tools at all, which I covered in your staff already paste company data into ChatGPT.
What it does not change, and what I would do this month
Article 50 does not ban AI-generated content, does not require you to stop using AI tools, and does not ask a small business to buy watermarking software. The marking inside the files is the tool makers' job.
What it changes is the default. Content that could be taken for real, a voice that could be taken for a person, and a chat that could be taken for a human now come with a plain statement of what they are. The Commission's summary gives fines of up to €15 million or 3 per cent of worldwide annual turnover for breaches, with proportionality for small companies; that is a reason to take the rule seriously, not to panic about it.
If I were setting this up for a small business this month, I would do it in this order: label the chatbot in its first message, go through the homepage and the social profiles for realistic images and voices that need a label or a real replacement, put a named person in charge of AI-written articles, and write the one-page rules. Each step is small, and together they give you a site and a feed that people can trust.
Is your chatbot, your site or your feed clear about what AI made?
Discuss your projectTell me where you use AI with your customers, and I will tell you what I would label first.