AI Disclosure Rules 2026: What You Must Label on Your Website — and What You Don't

The EU AI Act’s transparency obligations have applied since August 2, 2026. Since July 29, 2026, Germany has an authority to enforce them: the KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG), Germany’s AI Act implementation law, makes the Bundesnetzagentur the national coordinator as well as the market surveillance, contact and complaints authority. Ever since, the same question keeps coming up in client conversations: do I now have to stamp “AI” somewhere on my website?

The most common answer is wrong — in both directions. Some businesses put a precautionary AI notice under every blog post they don’t need to label. Others run a chatbot that behaves like a human, which is exactly what no longer works.

This post is not legal advice — I’m a web designer, not a lawyer. But I build websites for small businesses, and I read the regulation the way it has to be implemented: as a question about which sentence, which page, and which line of code needs to change. That’s what this is about.

What Has Applied Since August 2, 2026

The relevant provision is Article 50 of the AI Act (Regulation (EU) 2024/1689). It contains no blanket “AI labelling duty” — instead, four clearly separated obligations with different addressees. This is where most guides get imprecise.

Paragraph	What	Who it binds
Para. 1	AI systems interacting directly with people (chatbots, voice assistants) must identify themselves as AI	Providers
Para. 2	Synthetic audio, image, video and text output must be marked in machine-readable form	Providers
Para. 3	Emotion recognition and biometric categorisation	Deployers
Para. 4	Disclose deepfakes (image, audio, video only) · disclose AI text on matters of public interest	Deployers

A “deployer” under Article 3(4) is anyone “using an AI system under its authority.” That’s you the moment you put a finished tool to professional use.

“Provider” is where it gets interesting — and where nearly every guide goes wrong. Article 3(3) defines it as someone who develops an AI system, or has one developed, and “places it on the market or puts the AI system into service under its own name or trademark.” And “putting into service” expressly covers supply “for own use” under Article 3(11).

In plain terms: a provider isn’t only someone who sells software. If you assemble your own AI assistant — on a language model API, say — and run it under your own company name on your own website, you are the provider of that system. Paragraph 1 then binds you directly. More on that below.

That leaves the pure deployer obligations: paragraph 3 only matters if you run emotion recognition or biometric categorisation, which no ordinary business website does. Which leaves paragraph 4.

The Timeline, Briefly

The so-called Digital Omnibus pushed back several AI Act deadlines in late 2025, mostly in the high-risk category. Article 50 was explicitly not among them and has applied since August 2, 2026. There is one transitional rule: the machine-readable marking under paragraph 2 only applies from December 2, 2026 for AI systems already on the market before August 2, 2026. That, too, is a provider obligation — it doesn’t land on your desk.

Two documents published in 2026 matter more in practice than the regulation text itself:

• The Code of Practice on Transparency of AI-generated Content of June 10, 2026 — voluntary, and confirmed by the Commission as an adequate instrument for demonstrating compliance. Among other things, it provides a standardised set of EU icons for labelling.
• The European Commission’s final guidelines on Article 50, published July 20, 2026. They are legally non-binding but serve national authorities as the primary interpretive tool. They interpret the open-ended legal terms — and at the very point that matters for blogs, they stay notably reserved.

One important caveat on the Code of Practice: signing it is not a free pass. It is explicitly not a safe harbour — it only makes it easier to demonstrate that your measures are adequate.

The Decision Tree

Before the detail, the short version. For a typical business website, the question resolves in four steps:

Are you using AI on your website?
│
├─ Chatbot or AI assistant that talks to visitors
│  └────────────────────────────────────────────────► DISCLOSE
│
├─ Image, audio or video
│  ├─ Does it resemble existing persons, places,
│  │  entities or events? → deepfake ───────────────► DISCLOSE
│  └─ Generic subject with no reference to
│     anything real ────────────────────────────────► no duty
│
└─ Text
   └─ Does it inform the public on matters of
      public interest?
      ├─ No: guides, products, pricing, marketing ──► no duty
      └─ Yes
         ├─ human-reviewed + named editorial
         │  responsibility ─────────────────────────► no duty
         └─ published unreviewed ───────────────────► DISCLOSE

For most small websites this tree ends at “disclose” in exactly one place: the chatbot. Why that is, and why the text question is almost always answered no, is what the next three sections cover.

Obligation 1: The Chatbot — the One That Actually Hits You

Article 50(1) requires that people can tell they are talking to a machine. The exception: no notice is needed where this is “obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect.”

The paragraph addresses the provider. Whether that means you depends on how the chatbot got onto your site — and the answer is “yes” more often than most people assume:

How the chatbot got onto your site	Your role	Does para. 1 bind you directly?
Off-the-shelf widget, embedded unchanged	Deployer	No — the duty sits with the provider
Off-the-shelf widget, but branded as yours	Borderline	Probably yes
Your own assistant on a language model API, run under your company name	Provider (Art. 3(3) with 3(11))	Yes

The third case is now the norm on custom-built websites — and that is exactly where paragraph 1 binds you directly.

And even if you stay in the first case, there are three reasons to act:

1. The provider discharges the duty through design — and you can configure it away. Ship the widget with a human first name, a portrait photo and no notice, and you remove the basis for the exception rather than relying on it.
2. The Commission guidelines require dual disclosure for AI agents: the AI nature and the person or entity on whose behalf the agent is acting. The second half can’t possibly come from the provider — that’s you.
3. I wouldn’t rely on the “obvious” exception. It turns on a reasonably well-informed, observant and circumspect person in the specific context of use. For a trade business whose customers average 60 years old, a fluent assistant is not necessarily “obviously” a machine. That’s my assessment, not a statement from the guidelines — but the risk sits with whoever invoked the exception.

Under paragraph 5, the notice must appear at the latest at the time of the first interaction or exposure, in a “clear and distinguishable manner,” and in line with applicable accessibility requirements. That’s the same standard that applies under the European Accessibility Act — a notice a screen reader doesn’t announce is not a notice.

Implementing It

Three things I check on every chat widget:

The first message says it. Not in the imprint, not in a tooltip footnote:

<div role="log" aria-live="polite" aria-label="Chat transcript">
  <p class="chat-system">
    Hi! I'm the AI assistant for Example Ltd and I answer questions
    automatically. If you'd rather speak to a person, I'll connect
    you at any time.
  </p>
</div>

One sentence, both duties covered: AI nature and the entity behind it.

The entry point says it too. Someone who never opens the chat should still be able to tell:

<button
  class="chat-launcher"
  aria-label="Open AI chat with Example Ltd"
  aria-haspopup="dialog"
>
  <svg aria-hidden="true">…</svg>
  <span>AI assistant</span>
</button>

No human façade. No invented first name, no stock photo avatar, no “Anna from customer service.” This is the point where the AI Act and unfair competition law point in the same direction — more on that below.

My recommendation: treat the notice as expectation management, not as a warning label. Users forgive a bot mistakes they would hold against an employee. Disclosing that answers are automated lowers frustration — and the drop-off rate with it.

If you’re planning to go further than a chat widget, disclosure is only the beginning. What happens when AI agents act on visitors’ behalf on your site is covered in the post on the agentic web.

Obligation 2: AI Images — Usually No Duty, Often Misunderstood

There’s a persistent assumption that every AI-generated image on a website has to be flagged as such. That isn’t right.

Paragraph 2 — machine-readable marking — binds the provider. If you generate an image with an image model, embedding watermarks and metadata (for example under the C2PA standard) is the provider’s job. Not yours.

Paragraph 4 obliges you as a deployer to disclose — but only for deepfakes. And Article 3(60) defines that narrowly: “AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events” and would falsely appear authentic. Two things follow. Plain text never falls under the deepfake definition — that’s what the second subparagraph is for. And an image with no reference to anything real is not a deepfake, however photorealistic it looks.

The Commission guidelines add that content may fall outside the definition where the audience doesn’t expect authenticity in the given context. Conversely, advertising, digital replicas of real people and de-aging effects typically do count.

For evidently artistic, creative, satirical or fictional works, paragraph 4 provides relief: there the duty is limited to disclosing the existence of generated content in an appropriate manner that does not hamper the display or enjoyment of the work.

In practice:

Image on your website	Disclosure under Art. 50?
Generic AI subject (desk, tools, abstract graphic)	No
AI illustration that reads as an illustration	No
AI image presented as a “team photo”	Contested — “entities” may apply; unfair competition law applies regardless
Photorealistic AI portrait of a real person	Yes
AI video of a client delivering a testimonial	Yes

Two things that tend to get lost:

Metadata often doesn’t survive your image pipeline. Optimising images for the web — converting to WebP, compressing, resizing — silently strips all metadata in many toolchains. The C2PA provenance data goes with it. That’s not currently a violation on your part, but it destroys exactly the signal the regulation is built on. If provenance matters to you, audit your pipeline for strip flags.

The line isn’t drawn at “AI” but at “deception.” An AI image that looks like a photo of your shop, when your shop looks different, is a problem even without qualifying as a deepfake — just a different kind of problem.

Obligation 3: AI Text — the Rule Everyone Is Actually Asking About

Now to the question that worries most website owners. The operative sentence in Article 50(4):

Deployers of an AI system that generates or manipulates text which is published with the purpose of informing the public on matters of public interest shall disclose that the text has been artificially generated or manipulated. This obligation shall not apply […] where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication.

Two hurdles — and both must be cleared before the obligation applies at all.

Hurdle 1: “Matters of Public Interest”

The regulation doesn’t define the term, and remarkably, the Commission’s final guidelines don’t conclusively interpret it either. But the recitals and commentary point clearly in one direction: what’s meant is information of societal relevance — public safety, health, the environment, consumer protection, political discourse, crisis communication. The purpose of the rule is combating automated disinformation, not regulating content marketing.

A how-to guide, a pricing page, a service description, a product comparison, a recipe, directions to your office: all of that serves a commercial purpose and does not inform the public on a matter of public interest. For an ordinary company blog, the trigger is therefore regularly not met.

Borderline cases exist, and they’re closer than you’d think. A tax adviser writing about a change in the law, a medical practice writing about a vaccination recommendation, an energy consultant writing about subsidy schemes, or a web designer writing about new legal duties — all of these touch areas where the public has an information interest. Strictly speaking, that includes this very post.

Hurdle 2: Editorial Control

Which is precisely why the second hurdle is the more important one. Even if your text falls under “public interest,” the disclosure duty disappears once both conditions are met:

1. The content underwent a process of human review or editorial control.
2. A natural or legal person holds editorial responsibility.

Condition 2 is the easier one. The regulation asks for no more than that a named natural or legal person holds editorial responsibility. A real byline under the post and an imprint identifying the company are enough.

Don’t confuse this with § 18(2) MStV (Germany’s Interstate Media Treaty). That provision requires a separately named responsible person, but applies only to “journalistic-editorial offerings in which, in particular, content of periodical printed matter is reproduced in whole or in part in text or image” — that is, press-like offerings. An ordinary company blog regularly falls outside it. Naming a responsible person anyway documents your editorial responsibility cleanly; the AI Act does not require it.

Condition 1 is the real requirement — and here the Commission guidelines are unambiguous: what’s required is genuine editorial responsibility, not a routine skim. Dumping a generated text into the CMS unread and hitting publish doesn’t qualify. Checking it on the merits, verifying figures against sources, fixing errors and standing behind the result does.

That’s not a legal formality but a work instruction. A review step you need anyway — because language models invent figures, deadlines and sources — becomes the reason you don’t have to label.

In short: the way out of the disclosure duty isn’t avoiding AI, it’s taking responsibility for the output. Review it and you don’t need to label. Skip the review and you have a bigger problem than a missing label.

The Real Risk Isn’t the AI Act — It’s Unfair Competition Law

If something catches up with you over AI content in the next few years, it very probably won’t be the Bundesnetzagentur but a competitor. Because unfair competition law picks up exactly where Article 50 stops — and it has no public-interest threshold.

Three provisions of the German UWG matter most:

• § 5 UWG — misleading commercial practice. False statements about material characteristics of your service, about results, or about references are misleading.
• § 5a UWG — withholding material information the consumer needed to make a decision.
• Nos. 23b and 23c of the Annex to § 3(3) UWG — fake consumer reviews, and reviews presented as genuine without adequate verification. Both are per se unlawful, with no balancing test.

Translated into concrete mistakes I see on websites:

What the page says	Why it’s a problem
”In my projects I routinely cut load times by 40%” — with no such project	§ 5 UWG: fabricated performance claim
A case study with an invented client that reads as real	§ 5 UWG: fabricated reference
AI-generated customer quotes in the testimonial slider	Annex No. 23c: fake review
An author profile for a person who doesn’t exist	§ 5 UWG: deception about expertise
Chatbot with a human name and portrait photo	§ 5a UWG and Art. 50(1)

The common thread: the problem isn’t using AI, it’s claiming an authenticity that doesn’t exist. An AI-written guide without invented experience is unproblematic. A hand-written text with invented figures wouldn’t be.

That yields a very practical review step I recommend to anyone using AI in content: go through your existing posts looking for first-person claims. Search for “in my projects,” “in my experience,” “a client of mine,” “we measured.” Every one of those is a factual assertion about you. What you can substantiate stays. What you can’t gets depersonalised (“typically,” “in practice”) or deleted. It takes an hour and removes by far the largest risk.

The Side Effect: Copyright

One point that almost never comes up in the labelling debate but matters commercially.

Under § 2(2) UrhG, German copyright law protects only personal intellectual creations. A text or image generated entirely by a language or image model is not a human creation — and therefore not protected. The practical consequence: a competitor may copy your purely AI-generated blog posts, and copyright gives you no recourse.

Protection returns the more genuine creative work goes into the result — through selection, arrangement, editing and substantive content of your own. Here too, the incentive points in the same direction as editorial control.

It gets particularly awkward with logos and figurative marks: a purely AI-generated logo enjoys no copyright protection. You can still obtain trade mark protection, but that only arises upon registration — and only within the registered scope.

Google, AI Content and Visibility

For reassurance, because the question is always hovering: Google does not require AI disclosure. The search engine evaluates content by usefulness and quality, not by production method. There is no ranking penalty for a text having been produced with AI assistance — and no bonus for hiding it.

What does exist is a quality filter: mass-produced content without added value gets devalued. So again, the dividing line isn’t “AI or not,” it’s “reviewed or not.”

For visibility in AI search engines, transparency actually helps: clear authorship, named responsibility and traceable sources are exactly the signals a language model treats as citation-worthy. How to work towards that deliberately is covered in the post on GEO and AI search engines.

Implementation: Six Things I Build In by Default

Concrete, prioritised, with realistic effort.

1. Chatbot disclosure — 15 minutes. The first message and the launcher button both name the AI nature and the entity behind it. No human façade.

2. Audit your experience claims — 1 hour, one-off. Check every first-person statement in existing posts against reality. Substantiate, depersonalise or delete.

3. Name who holds editorial responsibility — 10 minutes. A named natural or legal person with a service address in the imprint. That satisfies the second condition of the editorial exception. A separately named responsible person under § 18(2) MStV is only mandatory for press-like offerings — but it never hurts.

4. A real byline per post — 20 minutes. A real name, linked to a Person entry in the Article schema. No fictional authors.

5. A voluntary transparency note — 20 minutes. Not required, but worth it. One sentence in the post footer or on a dedicated page:

Research and drafting for this post were AI-assisted. All statements, figures and sources were verified before publication. Editorial responsibility rests with [name]; see imprint.

That sentence costs nothing, defuses any accusation of feigned authenticity, and incidentally documents the very process the Article 50(4) exception requires.

6. A short editorial policy — 1 hour. A public page describing how content is produced and reviewed. From the regulation’s point of view it’s evidence of the “process of human review.” From search’s point of view it’s an E-E-A-T signal.

If you do label, you can use the EU icon set from the Code of Practice. It isn’t mandatory — the Code explicitly allows alternative designs as long as they meet its specifications. The advantage of the standard icon is recognisability, not legal certainty.

Penalties and Who Enforces

Breaches of the transparency obligations carry fines of up to 15 million euros or 3% of worldwide annual turnover under Article 99(4) — whichever is higher. For small and medium-sized enterprises, Article 99(6) flips that: the lower of the two applies. There is, however, no SME exemption from the obligation itself. “We’re only a small business” is no argument against the rule — only against the size of the fine.

In Germany, the Bundesnetzagentur has been the competent authority since July 29, 2026. The KI-MIG makes it the national coordinator as well as the market surveillance, contact and complaints authority; it works alongside the existing market surveillance bodies, so sector-specific regulators remain competent in their own fields. It also supports businesses through an AI service desk, regulatory sandboxes and advisory services.

A realistic note: a wave of cease-and-desist letters like the one following the European Accessibility Act is less likely in the short term here. Whether Article 50 breaches even qualify as market conduct rules actionable under the UWG has not yet been settled by the courts. That’s no reason to relax, though — just a shift: the cases that actually do get letters run through § 5 UWG anyway, and that doesn’t need Article 50 at all.

Frequently Asked Questions

Do I have to label AI-generated blog posts?

Usually not. The duty under Article 50(4) applies only to text published to inform the public on matters of public interest — not to guides, product copy or content marketing. Even there it falls away if the text underwent human review and a named person holds editorial responsibility.

Does the AI labelling duty apply to small businesses?

Yes, the AI Act has no size exemption. Article 99(6) only caps fines for SMEs at the lower of the two figures. Whether a duty applies depends on what you deploy, not on how big you are.

Do I have to disclose that my chatbot is AI?

Yes. Article 50(1) requires that users can tell they are interacting with an AI system. It addresses the provider — and that is often you: anyone who puts their own assistant into service under their own company name is the provider of that system under Article 3(3) read with 3(11). Embed a third-party widget unchanged and the duty sits with the provider, though you still have to implement it in practice. The notice must appear at the latest at the time of the first interaction and be accessible.

Do I have to label AI-generated images on my website?

Only deepfakes. Article 3(60) defines these narrowly: image, audio or video content resembling existing persons, objects, places, entities or events that would falsely appear authentic. Generic AI subjects and recognisable illustrations need no Article 50 label. Machine-readable marking under paragraph 2 is the image generator provider’s job, not yours.

What counts as “matters of public interest”?

Societally relevant topics such as public safety, health, the environment, consumer protection or political discourse. The rule exists to counter automated disinformation. Purely commercial content like service descriptions, pricing or how-to guides generally falls outside it.

Is reading the text once enough?

No. The Commission’s final guidelines of July 20, 2026 require genuine editorial responsibility; a routine skim explicitly does not suffice. What’s needed is a substantive review in which statements, figures and sources are checked and a named person stands behind the result.

What happens if I don’t disclose?

Article 99(4) allows fines up to 15 million euros or 3% of worldwide annual turnover; for SMEs the lower figure applies. In Germany the Bundesnetzagentur has been competent since July 29, 2026. More relevant in practice right now is unfair competition law: invented references, figures or customer quotes are actionable under § 5 UWG regardless of the AI Act.

Are AI-generated texts protected by copyright?

No. Under § 2(2) UrhG only personal intellectual creations are protected. Purely machine-generated text and images don’t meet that bar and may be copied by third parties. Protection only arises once genuine creative work — selection, editing, substantive content — is added.

What to Do Now

The situation is more manageable than the headlines suggest. For a typical small business website: the chatbot needs a notice, the blog posts don’t. And the work that keeps you out of the disclosure duty — reviewing texts on the merits, naming responsibility, not inventing experience — is the same work that makes your content better.

If you’re unsure where your site stands, look at the chat widget first, then at the first-person claims in your posts. Those two cover the bulk of the real risk, and you can handle both in a morning.

For anything beyond that — especially the question of whether a particular phrasing on your site is still opinion or already a factual assertion — ask a lawyer. I’m not one. What I can do is show you where on your website those spots are. Get in touch and I’ll take a look.