EU AI Act Article 50: What SMEs Using AI Agents and Chatbots Must Do in 2026
Since 2 August 2026, the EU AI Act's transparency rules apply. For a small company, they are less about paperwork than about three concrete questions: does the person talking to your chatbot know it is a bot, can software tell that your agent wrote an email, and can you show which agents do what? This guide sets out what Article 50 asks, which dates moved with the Digital Omnibus, and what you can switch on in Orkeste today.
It is a practical summary, not legal advice. Your role under the Act (provider or deployer) depends on how you build and offer your AI system, so check the details with counsel.
The timeline after the Digital Omnibus
The Digital Omnibus on AI, in force since 27 July 2026, postponed the high-risk obligations but left the transparency rules of Article 50 largely in place (Fedil).
The European Commission published its transparency guidelines on 20 July 2026, and the Code of Practice on the transparency of AI-generated content was finalised on 10 June 2026 (Ropes & Gray). According to the same analysis, the guidelines bring agentic systems into scope even though the Act does not name them.
What Article 50 asks, in plain terms
Article 50(1): tell people they are talking to an AI. A system that interacts with people must make that clear, at the latest at the first interaction, unless it is obvious to a reasonably well-informed user. Generic terms and conditions do not count: the disclosure belongs in the interface.
Article 50(2): mark generated content in a machine-readable way. Providers of systems that generate text, images, audio or video must make the output detectable as AI-generated.
Article 50(4): label deepfakes and public-interest text. Deployers must disclose AI-generated text published to inform the public on matters such as politics or public health, unless a person with editorial responsibility genuinely reviews it. A quick skim before publishing does not qualify.
Fines for breaching Article 50 can reach €15 million or 3% of worldwide annual turnover, whichever is higher, with proportionality for SMEs.
What this means for a company running AI agents
Most SME agents fall into three situations:
- A chatbot or widget on your website. This is the clearest Article 50(1) case: visitors must know they are not talking to a person.
- Agents that draft or send emails to customers. The email is generated text. A machine-readable marker answers 50(2), and many companies add a short visible mention for trust, even where it is not strictly required.
- Internal agents that summarise tickets or update the CRM. The transparency duties are lighter, but you still need to know which agents exist, what they can do and which actions skip human review. That inventory is also the first thing a customer's security questionnaire or an auditor asks for.
What Orkeste does out of the box
These features shipped in October 2026. Some are always on; the others are settings for workspace owners and admins under Settings, AI compliance.
The CSV files use semicolons and a UTF-8 BOM so they open cleanly in a French or German Excel, and cells are neutralised against formula injection.
A worked example: a 20-person agency
An agency uses three agents: a website assistant, an agent that drafts client follow-ups in Gmail, and an internal reporting agent.
- Website assistant. It is embedded with the Orkeste widget. The AI disclosure is already shown; nothing to configure.
- Follow-ups. Each draft carries the AI header. The agency also switches on the visible mention: "This message was prepared with the help of an AI assistant and reviewed by our team." Because every follow-up waits in Validations before it goes out (see the human-in-the-loop guide), the second half of that sentence is true.
- Register. Once a quarter, the operations lead exports the agent register and the validations journal and files them with the agency's GDPR records. When a client's procurement team asks how AI is used on their account, the answer takes ten minutes.
Where the EU sovereign profile fits
Article 50 is about transparency, not hosting. But the same customers who ask about the AI Act ask where their data goes. Orkeste's EU sovereign profile keeps every model call on EU-hosted models, with no fallback outside the EU. It is a separate switch in the same settings section.
Limits
Orkeste covers the AI it runs. The tools your agents work in (Gmail, HubSpot, Zendesk...) and the MCP servers you connect follow their own terms. Slack and Teams already show an app as a bot, so no extra mention is added there. And none of these features decides your legal role or replaces an assessment of high-risk use cases, which have their own, later deadlines.
FAQ
Does the AI Act apply to small businesses using chatbots?
Yes. The Article 50 transparency rules have applied since 2 August 2026 regardless of company size: people must be told they are talking to an AI. Penalties are scaled for SMEs, but the obligation itself is the same.
Do AI-generated emails need to be labelled?
Article 50(2) asks providers of generative systems to mark output in a machine-readable way, with a grace period until 2 December 2026 for systems already on the market. Orkeste adds a machine-readable header to agent emails, and you can add a visible mention as well.
What is the deadline for AI Act transparency compliance?
The transparency obligations apply from 2 August 2026. For machine-readable marking, generative systems already on the market before that date have until 2 December 2026. High-risk obligations were postponed to December 2027 and August 2028.
Does human approval help with the AI Act?
For AI-generated text published to inform the public, genuine review by a responsible person is the main exemption from the labelling duty of Article 50(4). An approval queue where someone can edit or reject each draft supports that review; a rubber stamp does not.
How do I export a register of my AI agents?
In Orkeste, owners and admins open Settings, AI compliance, and export the agent register or the validations journal as CSV.