Your AI Chatbot Now Has to Tell People It Is AI
The EU AI Act's chatbot disclosure rules and California's SB 942 both became enforceable on 2 August 2026. Here is what that means if you run a small business with an AI feature on your site.
If your site has a chatbot and any of your visitors are in the EU, you now have to tell them a machine is answering. The European Commission's AI Office began enforcing Article 50 of the AI Act on 2 August 2026. California's SB 942 became operative the same day. Both are live.
Neither law is aimed at small businesses. Both catch them anyway, because the obligation to disclose attaches to the thing on your website, not to the size of the company running it. This post is about what actually changed, who carries which part of the burden, and the short list of things worth doing about it. It is not legal advice, and if you operate at any scale in the EU you should get some.
What exactly changed on 2 August 2026?
Three requirements from Article 50 became enforceable rather than advisory:
- Chatbots have to identify themselves. An EU user interacting with an AI system has to be told that is what is happening.
- Deepfakes have to be labelled. Synthetic images, audio and video of real people carry a disclosure obligation.
- AI-generated content has to carry machine-readable provenance. Not just a visible label a human can read, but a marker a machine can check.
The enforcement teeth are the part that changed. The AI Office can now levy fines of up to 15 million euros or 3% of global annual turnover. For general-purpose AI model providers, the Commission's announcement states the penalties reach back to violations dating from August 2025, so the compliance date and the exposure window are not the same date.
Does the EU AI Act apply to a Canadian business?
Possibly, and that surprises people. The Act follows the user, not the company. A studio in Vancouver with a support chatbot that answers questions from customers in Berlin is running an AI system that interacts with EU users.
In practice the risk scales with how much EU business you actually do. A Canadian shop with three European customers a year is not the target of a 15 million euro fine, and pretending otherwise is fear-selling. But the fix here is so cheap that the calculation does not really matter. One sentence of disclosure in a chat window costs an afternoon. Working out whether you were technically exempt costs a lawyer's retainer.
What does California's SB 942 require?
California's AI Transparency Act is narrower in who it covers and more specific in what it demands. It applies to generative AI providers with more than one million monthly users in California, which is a threshold that catches the model vendors and almost no one who hires a studio to build a feature.
Covered providers must embed C2PA-compatible provenance records in generated images, video and audio, show a visible AI label on outputs, and publish a free public detection tool. Penalties run to $5,000 per day per violation.
The reason a small business should care about a law it is not subject to is the second-order effect. Because SB 942 and Article 50 both landed on C2PA, provenance metadata is becoming the default output of the large image and video tools rather than an option somebody enables. That metadata will travel with the assets you generate, into your marketing, your ad accounts, and your clients' brand libraries.
Who is on the hook, you or your AI provider?
Roughly, the split works like this.
Your provider carries the model-level obligations. If you build on Claude, GPT or Gemini, the provenance marking of raw generated media and the GPAI transparency duties sit with the vendor. You inherit the benefit of that work without doing it.
You carry the deployment-level obligations, and there are only a few. Disclosure in the interface is the main one, because you are the one who decided to put a chatbot on a page and only you know where it is. If you strip provenance metadata out of generated images during your own build pipeline, that is also your decision and your problem. Image optimisers do this routinely and silently, which is worth checking.
The uncomfortable version: the obligations you are most likely to breach are the cheap ones you did not think about, not the expensive ones the vendor handles.
What should a small team actually do this month?
Five things, in the order I would do them.
- Label every AI surface you have shipped. Chat widgets, AI email replies, phone agents, AI-written product descriptions. A line in the chat header stating that responses are AI-generated, plus a human escalation route, covers the common case.
- Write the disclosure like a person. "You are chatting with an AI assistant. Ask for a human any time and we will pass you over." That satisfies the requirement and reads better than legalese.
- Check whether your build pipeline strips image metadata. If you are generating marketing images with AI and running them through a compressor, provenance may be getting removed after the vendor added it.
- Write down which models and vendors you use, and where. A one-page inventory answers most client due-diligence questions and takes twenty minutes. You will need it again.
- Decide who owns this. For a small team it is one named person, not a committee, and it is a recurring calendar entry rather than a project.
If you want the reasoning behind how a specific AI feature should be built, disclosed and maintained, that is exactly the sort of thing Code4U scopes in a consulting engagement, usually in less than a call.
Why this matters more than the fine
Disclosure is being framed as a compliance cost, and treating it that way is a small mistake. A visible label on an AI feature tends to reduce support complaints rather than increase them, because the failure mode people resent is discovering they were talking to a machine after the machine wasted their time. Telling them upfront resets what they expect from the conversation.
Code4U builds AI features for small businesses, and the ones that go well are the ones where the AI is obviously AI and the handoff to a person is obvious too. The law arriving at that same answer on 2 August is convenient, not inconvenient.
FAQ
Do I have to disclose AI if my chatbot only answers FAQs?
Yes. Article 50's disclosure duty attaches to a user interacting with an AI system, not to how sophisticated the system is. A retrieval-based bot answering shipping questions still needs to say it is AI. The upside is that the requirement is satisfied by one clear sentence in the interface, so simple bots have the cheapest possible compliance path.
Does the disclosure have to appear before the conversation starts?
The requirement is that the user is informed they are interacting with an AI system, so putting it where they will see it before they type is the safe reading. A persistent line in the chat header or an opening message from the assistant both work. Burying it in a linked privacy policy does not, because nobody reads a policy before asking about a return.
Do I need C2PA provenance on AI images I use for marketing?
The embedding obligation under SB 942 sits with large generative AI providers, not with you as a customer of one. Your practical job is not to destroy the provenance data your vendor already added. Check your image compression and CDN pipeline, since stripping metadata is a common default optimisation.
What happens if a small business just ignores this?
Enforcement attention will go to model providers and to large deployments first, so the realistic near-term risk to a small business is not a 15 million euro fine. It is a client or partner asking how you handle AI disclosure during procurement and getting no answer. That is the cost that shows up first, and it is avoidable in an afternoon.
Where can I follow what is changing next?
Code4U tracks this daily in the AI Daily Digest, including regulation, model releases and security. Both of the developments behind this post came from it, on 2 August 2026.