AI Act Article 50 and Greek Law 5321/2026: what every chatbot must say from August 2026
Since 2 August 2026, chatbots and voice assistants must say upfront that they're AI, and realistic AI images must be labelled. What Article 50 says paragraph by paragraph, what Greek law adds, eight systems from eight sectors, and a 60-second check.
In this article
- “Maria” isn’t Maria.
- The five paragraphs that matter to you, in plain English.
- Provider or deployer?
- One sentence, at the start.
- Eight systems, eight sectors.
- Who supervises in Greece.
- From 2024 to 2028.
- The fine is the smaller risk.
- Check your assistant in 60 seconds.
- Compliant from the first sentence.
- What businesses ask about Article 50.
- Read next
- Sources
This article explains how we read and apply the rules. It isn’t legal advice. For your own case, talk to your lawyer or your data protection officer.
AI Act for SMEs
“Maria” isn’t Maria.
Old opening
Good evening, I’m Maria. How can I help?
New opening
AI Good evening, I’m the hotel’s digital assistant, an AI system. For someone at reception, press “Person”. How can I help?
Picture this first message in a hotel’s chat: a woman’s name, a face, a friendly tone. Behind “Maria” there’s no member of staff; there’s a language model. The guest doesn’t know that, and that is now the problem.
Since 2 August 2026, Article 50 of the EU’s Artificial Intelligence Act requires that the person on the other side knows they’re talking to an AI system, at the latest at first contact. The fix is one sentence. The hard part is knowing which sentence, where, and which of your systems need it.
This article puts it in order: what Article 50 says paragraph by paragraph, who carries the duty, what Greek Law 5321/2026 adds, eight systems from eight sectors with the sentence each one needs, and a 60-second check for yours.
The text
The five paragraphs that matter to you, in plain English.
Regulation (EU) 2024/1689 applies directly across the EU. Article 50 is the part that touches almost every business using AI in front of customers. It doesn’t ban anything; it asks you to be honest about what is talking to your customer and what you’re showing them.
| Paragraph | Who it applies to | What it requires | Example | From |
|---|---|---|---|---|
| 50(1) | Providers of systems that interact directly with people | The system is designed so the person is told they’re interacting with an AI system, unless that’s obvious to a reasonably well-informed, observant and circumspect person, given the circumstances. | A website chatbot, a phone voice assistant, an assistant on Viber or WhatsApp, an operator assistant on a tablet. | 2 August 2026 |
| 50(2) | Providers of systems that generate synthetic audio, images, video or text | Outputs are marked in a machine-readable format so they can be detected as artificial. Simple assistive editing that doesn’t substantially change the material is exempt. | Image, voice or video generators. The duty sits with the tool’s provider, not the business using it; the business simply doesn’t strip the marking. | 2 August 2026; for systems already on the market, 2 December 2026 |
| 50(3) | Deployers of emotion-recognition or biometric-categorisation systems | They tell the people exposed to the system, and process the data in line with GDPR. | Emotion recognition at work and in education is already banned by Article 5, except for medical or safety reasons. We don’t use it anywhere. | 2 August 2026 |
| 50(4), image · audio · video | Deployers who generate or alter content that amounts to a deepfake | They disclose that the content was artificially generated or altered. In an evidently artistic, satirical or fictional work, the disclosure is made in a way that doesn’t spoil the work. | Virtual furniture in a photo of a real flat; a digital coach who passes for a person; the owner’s cloned voice in an ad. | 2 August 2026 |
| 50(4), text | Deployers who publish AI text to inform the public on matters of public interest | They disclose that the text was artificially generated, unless it went through human review and a person or company holds editorial responsibility. | An informational text written and published automatically, unedited. This article, checked and signed by a named person, needs no label. | 2 August 2026 |
| 50(5) | All of the above | The information is given clearly and distinguishably, at the latest at the first interaction or exposure, and meets accessibility requirements. | The disclosure is spoken on calls, read out by screen readers, and never buried in the terms or the footer. | 2 August 2026 |
AI Act (Regulation (EU) 2024/1689), Articles 3, 5, 50, 113 · legislation
Second date in 50(2): Jones Walker / Cooley, August 2026 · legal analysis
What counts as a “deepfake”
Image, audio or video generated or altered with AI that resembles existing people, objects, places, entities or events and would falsely appear authentic to whoever sees it. It needn’t show a politician; a “photo” of a flat with furniture that isn’t there fits too, if it passes for real.
AI Act, Article 3(60) · legislation
The Commission consulted on draft guidelines for Article 50 in May 2026, and in July found the Code of Practice on marking synthetic content adequate. When the guidelines are final, we’ll update this article and the review date at the top.
Jones Walker, August 2026 · legal analysis
Roles
Provider or deployer?
Provider
Builds or commissions it, and releases it under its own name.
Deployer
Uses it in the course of business.
The regulation talks about two roles. A provider is whoever develops an AI system, or has it developed, and places it on the market or puts it into service under its own name. A deployer is whoever uses an AI system in the course of their work.
The duty in paragraph 1 belongs to the provider: the system has to be built to say it’s an AI. If you buy an off-the-shelf assistant, the vendor has to supply it that way. But if you commission an assistant and put it into service under your company’s name, you may count as a provider too.
The distinction matters for the contract, not for your customer. They see your name. So the contract has to say who ensures the AI disclosure, and the assistant has to make it, whoever turns out to be the provider.
When a system ships under our name, we say so and we’re its provider, with the duties that brings. When we build it for you, the contract spells out who does what.
AI Act, Article 3(3) and (4) · legislation
The wording
One sentence, at the start.
The law doesn’t supply a wording. These are ours, as we deliver them. They say what matters in the first seconds, sound natural, and offer a way out to a person.
Website chat law
Hello, I’m {business}’s digital assistant, an AI system. For a person, type “person” or press the button below.
Phone law
Hello, you’re speaking to {business}’s digital assistant, an AI system. This call is recorded to help us serve you. For a person, say “person” or press 0.
Viber or WhatsApp law
Account name: “{business} · Digital assistant (AI)”. First message of every new conversation: “Hello, this is {business}’s digital assistant, an AI system. For a person, type ‘person’.”
Automatic email reply law
This message was written automatically by an AI system. A member of our team will reply by {day}.
The disclosure is made in the language of the conversation. On the phone, where the language isn’t known before the caller speaks, the opening line is bilingual and already contains the disclosure.
In chat, an “AI” label stays visible for the whole conversation, and screen readers announce it.
What we never do
- A human name and a face with no “AI” beside them.
- Fake “typing” delays that imitate a person.
- “Just a moment, let me ask a colleague” when there is no colleague.
- The disclosure only in the terms of use or the footer.
- A disclosure only the first time, when the customer comes back to a new conversation days later.
Items 4 and 5 are our reading of Article 50(5) (“clear and distinguishable”); items 1 to 3 are Netex rules.
Use cases
Eight systems, eight sectors.
Article 50 doesn’t look the same in a hotel and in a factory. Here are eight systems we come across in Greek businesses: what each one must say, where the duty applies, and where it doesn’t.
- The system
- A booking assistant on the website, in five languages.
- Does Article 50 apply?
- Yes · Article 50(1)
- What it says
- “Hello, I’m the hotel’s digital assistant, an AI system. I can check availability and prices; for reception, press ‘Person’.”
- Watch out
- The disclosure switches language with the guest. The “AI” label stays in the chat header throughout.
- Netex rule
- When the assistant doesn’t know, it says so, and hands the conversation to a person with the full history.
- The system
- A voice assistant that answers the phone and books appointments.
- Does Article 50 apply?
- Yes · Article 50(1), plus GDPR for the recording
- What it says
- “Hello, you’re speaking to the clinic’s digital assistant, an AI system. This call is recorded so we can book your appointment correctly. For a person, say ‘person’ or press 0.”
- Watch out
- The assistant doesn’t triage symptoms or give advice. Anything urgent goes straight to a vet.
- Netex rule
- Critical details (name, phone, day and time) are read back before anything is confirmed.
- The system
- A customer-service assistant on Viber and WhatsApp: order status, returns, exchanges.
- Does Article 50 apply?
- Yes · Article 50(1)
- What it says
- “Hello, this is {e-shop}’s digital assistant, an AI system. Give me your order number and I’ll tell you where it is. For a person, type ‘person’.”
- Watch out
- Messaging apps don’t always allow a permanent label. So “AI” goes into the account name too: “{e-shop} · Digital assistant (AI)”.
- Netex rule
- Every new conversation, even days later, starts with the disclosure again.
- The system
- AI drafts replies to clients’ emails; the accountant reads them, edits them and sends them.
- Does Article 50 apply?
- Usually not under paragraph 1: the client is dealing with the accountant, not the system. If replies go out automatically without review, yes.
- What it says
- In the email the accountant sends, no disclosure. In the out-of-hours automatic reply: “This message was written automatically by an AI system. Your accountant will reply by {day}.”
- Watch out
- The test is who is talking to the client. When a person reviews the text and sends it, the responsibility and the voice are theirs.
- Netex rule
- No automatic message with tax content goes out without an accountant’s approval.
- The system
- An operator assistant on a tablet beside the line, answering from the manuals and the fault history.
- Does Article 50 apply?
- Yes · Article 50(1). Employees are people talking to the system too. It may be “obvious” that it’s an AI, but we don’t rely on that.
- What it says
- First screen: “AI assistant. Answers from the plant’s manuals and always shows the source. For safety and machine settings, ask the shift lead.”
- Watch out
- It doesn’t measure staff performance and doesn’t recognise emotions; the latter is banned in the workplace by Article 5.
- Netex rule
- Every answer shows the manual page it came from, and the team is trained before first use.
- The system
- AI virtual staging of photos of empty flats.
- Does Article 50 apply?
- Yes · Article 50(4), when the image passes for a real photo of the property
- What it says
- A label on the image itself: “Virtually furnished with AI. The flat is sold unfurnished.”
- Watch out
- The listing also shows the real, empty photo. Without a label, beyond the AI Act there’s a misleading-advertising issue as well.
- Netex rule
- The label goes on the image itself, so it isn’t lost when the photo is reposted. Law 5321/2026 prohibits removing transparency labels.
- The system
- A voice assistant for table bookings in August, when most calls are in English.
- Does Article 50 apply?
- Yes · Article 50(1)
- What it says
- Opening line, bilingual: “Γεια σας, hello. You’re speaking to the taverna’s AI booking assistant.” Then it carries on in the caller’s language.
- Watch out
- The disclosure has to be heard before anything else. If the assistant waited to work out the language first, the first contact would already have happened without it.
- Netex rule
- The booking is confirmed in writing, by text or email, with the same details that were spoken.
- The system
- An ad in which a digital coach, made with AI, explains the programme.
- Does Article 50 apply?
- Yes · Article 50(4), if the avatar resembles a real person and would pass as real. If it uses a real coach’s face or voice, their written consent is needed as well.
- What it says
- A label on the video from the first second: “Digital coach, created with AI.”
- Watch out
- An obvious cartoon isn’t a deepfake. An avatar that passes for a person is, and the label has to be visible. In borderline cases, we label.
- Netex rule
- We never strip the machine-readable marking added by the generation tool.
Greece
Who supervises in Greece.
The regulation applies directly. Greek law decides who supervises it and adds a few rules of its own.
- Law 5321/2026 (Government Gazette, Series A, No. 114, 20 July 2026) names the Hellenic Data Protection Authority as the market-surveillance authority for Article 50 transparency duties, for prohibited practices and for Annex III high-risk systems. It is also the single point of contact, with a complaints system.
- It’s the same authority that supervises GDPR. The notice that you’re talking to an AI and the notice about your data are best written, and checked, together.
- EETT, the telecoms regulator, is the notifying authority: it designates and monitors the bodies that assess high-risk systems. A front-desk assistant won’t bring you into contact with it.
- The register of AI systems the law sets up covers public-sector bodies, not private businesses. You don’t need to register your assistant anywhere.
- Removing transparency labels from deepfakes is prohibited.
- AI Act breaches fall under whistleblower protection (Law 4990/2022), and the earlier Greek AI rules in Law 4961/2022 are repealed in the relevant chapter.
Lawspot, 22 Jul 2026 · Taxheaven, Law 5321/2026 · PwC Greece, Legal Flash · legal analysis
Timeline
From 2024 to 2028.
- 1 August 2024 The AI Act (Regulation (EU) 2024/1689) enters into force. in force
- 2 February 2025 The prohibited practices (Article 5) and the AI-literacy provisions (Article 4) apply. in force
- 2 August 2025 The rules for general-purpose AI models and the penalty provisions apply. in force
- 20 July 2026 Law 5321/2026, implementing the AI Act in Greece, is published. in force
- Late July 2026 Regulation (EU) 2026/1744 (the “Digital Omnibus”) postpones the high-risk rules, not transparency. in force
- 2 August 2026 The Article 50 transparency duties apply. in force
- 2 December 2026 The grace period for machine-readable marking of synthetic content ends, for systems on the market before 2 August 2026 (a provider duty). coming
- 2 December 2027 Obligations for Annex III high-risk systems: employment, education, credit scoring, essential services. coming
- 2 August 2028 Obligations for AI embedded in products (Annex I). coming
The 2026 postponement covers high-risk systems only. The Article 50 transparency duties were not moved.
Jones Walker, August 2026 · legal analysis
Penalties
The fine is the smaller risk.
For Article 50 breaches, the regulation sets fines of up to €15m or 3% of worldwide annual turnover, whichever is higher. For SMEs and start-ups, the lower of the two applies.
AI Act, Article 99(4) and (6) · legislation
In Greece, supervision and complaints are handled by the Data Protection Authority. The likeliest scenario for a small business isn’t an inspection out of the blue. It’s a customer who felt fooled and now knows who to tell.
And before any authority gets involved, the customer has already decided. An assistant that hides that it’s an AI loses trust the first time someone notices. One that says so upfront has nothing to hide.
Self-check
Check your assistant in 60 seconds.
Self-check
Seven questions about your chatbot or voice assistant. Answer for the system as it works today, not as you’d like it to.
Answer all seven questions to see the result.
What to fix
- Does it say it’s an AI in its first message or first sentence? Put the disclosure in the first sentence, before any answer. law · Article 50(1) and (5)
- Does it say so in the other person’s language? The disclosure follows the language of the conversation; on the phone, the opening line is bilingual. our reading of Article 50(5) (“clear manner”)
- Does an “AI” label stay visible for the whole conversation, or in the account name? Add a permanent label in the chat header, or “(AI)” in the account name on messaging apps. Netex rule
- Can the customer reach a person in one step? One word, one key or one button: “person”, 0, “Talk to a person”. Netex rule
- Does it mention recording or storing the conversation, with a link to the privacy notice? One short line at the start, and the full details in writing: purpose, retention period, rights. law · GDPR Articles 12–13
- Do AI images, video and audio that look real carry a visible label? A label on the content itself, not just in the caption, and never strip the tool’s marking. law · Article 50(4)
- Do you know who the system’s provider is, and what the contract says about the AI disclosure? Ask the vendor in writing: who the provider is, where processing happens, who ensures the disclosure. law · AI Act Article 3 · GDPR Article 28
The check doesn’t save or send anything. It isn’t legal advice.
Netex
Compliant from the first sentence.
- Every AI Front Desk we deliver opens with the disclosure, keeps an “AI” label throughout and offers a one-step route to a person. For chat, from €390/month + €2,500 set-up. AI Front Desk →
- For systems we didn’t build, the Comply & Secure add-on checks and fixes Article 50 disclosures and labels, together with baseline security controls. Ask us about Comply & Secure →
- Training for your team: how the AI you use works, where it gets things wrong, what you tell customers. Workshops from €600.
Frequently asked questions
What businesses ask about Article 50.
Does a chatbot with buttons and canned replies count?
It depends on whether it’s an “AI system” under the regulation, meaning it infers from what you type how to respond. A simple tree of buttons and preset texts probably isn’t. But customers can’t tell the difference, so we recommend the same transparency anyway: one sentence saying they’re talking to an automated assistant, not a person.
Is “AI assistant” in the chat window title enough?
Maybe, since the regulation exempts what’s “obvious”. We wouldn’t rest compliance on it, though. The title gets hidden on mobile, screen readers don’t always announce it, and on a call it doesn’t exist. One sentence at the start of the conversation settles it on every channel.
Do I have to label text written by AI?
The regulation requires a disclosure for AI text published to inform the public on matters of public interest, unless a person holding editorial responsibility has reviewed it. A product description your editor checks usually needs no label. A realistic AI image does.
Do AI-made product photos need a label?
If they look like a real photo of the product and would pass as one, yes: it’s artificially generated content that appears authentic. Beyond Article 50, consumer law applies too: the image mustn’t show something the product isn’t.
Which authority supervises in Greece, and where do complaints go?
The Hellenic Data Protection Authority. Law 5321/2026 names it the market-surveillance authority for Article 50 transparency and the single point of contact, with a complaints system. It’s the same authority as for GDPR, so the AI notice and the privacy notice are best written together.
My chatbot vendor is outside the EU. Does this apply to me?
Yes. The regulation applies to systems placed on the market or used in the EU, and to businesses using them in the EU, wherever the provider is based. For the data, GDPR additionally requires a processing agreement with the vendor and a lawful basis for any transfer outside the EU.
Sources
- Regulation (EU) 2024/1689 (AI Act), Articles 2, 3, 5, 50, 99, 113 · legislation
- Jones Walker, “Yes, August 2 still matters” (August 2026) · legal analysis
- Cooley, “EU AI Act transparency obligations take effect 2 August 2026” (3 Aug 2026) · legal analysis
- Lawspot, “Law 5321/2026: national law implementing the AI Act published” (22 Jul 2026) · legal analysis
- Taxheaven, Law 5321/2026, Article 21 · legislation
- PwC Greece, Legal Flash: New national framework for the implementation of the AI Act in Greece · legal analysis
- European Commission, regulatory framework for AI · official source
- Regulation (EU) 2016/679 (GDPR), Articles 12, 13, 28 · legislation