Home / Answers / Chatbot disclosure evidence (Art. 50(1))
EU AI Act · Article 50(1) · Chatbot disclosure
Do AI chatbots have to tell users they’re AI under Article 50 — and how do you prove you did?
What Article 50(1) requires
Article 50(1) places the obligation on providers: AI systems intended to interact directly with natural persons must be designed and developed so that the persons concerned are informed they are interacting with an AI system, unless that is obvious from the point of view of a reasonably well-informed, observant and circumspect person. These transparency obligations apply from 2 August 2026.
Knowing you disclosed is easy. Demonstrating it to a third party — months later, for a specific conversation, in the exact wording shown — is the hard part, and it’s the part regulators and auditors probe.
Why a screenshot of the disclosure isn’t proof
Most teams’ only record of a chatbot disclosure is a screenshot or an internal log — both of which the organization controls and can change. Verifiable evidence has three properties they don’t:
| Property | Screenshot / self-written log | Tamper-evident receipt |
|---|---|---|
| Independently checkable | No — requires trusting you | Yes — anyone can verify |
| Tamper-evident | No — editable in place | Yes — any change is detectable |
| Timestamp you can't backdate | No — system clock | Yes — cryptographically anchored |
How to produce the evidence
- Capture the event. At the moment the disclosure, marking, or label is applied, record the exact text or marking, the output's content hash, and the context.
- Fingerprint it. The SDK computes the SHA-256 fingerprint locally — the content never leaves your systems (hash-only, GDPR- and confidentiality-clean).
- Anchor it. Fingerprints are folded into daily RFC-9162 Merkle roots and anchored to the public chain via a public-ledger transaction.
- Verify it — anytime, by anyone. Re-check the receipt against the public chain with the open-source verifier, no account required.
Because the receipt format is an open IETF Internet-Draft implementing the SCITT architecture, the evidence you hold today keeps verifying even if any single vendor disappears.
The result: for any conversation, you can hand a regulator a receipt that proves the AI disclosure was shown, unaltered, at that moment — without asking them to trust your systems. See the general Article 50 evidence guide for the full picture across all three obligations.
Frequently asked questions
Does Article 50(1) apply if it's obvious the user is talking to a bot?
The obligation does not apply where it is obvious to a reasonably well-informed, observant and circumspect person that they are interacting with an AI, given the circumstances and context. In practice that judgment can be contested, so many deployers disclose anyway and keep verifiable evidence of the disclosure rather than rely on 'it was obvious.'
What should the receipt actually capture?
At minimum: the disclosure text as shown to the user, a content hash of the interaction or output, the AI system's identity, and the timestamp. LedgerProof anchors only the SHA-256 fingerprint of that record, so the receipt proves the event existed unaltered at that time.
Does this send my chat transcripts anywhere?
No. LedgerProof is hash-only — it anchors the SHA-256 fingerprint of each disclosure event, never the conversation itself. The content stays in your systems, which keeps the approach GDPR- and confidentiality-clean.
When does the obligation apply?
Article 50 transparency obligations apply from 2 August 2026. Producing verifiable evidence before then means your audit trail already exists when the obligation takes effect, rather than being reconstructed under pressure afterward.
Last updated 1 August 2026 · LedgerProof