AI transparency obligation: check these 5 points.

Since 2 August, the transparency obligation in the European AI Act has applied in practice. Do you have a chatbot on your website, do you use AI for customer contact, or do you have images, video or text generated automatically? Then there are a number of things you need to have in order. In the Netherlands, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) confirmed in mid-July that the rules were taking effect and advised companies to sign the European Commission's voluntary code of practice. A month on, it turns out that many business owners simply let that deadline pass, usually because they did not know the law also applies to a small chatbot on an online shop. This article walks through what exactly is required, what you can still put right this week and roughly what it will cost.

What changed on 2 August

Article 50 of the AI Act does not regulate whether you may use AI, which you simply may, but whether you are open about it. The Dutch Data Protection Authority lists four situations in which you have to disclose or label something. If a visitor talks to a system driven by AI, it must be clear to that person that it is not a human. If you use AI to recognise emotions or to categorise people based on biometric characteristics, you disclose that in advance. If you have audio, images, video or text generated automatically, that synthetic content must be recognisable, for example with a watermark or label. And if you create or distribute a deepfake, you indicate visibly or audibly that it was made or edited with AI.

For most SMEs, the first point is the one that bites: the chatbot on the website or in the customer service app.

Five things to check this week

A compliance project does not have to take months. These five points cover most of what an average SME needs to arrange.

• Place a visible notice above your chatbot, before anyone starts typing. Something like "You are now chatting with the AI assistant of [company name]" is sufficient, as long as it is not tucked away in the small print at the bottom of the page.
• Make a list of all AI applications in your business, including which system, for what purpose and who is responsible for it internally. Without that overview you do not even know where you still need to make changes.
• Label images, video or audio that AI has generated and that resemble real material. A product photo that is clearly an illustration does not need a label; an AI-generated testimonial video does.
• Sign the European Commission's voluntary code of practice. Those who did so before 22 July are registered as first signatories, but according to the Dutch regulator signing later still carries more evidential weight in an inspection than a self-declaration alone.
• Record who carries out the checks and when. Half a page with a date, a name and action points is already enough as evidence that you are taking it seriously.

What if you have missed something

Coding Agency, a knowledge centre specialising in AI regulation, cites fines of up to 15 million euros or 3 percent of global annual turnover for breaches of Article 50, whichever is higher. That sounds alarming for a company with ten employees. In practice, enforcement focuses mainly on the providers of AI models themselves, such as OpenAI, Google and Anthropic, and on large parties deploying AI at scale without any form of transparency. For smaller businesses the penalty rules include a softening, where the lower of the two maximum amounts applies instead of the higher.

A common misconception is that all AI-written text has to be labelled. That is not quite right. The labelling requirement for text mainly applies to content on matters of public interest that has not been through editorial review. A product description or blog article that you have reviewed and edited yourself generally falls outside it. What we often see among business owners is that they get needlessly nervous about precisely this point while forgetting the chatbot notice, when it really should be the other way round.

Roughly what it costs

For an average SME, this does not need to be a significant expense. AI governance adviser Vincent van Deth puts a legal review of your chatbot and content process at between 500 and 1,500 euros with a specialised firm, depending on how many AI applications you have. If you want to set up a sturdier governance layer, with a fixed process for new AI tools and a designated owner, you are looking at something closer to 2,000 to 5,000 euros. A standard such as ISO/IEC 42001 can help to get processes in order, but does not count as legal proof of compliance. See it as a tool, not a substitute for the law itself.

A chatbot that stays silent about being a chatbot has simply been breaking the law since 2 August. Put one sentence above the chat and the problem is solved.

Frequently asked questions

Does my simple FAQ chatbot also need to show an AI notice?

Yes. If the system responds automatically and it is not immediately obvious that it is not a human, you have to disclose that. A simple line at the top of the chat window is enough; you do not need to build a separate page for it.

Do I also have to label texts I wrote with ChatGPT and edited myself?

In most cases, no. The labelling requirement for text is mainly intended for unedited content on matters of public interest. A blog article you have checked and edited generally falls outside it. If you are unsure about your specific situation, seek targeted legal advice. This article is meant as a practical guide and is not legal advice, and the interpretation of "public interest" can differ from case to case.

Who actually enforces this? The Dutch example

No separate new supervisory authority has been created. According to Coding Agency, a group of ten sectoral regulators in the Netherlands deals with this, with the Dutch Data Protection Authority in a coordinating role. For most SMEs this mainly means that an inspection may follow a complaint or a spot check, not that checks take place daily.