AI Act Article 50: The Mandatory AI Disclosure for Your n8n Chatbots Since August 2, 2026

August 2, 2026 was a little over two weeks ago, and it's a deadline that directly concerns anyone who has wired an AI Agent or Chat Trigger node to a public-facing channel in n8n. That day, Article 50 of the EU's Artificial Intelligence Act (AI Act) became fully applicable: anyone interacting with an AI system must be informed of it, clearly and distinguishably, unless it's already obvious from context. National market surveillance authorities can now fine a breach up to €15 million. At the same time, the "AI Omnibus" adopted this summer pushed the heaviest obligations — those for Annex III high-risk systems — back to December 2027, which created widespread confusion: many businesses wrongly assume the whole August deadline was postponed. It wasn't, for transparency — and that happens to be the obligation that's easiest to automate in an n8n workflow.

What already applies, and what's been deferred

The AI Act has rolled out in waves since it entered into force in August 2024: a ban on the most intrusive practices (Article 5) since February 2025, obligations for general-purpose AI (GPAI) model providers since August 2025, then a new deadline on August 2, 2026. It's this last wave that was partially amended by the Omnibus regulation, published in the Official Journal on July 24, 2026 and in force since July 27: only the obligations specific to standalone Annex III high-risk systems (recruitment, credit scoring, critical infrastructure, education, justice, migration…) were pushed to December 2027. Everything else on the August 2, 2026 calendar remains in force as-is: Article 50 transparency obligations, the requirements already applying to GPAI providers, and the Article 5 prohibited-practices regime.

In practice, for the vast majority of n8n users deploying a conversational agent, a support bot, or a voice assistant that never falls into an Annex III category, it's Article 50 that applies right now — and nothing about the Annex III deferral exempts you from it.

Why your n8n workflows are affected

Article 50(1) targets "AI systems intended to interact directly with natural persons" — a definition that unambiguously covers a Telegram bot, a website chat widget, a WhatsApp assistant, or a phone voice agent built with the AI Agent node and a Chat Trigger. The exemption only applies when interacting with an AI is "obvious" from context — a scenario the academic literature considers rarely applicable in practice.

An analysis published in the Journal of Intellectual Property, Information Technology and E-Commerce Law, Article 50 AI Act: Do the Transparency Provisions Improve Upon the Commission's Draft? by Nicolaj Feltes (2025), points out exactly the uncertainty surrounding "direct interaction" and the "obvious" use exemption, along with the asymmetric split of responsibility between providers and deployers. The practical takeaway for an n8n deployer: better to show the disclosure by default on every conversational channel than to bet on an exemption whose legal boundaries remain fuzzy.

Building the mandatory AI disclosure, channel by channel

The disclosure needs to be structural, carried by the workflow itself, not just suggested in the system prompt and hoped for on every turn.

1. Website Chat Trigger or embedded widget — in your AI chat widget, add the disclosure in two places: a fixed label in the interface ("AI Assistant", permanently visible near the input field) and a first message generated by a Set node injected before the model's first reply, to guarantee it appears even if the system prompt is edited later.
2. Telegram, Slack, Discord, Microsoft Teams bots — on these persistent-thread channels (see our guides on Telegram bots, Slack bots, Discord bots, and Microsoft Teams bots), pair the welcome message with a fixed mention in the bot's display name or bio: a welcome message scrolls out of view after a few exchanges, a bot name stays visible permanently.
3. WhatsApp — same logic for a WhatsApp RAG chatbot: the first message of the conversation-opening template should carry the disclosure, since WhatsApp Business already requires approved templates at conversation start, making it the natural place to insert it once and for all.
4. Phone voice agent — for a voice AI agent handling calls, the disclosure must be audible, at the very start of the call, before any information is collected: a simple text-to-speech node stating "you are speaking with an automated assistant" before handing off to the agent is enough to cover the obligation.

Logging proof the disclosure was actually shown

Showing the disclosure isn't enough if you can't prove, during an inspection, that it was actually sent on every conversation. The same pattern detailed in our article on logging an AI Agent's decisions for audit applies here: a dedicated sub-workflow inserts a row into a Supabase table (transparency_disclosure_log) on every new conversation, with the channel, conversation ID, the exact disclosure text sent, and a server-side timestamp. It's this trail, not a reminder buried in internal documentation, that counts as admissible evidence if a market surveillance authority asks how you comply with Article 50. The Supabase audit logging workflow from the Compliance & Audit Pack (€149) provides the reusable table schema and sub-workflow for exactly this case.

A study published in Computer Law & Security Review, Transparency in human-AI interaction – An analysis of Article 50(1) AI Act, warns that a plain text mention offers little epistemic value if it isn't genuinely "clear and distinguishable" — a user who glimpses a line buried in a long welcome message is barely better informed than without it. In n8n terms, this means: a short disclosure, at the top of the message, never folded into a longer welcome paragraph, and repeated on channels where history scrolls quickly.

GPAI obligations: who's actually on the hook

Don't confuse the obligations of general-purpose AI (GPAI) model providers — which fall on OpenAI, Anthropic, Mistral, or Google as model publishers — with those of deployers, who use those models via an API key inside a workflow, which is what the overwhelming majority of n8n users do. If you're calling an existing model's API without retraining or redistributing it under your own brand, you remain a deployer: the GPAI obligations around technical documentation and copyright don't apply to you directly. The obligation that does apply to you is Article 50, on the deployer side of a system that interacts with people.

The Annex III deferral: breathing room, not a free pass

If one of your workflows falls into an Annex III high-risk category — the most common case for SMEs being résumé screening or candidate scoring, as covered in our article on AI-based CV screening — the deferral to December 2027 buys more time, but it isn't a free pass. Fifteen months go by fast, and Annex III's requirements (technical documentation, effective human oversight, risk management) demand a deeper overhaul than simply adding a disclosure. Starting now to log decisions from that type of workflow, following the pattern above, lays the groundwork without waiting for the 2027 crunch.

Common pitfalls

• Confusing the Annex III deferral with a general postponement — this is by far the most common mistake right now. Article 50 has applied since August 2, 2026, independently of the high-risk systems timeline.
• An AI disclosure that only lives in the system prompt — a model can forget to repeat it after several conversation turns or a prompt rewrite. The disclosure needs to be injected by the workflow, not merely suggested to the model.
• No timestamped proof the disclosure was shown — without logging, there's no way to demonstrate after the fact that the disclosure was actually sent on a given conversation.
• Treating WhatsApp and Telegram like a regular website — on a persistent thread, a welcome message that scrolls out of view isn't enough; you need a fixed mention that's permanently visible (bot name, bio).

Going further

Article 50 imposes a technically simple obligation — a clear, systematic, logged disclosure — but it needs to be built into the workflow, channel by channel, rather than hoped for from the model. The Compliance & Audit Pack (€149) provides a directly reusable timestamped audit trail building block for logging this proof; for teams managing support bots across several channels at once, the FlowKit Complete Bundle (€269) bundles every FlowKit pack, including Inbox AI so you never miss a regulatory alert in the daily flood of email.