Method · Checks · Limits

How the scan works

Last updated: 7 October 2026

Key point: Article50.io loads your live page in a real browser, with scripts running, and looks for things Article 50 of the EU AI Act cares about: AI chat, voice and avatar widgets, whether they tell visitors they are talking to AI, how clearly, in which language, and whether images whose file data says they are AI-generated carry a visible label. The full report says what was checked and what could not be checked. Findings describe what we saw, never a legal verdict.

Scan for free

Step 1: Your page loads in a real browser

We open the URL you give us in a real Chromium browser, not a simple HTML download. Scripts run and widgets load, at a desktop screen size (1366 × 768). Then we wait up to 5 seconds for chat widgets that load late, and stop sooner once a known chat widget has appeared on screen. To keep scans quick, the browser doesn't download images, fonts or media; images are read separately in Step 6. No scan runs in the browser for longer than 45 seconds.

We scan the page at the address you give us; we don't crawl the rest of the site.

Step 2: We look for AI chat, voice and avatar widgets

We recognise widgets from known vendors by their scripts, the requests the page makes to their loader servers, page globals, element IDs and, for voice and avatar widgets, the embed markup. Vendors we currently recognise:

Chat: Intercom, Drift, Zendesk, Crisp, Tidio, LiveChat, HubSpot chat, Freshchat, tawk.to.
Voice: ElevenLabs voice agent, Vapi voice agent, Telnyx AI agent.
Avatar: D-ID avatar, Tavus avatar, Synthesia presenter video.

A custom-built chatbot that doesn't match a known vendor may not be recognised. It is only picked up if its markup uses common names such as "chatbot", "ai-chat" or "chat-widget", and is then reported as a custom chat widget. Voice and avatar widgets are recognised from the vendors above only.

Step 3: We read the text visitors see, including inside widgets

We read the visible text of the page. For chat, voice and avatar widgets we also read text inside chat-like frames (up to 25) and chat-like shadow roots, which ordinary page text doesn't include. Frames that don't look like chat widgets aren't read, and the reading is best effort and time-boxed.

We read only what a widget shows as it first loads. Nothing is clicked or opened, so a disclosure that appears only once a conversation starts isn't seen. How a disclosure inside a frame from another site is presented can't be measured, and the report says so.

Step 4: We look for an AI disclosure, in 7 languages

We recognise wording that tells visitors they are talking to AI in English, German, French, Spanish, Italian, Dutch and Portuguese. On the page, only sentences addressed to the visitor count, such as "You're chatting with an AI assistant". Marketing lines like "Powered by AI", bare labels like "virtual assistant", and negated phrases ("you are not talking to an AI") don't count as a disclosure there.

Inside a chat widget, where the text is the bot speaking, more wording counts: first-person statements such as "I'm an AI assistant" and labels that name the bot as an AI. Negated phrases still don't count, and in the six languages other than English a label has to say AI.

When we find a disclosure, we compare its language with the page's language setting where both are clear, and say "couldn't determine" otherwise. Labels on AI-generated content and on images are recognised in English only. Avatar labels are recognised in all seven languages. Read more in AI disclosure and language.

Our non-English phrase lists are still being reviewed by native speakers. If we miss a correct disclosure in your language, tell us at [email protected] and we'll fix it.

Step 5: We check how clearly a disclosure is presented

Where we find a disclosure, we measure how it is presented as the page first loads. We report measurements and flag only clear problems:

→Visibility: whether the text is hidden (display or visibility off, zero size, off-screen, near-zero opacity, clipped, fully transparent text) or very small (under 10px).
→Readability: the contrast of the text against its background and its font size. Contrast is shown against 4.5:1, a common technical benchmark and not a legal threshold, and only a ratio below 3:1 is flagged.
→Assistive technology: whether the text is hidden from assistive technology (aria-hidden, inert, the hidden attribute, or not rendered). This reads attributes and rendering state; we don't run a screen reader.
→Language: whether the language of the matched text differs from the language set for it on the page. It is flagged only when both are clear. A page marked English with text clearly in another language is "couldn't determine", because English is often just a default.

Anything we couldn't inspect, such as gradient or image backgrounds, text in a frame from another site, or text we couldn't locate, is reported as "couldn't determine" and never produces a finding.

Step 6: We check images for AI provenance markers

After the browser is closed, we read the start of up to 8 images on the page (the first 256 KB of each, within a shared 5-second limit). We pick the social-share image first, then images by size, and skip icons, logos, SVG, video and tiny images. We look for provenance data that says an image was made by a trained model: an IPTC digital source type in the image's XMP metadata, or in a C2PA (Content Credentials) manifest.

If an image says it is AI-generated and no label, caption or alt text near it, or text elsewhere on the page, says so (English wording only), we report it. A missing marker is never a finding, because many AI images carry none, and markers are easy to strip.

Separately, if the page's own markup says content is AI-generated (a generator tag naming a known AI tool, or an explicit AI-generated attribute) and no visible text discloses it, we report that too.

Step 7: We never show a blocked page as clean

If the page redirects to a different site, shows a bot check or security challenge, answers with an HTTP error (400 or above), loads with almost no visible text (under 50 characters), or fails to load or times out, we say we couldn't scan it. We never show that as a clean result. A redirect within the same site, including to or from a "www" or subdomain address, isn't treated as another site. For a redirect to a different site, we show where it went and let you scan that address.

What you get

→Free scan: the most severe finding, with a note of how many other issues were found, or "No obvious Article 50 issues found" with a summary of what the scan checks. Where it found a chat disclosure, a clean result shows the wording it found and how it is presented.
→Full report: every finding with the Article it relates to, what we saw, and suggested wording you can paste in with where to put it, plus a coverage map. For each of Article 50(1) to 50(5) the map gives one status: “Checked: finding”, “Checked: nothing found”, “Not observable from a public page”, “Declared by you, not verified”. "Declared by you, not verified" applies only to 50(2) and 50(3), the paragraphs a public page can't show.
→Questionnaire: 5 optional yes/no questions about things a public page can't show. Your answers appear as "Declared by you, not verified" and never change what the scan measured. You can change them for 7 days after the report is made.

See a sample report, or run a free scan.

What the scan can't check

→Anything behind a login, or shown only after a click, a consent banner or a chat being opened.
→A separate mobile layout.
→What a voice agent says on a call.
→Whether AI output you generate is machine-marked (Article 50(2)).
→Custom chatbots from vendors we don't recognise, and disclosure wording in other languages or unusual phrasing.
→Who is the provider or deployer, whether an exception applies, or whether a disclosure is legally sufficient.
→Other pages of your site: we scan only the address you give us.
→Disclosures that are images rather than text, and contrast over gradients or image backgrounds.
→Anything inside a frame from another site, beyond noting that it is there.
→Watermarks with no public detector (such as SynthID), markers stripped by hosting, images beyond the first eight, and video or audio.

A clean result is not a compliance clearance, and this page is not legal advice. For the rules themselves, see the Article 50 guide.

Frequently Asked Questions

Does the scan use a real browser?

Yes. Your page is loaded in a real Chromium browser so scripts and widgets run as they would for a visitor.

Which languages does it recognise?

AI disclosures addressed to visitors in English, German, French, Spanish, Italian, Dutch and Portuguese. Content and image labels in English only.

Does a clean result mean my site meets Article 50?

No. It means the scan found no obvious issue in what it could check. The full report lists what it could not check.

What happens if my site blocks the scan?

We tell you we couldn't scan it. We never show a blocked or empty page as clean.

Does the scan check images for AI?

It reads provenance markers some AI tools embed in images. It does not guess from how an image looks, and a missing marker is never reported as a problem.

Check your site automatically

Article50.io is an automated scanner for the Article 50 transparency rules of the EU AI Act. It scans a website for potential Article 50 transparency gaps and generates a report of what the scan found and what it could not check, with remediation guidance, implementation instructions and disclosure wording you can paste in.

The free scan shows your single most severe finding in about 30 seconds — no signup, public pages only.