How to check a website for EU AI Act Article 50

Start by writing down every place AI touches your visitors: chat or support widgets, voice agents, avatars, AI-generated images, video or audio, and AI-written articles. For each one, note who built it and whether you are the provider (you develop it or put it on the market under your name) or the deployer (you use a vendor's system). The role decides which Article 50 duties are yours: 50(1) and 50(2) are provider duties, and 50(3) and 50(4) are deployer duties.

The fastest check is to look at your chat widget the way a first-time visitor does.

1. Open the page in a private window, so you see it as a new visitor.
2. Open the chat and read the first message. Does it say plainly that this is an AI?
3. Ask "Am I talking to a person?" and read the reply.
4. Take a dated screenshot of the greeting and the reply.
5. Repeat on a phone — a separate mobile layout can hide or move the chat.

Check that the disclosure is accessible too (guidelines ¶142): it should be real text rather than an image, with enough contrast, and screen readers should announce it.

The Commission's guidelines (C(2026) 5054 final, non-binding) say first-turn greetings "may be combined, as appropriate, with persistent badges or labels visible throughout the interaction" (¶37).

Automated tools work in three different ways, and the method decides what they can see.

• Rendered-browser scanners load the page with scripts running, so chat widgets appear as visitors see them. Examples: Article50.io, DisclosureProof, GotAlt.
• HTML-only scanners read the page source. EUAiShield says it "does not execute JavaScript", so it may miss widgets that load by script.
• Questionnaires base their result on your answers about your setup rather than the live page. Examples: Disclo's free Scope Check and the Commission's EU AI Act Compliance Checker (beta), which doesn't scan your page.

Article50.io loads your page in a real Chromium browser, reads text inside chat-like frames among the first 25 frames on the page, and reads C2PA and IPTC AI markers in up to 8 images. Your own output's 50(2) marking is marked as declared by you and not checked by the scan. Method in full: how the scan works.

For a side-by-side of free tools, see the best free Article 50 scanner and Article 50 scanners compared.

Open the chat, ask whether you are talking to a person or an AI, and keep the transcript, because a page scan only reads what a widget shows as it first loads. Tools such as AnswerTested can record this. Repeat the test whenever your vendor or prompts change. If you run an AI voice agent, call it as a customer would and check that it says it is an AI at the start of the call; no page scan hears a call.

Article 50(2) and 50(4) cover AI-generated content rather than chat: machine-marking (50(2)) is the provider's duty, and visible labels for deepfakes and public-interest AI text (50(4)) are the deployer's.

• Art. 50(2) is a provider question. If you use a vendor's generative AI, ask the vendor how its output is machine-marked. The 2 December 2026 date is a transition for legacy systems only, not a general Article 50 deadline (Article 50 delay explained).
• Art. 50(4) is about visible labels. If you publish deepfakes, or AI-generated text to inform the public on matters of public interest, label it. That includes AI-generated deepfakes from suppliers or stock libraries. Templates: AI content label, deepfake disclosure, AI chatbot disclaimer.

A scan can't see the following (full list on the method page):

• Content behind a login, or that appears only after a click, a consent banner or opening the chat.
• A mobile layout that differs from the desktop page.
• What a voice agent says during a call.
• Whether the AI output you produce is machine-marked (Art. 50(2)).
• Custom chatbots from unrecognised vendors, and disclosure wording in other languages or unusual phrasing.
• Other pages, image-only disclosures, how text in cross-site frames is presented, some image markers, video/audio, and legal questions such as your role or whether a disclosure is sufficient.

Keep a dated screenshot of each chat greeting, dated transcripts from conversation tests, and the dated scan report. Each paid report from 30 Oct 2026 has a report ID, and its PDF has a SHA-256 fingerprint, so anyone you share it with can check the file is unaltered since it was issued (how the scan works). It says nothing about whether your site is compliant.

Most failed checks come from checking too little, too late, or in the wrong view.

• Checking only while logged in. Agent or admin views can hide the visitor greeting.
• Treating a clean scan as clearance. It covers what the scan could see on one page, on one day.
• Waiting for 2 December. That date is the Art. 50(2) legacy transition only; Art. 50(1) has applied since 2 August 2026.