The EU AI Act's transparency duty is already in force.

If your product talks like an AI, Article 50 applies to you.

Article 50 of the EU AI Act became enforceable on August 2, 2026. Non-compliance can cost up to €15M or 3% of global annual turnover, whichever is higher. For SMEs and start-ups, the AI Act applies the lower of the two amounts (Art. 99(6)).

If you operate a chatbot, virtual assistant, or AI agent that interacts with people, including one built on OpenAI, Anthropic, or Gemini, this obligation applies to you, regardless of company size. Building on top of someone else's model does not change that. Under Article 50(1), the duty sits with the provider of the AI system people interact with. If you put a chatbot into service under your own name, that is usually you, not the lab that trained the model.

The fix is a lot smaller than the risk: a clear way to tell users they're speaking with an AI, generated content labeled where required, and interaction records ready the moment a regulator asks: a few lines of code, not a legal project.

Built around the European Commission's official Article 50 guidelines (published July 2026).

What Disclarion actually does

Three obligations, handled at the SDK layer instead of bolted on after the fact.

The label ships with the content, not bolted on after

Add one script tag to your site and mark AI content with data-disclarion. Disclarion draws a standard "AI-generated" label on it, in the same spot every time, and keeps a record of each labeled item. No backend changes, no design work.

This page, live

The image beside this was generated with an OpenAI image model and its caption was written by Anthropic's Claude. Both are labeled right now by the same script our customers use. Click "Labeled by Disclarion" on either label to see its public record: the registered site, the page, and when it was confirmed.

<script src="https://cdn.disclarion.com/v1/label.js"
        data-site="site_…" async></script>

<img src="…" data-disclarion="ai-generated">
<p data-disclarion="ai-generated">…</p>

It's a label, not a certification: it shows content is AI-generated, it doesn't verify anything about the content itself. It's also a visible label, not the machine-readable marking Article 50(2) requires from providers of generative systems. Server-side apps can label content with track_content() in our Python SDK, which can also watermark images.

How Disclarion works

1. 01

   Integrate the SDK

   Wrap your existing chatbot or agent call. No infrastructure changes, no new services to run.

2. 02

   Logging runs automatically. Disclosure is a signal your UI renders.

   Every request is recorded in the background automatically, no per-message re-prompting. For a session's first message, the SDK also returns a signal that a disclosure is owed: your UI renders it, with the reference component or your own.

3. 03

   Review audit-ready evidence in the dashboard

   See, filter, and export compliance records the moment a regulator (or a customer) asks.

Ship it from wherever you already ship

A Python SDK, an n8n community node, and the HTTPS API underneath both: same disclosure, labeling, and audit trail, whichever one you reach for.

Built for teams without a compliance department

Disclarion is built for small and mid-size SaaS companies, agencies, and businesses running chatbots or AI agents. These are teams that need to meet Article 50 without the budget, headcount, or patience for a large enterprise GRC platform.

Agencies managing several clients: see Enterprise.

A banner tells a reader you used AI. It doesn't prove anything to anyone else.

Most disclosure tools stop at the front end: a badge in the corner of the page. Disclarion writes the record where the AI call actually happens, so the proof survives even if the badge doesn't.

Built with the same rigor it's asking of you.

We're early, so instead of logos, here's what's actually true about how your data is handled.

• Every customer's data is isolated at the database level

  Row-level security enforces the boundary in Postgres itself, so a bug in application code can't leak one account's data into another's.

• Audit logs are insert-only

  No application code path, including the dashboard itself, can edit or delete a log entry once it's written.

• API keys are never stored in plaintext

  Only a one-way hash is kept, so a database leak alone can't hand over usable keys.

• Data is hosted within the EU

  The database runs in an EU region (Ireland).

Frequently asked questions

From the blog