For a single business, Article 50 is one website and an afternoon of work. For an agency it’s thirty websites, thirty clients, and sooner or later the same email from each of them: “Do we need to do anything about this AI Act thing?”
The rules themselves aren’t hard. What trips agencies up is roles. Who counts as the provider, who counts as the deployer, and where does the agency fit, given that it built the site but doesn’t own it? That’s most of this guide. After that comes a routine you can run across a whole portfolio.
A tool, not legal advice. The AI Act has no special category for web agencies, and your role depends on your contracts and on how you build things. For anything high-stakes, ask a lawyer and write the answer into your client agreements.
Article 50 in one breath
There are four transparency duties. Chatbots and other AI that talks to people must say it’s AI (50(1)). AI providers must mark their output in a machine-readable way (50(2)). Emotion recognition and biometric categorization must be disclosed (50(3)). Deployers must visibly label deepfakes, and AI-written text on matters of public interest that no human reviewed (50(4)).
They’ve applied since 2 August 2026. The one exception is a short extension, until 2 December 2026, for providers under 50(2). On a typical client site, the two that matter are 50(1) and 50(4).
Provider or deployer?
The AI Act gives two definitions. A provider develops an AI system, or has one developed, and puts it on the market or into service under its own name or trademark. A deployer uses an AI system under its own authority, other than for purely personal use.
There’s nothing in the text about agencies. None of the legal commentary we read sets out a special rule for them either. The advice that keeps coming up is to check, case by case, whether a party is a provider, a deployer or both. So let’s do that with the setups agencies actually use.
A vendor’s chat widget on a client site
Say you add Tidio or Intercom to a dentist’s website. It’s on the dentist’s account, with the dentist’s logo on the chat window. The vendor built the AI, so the vendor is the provider. The dentist is the deployer, because the bot runs on their site for their practice. You did the setup. You probably don’t have a legal role of your own here, but you’re the one who knows where the settings are, and the dentist will ask you.
A custom chatbot you built
This one is less clear. Say you connected an AI model, wrote the prompts, designed the chat window and handed it over. If it runs under the client’s name, the client may be the provider as well as the deployer. If you sell the same bot to several clients under your agency’s brand, your agency may be the provider.
So write it down. Who is the provider, and who makes sure the “you’re talking to an AI” notice is there? It’s one paragraph in a contract, and it saves a lot of arguing later.
Content you produce for the client
Blog posts drafted with AI, hero images from an image generator, product photos with AI backgrounds. Once they’re published under the client’s name, the client is normally the deployer. But think about who actually knows which content was AI-assisted. Usually it’s your team, not the client. If you don’t tell them, or label it yourselves, nobody will.
Sites you run on a retainer
Plenty of agencies host, update and fill client sites month after month. In practice you’re running the site, even though it’s still the client’s site and the client’s publication. Get it in writing who decides what gets labeled. “We assumed you’d handle it” is a bad way to find out nobody did.
What clients will ask, and how to answer
“Are we compliant?” is the big one, and it’s best not to answer it with a yes or a no. Tell them which duties look relevant, what’s been done on the site and what’s left. The legal conclusion is for them or their lawyer.
“Do we need to label all our images?” Usually not. Only realistic AI images that could pass as real need a visible label under 50(4). Deepfake or not goes through examples.
“Does the chatbot need a notice?” Almost always, yes. It should appear in the chat, before or at the first message. See Chatbots on your website and the EU AI Act.
“We’re not in the EU, so this doesn’t apply to us, right?” Not necessarily. If people in the EU use the site, the Act can reach it.
A routine for a portfolio
Start with an inventory, even a rough spreadsheet. For each site, note four things. Which AI chat is running, and is it actually live or just installed? Which AI plugins are active, for writing, images or translation? Does the client publish realistic AI images or video? Does the client publish news, health, finance or political content written with AI?
Then sort. Brochure sites with no chat and no AI content are low priority. Sites with a chatbot or AI product photos sit in the middle. Publishers, health and finance sites using AI text, and anyone showing realistic AI people, go first.
The quick wins are the same almost everywhere. Make sure the chatbot notice appears before the first message. Add captions to realistic AI images. Publish a short “How we use AI” page and link it from the footer. How to write a “How we use AI” page has a template.
Keep a record. If a client is ever asked how they handled AI labeling, “we think we did it” isn’t much of an answer. A log of what was labeled, when, by whom and why makes that conversation short.
Then come back to it. Sites change. A client installs a new AI plugin, or a freelance writer starts using an image generator. Checking every quarter, or every month for the higher-risk sites, catches most of it.
Finally, add a clause to your contracts. Say who decides what gets labeled, who’s responsible for the chatbot notice, and that you provide tools and setup, not legal advice.
About fines
Breaking the Article 50 duties can cost up to €15 million or 3% of worldwide annual turnover, whichever is higher (Article 99). National authorities enforce it, and smaller companies are supposed to be treated proportionately. A missing caption on a cartoon isn’t what regulators are after. A client showing realistic AI “customers” without a label, or a chatbot that pretends to be a person, is worth fixing this week.
How AuthorLabel helps
On each site, the free plugin does the full job. The first-run check asks six short questions, scans for chat widgets and AI plugins, and shows which Article 50 duties look relevant. It can tell a live widget from one that’s only installed. Labels for posts, images and products, a chatbot notice, a “How we use AI” page generator and an activity log are all included.
For agencies we’re building AuthorLabel Pro: an overview of many sites, PDF and CSV reports with your agency’s logo, and a weekly check by email. It isn’t released yet. Until it is, the free plugin works on every site one by one.
AuthorLabel shows you what looks relevant and keeps a record. It doesn’t give legal opinions, and it doesn’t promise compliance.
In short
The AI Act doesn’t have a special role for agencies, so apply the provider and deployer definitions to how you actually work. In most setups the client is the deployer and the AI vendor is the provider. If you build a bot and sell it under your own name, you may be the provider. Start with an inventory, fix chat notices and realistic AI images first, keep a record, and put the roles in your contracts.
Sources
- Regulation (EU) 2024/1689 (AI Act), Article 3 (definitions of provider and deployer), Article 50 and Article 99.
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), published in the Official Journal on 24 July 2026.
- Paul, Weiss, “EU finalises transparency rules for AI-generated content” (August 2026). paulweiss.com
- Gibson Dunn, “EU AI Act Omnibus agreement” (May 2026). gibsondunn.com
Last reviewed: November 2026. AuthorLabel is a tool, not legal advice.