The EU's AI Disclosure Rules Now Apply to Companion Apps: What Actually Changes

What became applicable on 2 August

The AI Act (Regulation (EU) 2024/1689) has been phasing in since 2024. Its transparency article — Article 50 — reached its application date on 2 August 2026. It sets four separate duties, split between the company that builds an AI system (the "provider") and the company or person that uses one (the "deployer"):

Article 50(5) governs timing and presentation: the information has to be given clearly and distinguishably, at the latest at the point of first interaction or exposure. A disclosure buried on page nine of a terms document is not a disclosure.

Enforcement sits with national market surveillance authorities, and the penalty ceiling for breaching Article 50 is €15 million or 3% of worldwide annual turnover, whichever is higher.

The part that got delayed — and the part that didn't

This is where a lot of coverage has been muddled, so it is worth being precise. The "Digital Omnibus on AI" — formally Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force from 27 July — amended the AI Act to buy industry more time. It moved the high-risk obligations for standalone Annex III systems from 2 August 2026 to 2 December 2027, and for AI embedded in regulated products under Annex I to 2 August 2028.

It did not move Article 50. The transparency duties were treated as low-burden and citizen-facing, and they kept their original date. The single timing concession inside Article 50 is a four-month runway on the marking obligation in 50(2): generative systems that were already on the market before 2 August 2026 have until 2 December 2026 to get machine-readable marking in place. Everything else in the article is live now.

Two supporting documents landed shortly before the deadline. The Commission and the AI Office published the final Code of Practice on Transparency of AI-Generated Content on 10 June 2026, and the Commission adopted its guidelines on Article 50 on 20 July 2026. Neither is binding in itself; both are the reference point authorities will use when judging whether a given implementation is adequate.

What this looks like inside a companion app

Companion and character apps sit squarely in Article 50(1) territory: the entire product is an AI system designed to interact directly with a person. They also generate content, which brings 50(2) into play for apps with image generation.

Concretely, expect to see more of these:

• Persistent AI labelling. A marker at the start of a conversation, or in the chat header, stating the character is an AI. Apps that previously leaned into the illusion — no branding, no disclaimers, a character that insists it is human when asked — have the least room to manoeuvre.
• Metadata on generated images. Machine-readable provenance in the file itself, rather than a visible watermark. It is aimed at downstream detection tools, so you may never see it in the app; you would find it by inspecting a downloaded file.
• Disclosure at first interaction, not on request. 50(5) is explicit about timing. "The character will admit it's an AI if you ask" is not compliance.

What the rule does not do is prescribe a specific banner, wording or design. Two apps can comply in visibly different ways, and an in-fiction acknowledgement can still satisfy 50(1) if it genuinely informs the user. Roleplay is not outlawed — pretending, unprompted and unlabelled, that there is a human on the other end is the problem.

Does it reach apps built outside the EU?

Usually, yes. The AI Act applies to providers that place AI systems on the EU market regardless of where the company is established, and to providers and deployers in third countries where the system's output is used in the Union. An app that is downloadable and usable in an EU member state is in scope, whether the developer is in California, Singapore or anywhere else. For a category where a large share of the market is small studios operating internationally, that is the practically important sentence in the whole regulation.

How it compares to the US rules

The contrast is instructive, because the two jurisdictions are solving different problems. California's SB 243, signed on 13 October 2025 and operative since 1 January 2026, is aimed specifically at companion chatbots and is far more prescriptive on safety: AI disclosure, a break reminder at least every three hours for users known to be minors, protocols for handling self-harm content, measures to prevent sexually explicit material reaching minors, and a private right of action allowing damages of $1,000 per violation.

So an app serving both markets faces a split obligation: the EU tells it to be transparent about what it is, and California tells it to behave in specific ways around minors and crisis situations. Neither substitutes for the other, and an app that satisfies Article 50 may still be nowhere near SB 243 compliance.

What we're checking in reviews

We are not lawyers and we do not certify compliance. What we can do is record observable behaviour, which is exactly the kind of thing our review methodology treats as a hands-on check rather than a vendor claim. From this month we are noting, for each app we test: whether an AI disclosure appears before or at the first message; whether it survives into the chat UI or vanishes after onboarding; whether the character denies being an AI when asked directly; and whether downloaded generated images carry provenance metadata.

That sits alongside the checks we already run on age gates and content-filter defaults — which, as the app-store age rating data showed, are far more informative than any badge on a store listing. If you want the underlying mechanics, our privacy and age-verification guide covers how these systems actually work.

Frequently asked questions