Limited-risk AI

This is the tier almost every company touches, because a support chatbot or a marketing content generator qualifies while nothing else in the business does. It is also live now, unlike the high-risk regime, so it is the most likely source of a first enforcement contact. The machine-readable marking requirement is a build task rather than a policy task — provenance metadata or watermarking has to be designed into the generation pipeline, and retrofitting it across published content is far more expensive than shipping it once.

An e-commerce site runs an AI shopping assistant and generates product photography variants with a diffusion model. The assistant needs a clear disclosure at the start of the conversation, not buried in a terms page, and the generated imagery needs machine-readable provenance marking. The recommendation engine behind the scenes needs neither, because no one is interacting with it and it produces no synthetic content — the same product, three components, two different answers.

Reading limited-risk as a formal fourth category with its own definition. The Act does not define a limited-risk tier; it attaches transparency duties in Article 50 to specific system types, and those duties apply on top of high-risk obligations where both bite, not instead of them.

Do chatbots have to disclose that they are AI?

Yes. Article 50 requires providers to design systems that interact directly with people so those people are informed they are dealing with an AI system, unless that is obvious to a reasonably well-informed user in the circumstances.

When did Article 50 transparency obligations apply?

2 August 2026, two years after entry into force. They are already in effect, well before the Annex III high-risk obligations in December 2027.

Can a system be both limited-risk and high-risk?

Yes. Article 50 duties are cumulative. A high-risk system that also interacts with people or generates synthetic content must satisfy both the Chapter III requirements and the transparency duties.