The Disclosure Line: What Your AI Chatbots, Voice Agents, and SDR Bots Now Have to Tell Buyers

For about three years, most B2B companies handled the "is this a bot?" question with a shrug. The chat widget had a friendly first name. The AI SDR signed emails as a real-sounding person. The voice agent that called back inbound leads paused, said "um," and never brought up what it was. Nobody had decided to hide anything. Nobody had decided to say anything either.

That default ended on August 2, 2026. The transparency rules in Article 50 of the EU AI Act became enforceable that day, and they cover the exact tools revenue teams have been rolling out fastest: chat assistants, voice agents, autonomous outreach, and AI-generated content. Several US states had already started moving in the same direction. So the question for go-to-market leaders has changed. It used to be "should we tell people?" Now it is "how do we tell people without losing the trust we were trying to protect?"

That second question is harder than it sounds, because the research on AI disclosure is uncomfortable. Telling people you used AI often makes them trust you less. Getting caught not telling them is worse.

For CMOs, Sales Leaders, Customer Success Executives, and RevOps Teams running AI in customer-facing workflows

What changed on August 2

Article 50 of the EU AI Act sets four transparency duties. Two matter most to B2B revenue teams. Providers of AI systems that interact directly with people have to tell those people they are dealing with AI, unless that is obvious from the circumstances. Providers of generative AI also have to mark synthetic audio, images, video, and text in a machine-readable way so the output can be detected as AI-generated. A third duty requires deployers to disclose deepfakes, along with AI-generated text published to inform the public on matters of public interest.

The penalties are not symbolic. Violations can bring fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher, according to Baker Botts' summary of the rules. SMEs get the lower of the two figures.

A lot of US companies assumed the AI Act was a European problem that would keep getting pushed back. Part of it was. The Digital Omnibus on AI (Regulation (EU) 2026/1744), which entered into force on July 27, 2026, postponed the high-risk system requirements to December 2027. It left the Article 50 date alone. The only relief was a grace period until December 2, 2026 for generative systems already on the market before August 2 to add machine-readable marking. The chatbot disclosure duty got no grace period at all.

Reach is the other thing people miss. Article 50 applies to providers and deployers outside the EU when the system's output is used inside the Union. If your website chatbot answers a prospect in Munich, or your AI SDR emails a buyer in Rotterdam, you are in scope. You don't need a European entity or European servers.

Your company may be the "provider" without knowing it

Most revenue leaders read "provider" and think of OpenAI, Anthropic, or whichever vendor sold them the chatbot. The Commission's interpretive guidelines, adopted on July 20, 2026, are less comfortable on this point. According to a breakdown of the guidelines by VDF AI, an organization that builds a chatbot in-house and puts it into service under its own name counts as its provider. So does a company that modifies another provider's generative system (with new training data, for example) and runs it under its own brand.

Think about what a typical B2B "AI assistant" looks like in 2026. It runs on a foundation model, wraps your docs and product data in a retrieval pipeline, wears your logo, and lives on your domain. Under that reading, you may be the provider and the deployer at once. The disclosure duty in 50(1) is a provider duty. Your legal team should decide this system by system, and the decision should be written down before anyone argues about banner copy.

What counts as disclosure (and what doesn't)

The guidelines get specific about mechanics, and the details read like they were written by someone who has seen a lot of B2B websites.

For chat, a greeting or banner at the start of the conversation works. For voice, the agent has to say it is AI at the start of the call and remind people during long calls. Tones or chimes alone don't count. For agents, the system has to say that it is AI and on whose behalf it is acting. Replies that blend AI output with human content need disclosure unless a person reviews them and sends them as the main interlocutor. The system should also confirm it is AI any time someone asks.

The list of things that don't work is more telling. Terms and conditions don't count. Neither does invisible metadata, a generic "assistant" label, or a site-wide line saying "our services use AI." Under Article 50(5), the information has to be clear and distinguishable and given at the latest at the first interaction.

The "obvious from the circumstances" exception is narrower than most teams hope. The guidelines accept an internal assistant used by trained, AI-literate staff as a case where AI use is obvious. They reject helpdesk and platform chatbots that the general public can reach. Your pricing-page chat widget is the second kind.

Practical takeaway: if your current disclosure strategy is a line in the privacy policy and a bot named "Ava," you are not compliant for EU traffic.

AI SDRs are where this gets awkward

Chatbots are the easy case. Everyone already half-suspects the widget is a bot. The harder case is the fastest-growing category of revenue AI: autonomous outbound.

Gartner predicted in July 2026 that by 2028 AI agents will outnumber sellers ten to one, and that fewer than 40% of sellers will say those agents improved their productivity. A large share of those agents will write emails, send LinkedIn messages, book meetings, and handle replies under a human-sounding name.

Read the guidelines' language on agents again with that in mind. An agent interacting directly with a person has to say it is AI and on whose behalf it is acting. The human-in-the-loop exception only holds if a person actually reviews the message and sends it as the main interlocutor. A rep clicking "approve all" on 400 queued sequences is going to have a hard time arguing they were the main interlocutor on each one.

I don't think regulators are going to start by auditing cold email cadences. The first enforcement will likely target consumer chatbots and deepfakes. But your buyers can read, and nothing stops a procurement team from asking you directly how you use AI in customer-facing work. "Our outbound is written and sent by a persona that doesn't exist" is a bad answer to give a CISO in the middle of a security review.

The US is not a safe harbor either

US teams sometimes treat this as an EU issue. It isn't only that.

California's BOT Act has been in force since July 1, 2019. It makes it unlawful to use a bot to communicate with a person in California online with intent to mislead them about its artificial identity to incentivize a sale. The disclosure has to be clear and conspicuous, and the attorney general can seek fines of up to $2,500 per violation.

Utah went further. Under SB 226, which took effect May 7, 2025, a business using generative AI in a consumer transaction has to disclose it when a person clearly asks. People in regulated occupations have to disclose up front in high-risk interactions involving sensitive data and significant decisions, like financial, legal, or medical advice. The law gives a safe harbor to companies that clearly disclose AI involvement at the start of the interaction and throughout it. That safe harbor is a useful design target even if you never sell into Utah.

Voice has its own rules. In February 2024, the FCC unanimously ruled that AI-generated voices count as "artificial or prerecorded voice" under the Telephone Consumer Protection Act. That means AI voice calls need prior express consent for most purposes, and the message has to identify the entity making the call. If your team is testing AI voice agents for outbound prospecting, that ruling matters more than anything in Brussels.

The disclosure penalty is real

Here is the part compliance memos tend to skip. Disclosure has a cost, and the research is fairly consistent about it.

Oliver Schilke and Martin Reimann at the University of Arizona ran 13 experiments, published in Organizational Behavior and Human Decision Processes in May 2025. Across all of them, people who disclosed their AI use were trusted less than people who didn't. The effect held across tasks (communications, analytics, creative work) and across actors, from supervisors and analysts to investment funds. The authors traced it to legitimacy: using AI breaks a taken-for-granted norm that this kind of work is done by humans, and people read that as less effort, less commitment, and less authenticity.

A second study gets closer to sales. Peter Cardon and Anthony Coman surveyed 1,100 working professionals and showed them a congratulatory email from a supervisor written with low, medium, or high AI assistance. Only 40% to 52% saw the supervisor as sincere when AI did most of the writing, compared with 83% when it did little. Their conclusion was that people accept AI for routine, informational messages and push back on messages that are supposed to carry empathy, praise, or personal attention. Most outbound sales emails pretend to be the second kind.

Service data points the same way. A Gartner survey of 5,728 customers, conducted in December 2023 and published in July 2024, found that 64% would prefer companies not use AI in customer service, and 53% would consider switching to a competitor if they found out a company planned to. The top fear wasn't wrong answers. It was that AI would make it harder to reach a person.

And yet people say they want to be told. Forrester's 2025 Consumer Benchmark Survey found that three out of four US online adults expect companies to tell them when they're dealing with generative AI content. Researchers Siavosh Sahebi, Paul Formosa, and Sarah Bankins named this the "disclosure paradox" in a 2026 paper: readers say disclosure matters, then rate AI-attributed text as less trustworthy, less authentic, and less useful. A separate study by Jingchao Fang, Victoria Xiaohan Wen, and Mina Lee found that people want others to disclose AI use much more than they want to disclose their own.

So buyers want to know and then hold it against you. That's the situation.

Why hiding it is still the worse bet

The finding that should settle this for most teams comes from the last experiment in the Schilke and Reimann paper. People trusted a company that disclosed its AI use less than one that said nothing. But they trusted a company whose AI use was exposed by a third party least of all.

That's the realistic risk for B2B sellers. Buyers compare notes. They paste suspicious emails into their own AI tools. Peers talk. A champion who finds out three months into a deal that the "SDR" who booked the first meeting never existed doesn't just lose trust in that one email. They start wondering what else in your process is staged: the case study quotes, the "personal" video from the CEO, the follow-up that remembered their kid's soccer tournament.

Nielsen Norman Group made the same point in a September 2026 review of the disclosure research: since third-party exposure triggered the strongest negative reactions, proactive disclosure is usually the safer option when your AI use could come out later. In B2B, with long cycles and buying committees full of skeptical people, it almost always can.

The penalty isn't the same everywhere

The better news is that the trust hit varies a lot with context, which gives revenue teams room to design around it.

In a trust game with real money run by Zoe Purcell and colleagues (published in iScience in December 2025), messages labeled as AI-assisted didn't reduce how much money people sent or how trustworthy they rated the sender. In short, transactional exchanges between strangers, disclosure carried no measurable penalty.

How you describe the AI's role matters too. In an experiment by Zhuoyan Li and colleagues, saying AI had generated the content lowered quality ratings for both essays and stories. Saying AI had only edited the text lowered ratings for creative stories but not for argumentative essays. Hiroki Nakano and colleagues found that ratings of an author fell as the disclosed share of AI involvement went up, and that trustworthiness, caring, and likability dropped most when AI helped with interpersonal writing.

Audience matters as well. In a pooled analysis of 12 of their 13 experiments, Schilke and Reimann found the penalty was smaller among people with more favorable views of technology and among those who believed AI was accurate. It didn't disappear, but it shrank. A buying committee of engineers evaluating a developer tool will react differently than a committee of HR leaders buying a benefits platform.

Put those findings together and you get a fairly usable rule. Disclosure costs the least when the interaction is transactional, when a human visibly owns the outcome, and when the AI's role is described honestly and specifically. It costs the most when AI is standing in for something the buyer believed was personal.

A disclosure design that doesn't wreck trust

None of this requires a big compliance program. It requires a few decisions that most teams have avoided making.

Start with an inventory, not a banner. List every place AI talks to a prospect or customer without a person in between: website chat, support bots, voice agents, AI SDR sequences, AI-written follow-ups, avatar videos, renewal reminders. For each one, note who built it, whose name it uses, and whether EU or California buyers can reach it. Most companies discover two or three tools they forgot about.

Disclose at the first touch, in plain words. "I'm an AI assistant for [Company]. I can answer product and pricing questions, and I'll bring in a person whenever you want one." That one sentence covers the EU guidelines' requirement to say it's AI and on whose behalf it acts. It also answers the fear Gartner found was most common, that a person would be hard to reach. You're pairing the disclosure with the reassurance buyers actually care about.

Stop giving bots human personas. A named persona with a stock headshot is the clearest way to make your AI use look like a cover-up when it's discovered. Name the bot after the function, or after the company. If your AI SDR vendor's product only works when it pretends to be a person, treat that as a vendor risk.

Match the human share to the message. The Cardon and Coman results give you a map. Let AI handle scheduling, reminders, routing, recaps, and FAQ answers, and disclose it lightly. Keep congratulations, apologies, escalations, executive outreach, and renewal conversations mostly human, and make the human visible. If you can't afford a person on those messages, you can't afford the trust hit of sending them from a fake one.

Describe the AI's role precisely. "Drafted with AI and reviewed by Jordan" lands differently from "AI-generated." The research on edited versus generated content suggests the specific phrasing matters, and a named reviewer gives the buyer someone accountable. It's also closer to the editorial-review exception the EU guidelines allow for public-interest text, which requires real human review (at least fact-checking) and is cancelled by AI edits made after sign-off.

Keep the evidence. Version your disclosure copy like any other release. Log that the notice was shown at the first interaction. Write down which exception you relied on and who approved it. When a procurement team or a regulator asks, a two-page record beats a scramble.

Watch your content and executive video. Marketing teams tend to forget that the deepfake rules apply to them. According to the VDF AI summary, the Commission's guidelines treat a realistic avatar video of a CEO addressing staff as a deepfake that needs a label. The same logic applies to the AI-cloned founder video in your nurture sequence. The public-interest text duty also reaches further than people assume: the guidelines' examples include AI-edited corporate reports containing investor information on a listed company's website.

Turning disclosure into a selling point

There's a version of this where disclosure becomes something you sell on instead of something you put up with.

Buyers in 2026 are surrounded by AI-generated outreach and know it. A vendor that says plainly "our chat assistant is AI, our follow-ups are drafted with AI and checked by your account rep, and anything about pricing or contract terms comes from a person" is giving the buying committee something it rarely gets: a clear account of who is responsible for what. That's a trust signal, and it costs very little to produce.

It also gives you a ready answer for the security and AI governance questionnaires that show up in enterprise deals. A vendor that can show a disclosure policy, an inventory, and logs is in a much better spot than one that has to go ask the marketing ops team what the chatbot is called.

I'll admit the research doesn't make this easy. Disclosed AI will cost you some warmth in some conversations. The Schilke and Reimann data says so plainly, and pretending otherwise would be its own kind of spin. But the choice was never between disclosing and some imaginary world where buyers never find out. It's between telling them yourself, on your terms, with a person visibly standing behind the work, or having someone else tell them later.

Conclusion

The disclosure line is now drawn in law for any B2B company whose AI talks to buyers in the EU, and it's being drawn piece by piece in US states and at the FCC. The EU rules are specific: say it's AI at the first interaction, say on whose behalf it acts, remind people on long voice calls, label deepfakes, and don't count on a privacy policy or a cute bot name to cover you.

The trust research is just as specific, even when it's inconvenient. Disclosure costs something. Getting exposed costs more. The cost is lowest for transactional interactions where a named human owns the outcome, and highest where AI quietly replaces something the buyer believed was personal.

So the work for revenue leaders this quarter is mostly design work. Inventory every AI touchpoint. Drop the fake personas. Put people back on the messages that carry relationship weight, and be plain about where AI is doing the rest. Teams that do this will have a better answer than "we didn't think about it" when the question comes from a regulator, a procurement team, or a champion who just found out.