# RECIPES.md — installing the Article 50(1) disclosure on six chat platforms

> **Engineering tooling, not legal advice.** These recipes implement the
> disclosure obligation in Article 50(1) of Regulation (EU) 2024/1689, as
> described by the Commission's Guidelines C(2026) 5054 final of 20 July 2026.
> They do not make you compliant, they do not cover Article 50(2), (3) or (4),
> and Commission guidelines are non-binding — only the CJEU can authoritatively
> interpret the AI Act. Sources are cited so you can check every claim:
> `/research/`.

**Applies from 2 August 2026.** Not delayed by the Digital Omnibus — see
`research/03-application-dates-and-digital-omnibus.md`.

---

## Rule zero — prefer the platform's own setting over our script

If your chat platform can show a first-turn message or a persistent label from
its own settings, **use that**. A config field you set is more robust than a
script that injects into someone else's DOM: it survives their redesigns, it
cannot be broken by a CSP change, and it is one less dependency.

Use `disclosed.js` when the platform gives you no such field, when you need the
same wording across many clients, or when you want the disclosure positioned
where the platform will not put it.

---

## The disclosure text

The Commission's own example wording, from Guidelines paragraph (37):

> **You are interacting with an AI system.**

The widget renders that, plus an accuracy note, plus an optional link:

> **You are interacting with an AI system.** Responses are generated
> automatically and may be inaccurate. *How this works*

Polish:

> **Rozmawiasz z systemem sztucznej inteligencji (AI).** Odpowiedzi są
> generowane automatycznie i mogą być niedokładne. *Jak to działa*

Using the regulator's phrasing is deliberate. It costs nothing and removes an
argument about whether the wording is clear enough.

---

## Generic install

```html
<script src="disclosed.js"
        data-disclosed-target="#your-chat-container"
        data-disclosed-lang="auto"
        data-disclosed-link="/ai-transparency"></script>
```

Options: `target`, `lang` (`auto`|`en`|`pl`), `position` (`top`|`above-input`),
`link`, `text`, `theme`. Every option has a working default; the zero-config
case is correct.

The widget waits for the chat to mount (chat platforms load asynchronously),
renders once, makes no network calls, writes no cookies or localStorage, and
fails silently if the container never appears.

---

## Verify it yourself — the four checks

Do these in your own browser on every install. **Do not take our word for it.**

1. **Open the chat as a first-time visitor** (private window). Is the disclosure
   visible *before* you type anything? → S3, Art. 50(5)
2. **Read it.** Does it contain the words "AI" or "artificial intelligence"?
   *"Assistant"*, *"powered by Intercom"* and *"smart replies"* do not count. →
   S2, Guidelines (38)
3. **Tab to it with the keyboard, and run a screen reader if you have one.** Is
   it announced? Is it `aria-hidden`? → S7, Art. 50(5)
4. **Ask the bot "are you a human?"** Does it say it is an AI? → S9,
   Guidelines (40)

Check 4 fails on nearly every default install. See below.

---

## S9 — the check almost everyone fails

Guidelines paragraph (40):

> Providers must also design and develop the AI system to ensure disclosure in
> all situations where the AI system is being asked questions relating to its
> nature or to the origin of the interaction, or where it can be reasonably
> assumed from the exchanges with the natural person that that person is likely
> to be misled or confused about the AI origin of the interaction.

**No injected snippet can satisfy this.** It is a property of the model's
instructions, not of the page. Add to your system prompt, in the bot's language:

```text
If the user asks whether you are human, what you are, who they are talking to,
or otherwise appears unsure whether they are talking to a person, say plainly
and immediately that you are an AI system. Never claim or imply that you are
human, and never deflect the question.
```

For rule-based bots with no model, add an intent that matches "are you human",
"are you a bot", "is this a real person" and replies with the same statement.

---

## The six platforms

Each recipe: prefer the native setting; otherwise install the script; then run
the four checks.

> ⚠️ **Dashboard menu paths are not reproduced here because they were not
> verified for this release.** Platform UIs change often and a wrong menu path
> is worse than none. Each recipe tells you *what* to look for; find it in the
> current UI and confirm with the four checks. Verifying and pinning exact paths
> per platform version is tracked as an open item.

### 1. Intercom

Intercom can show an introductory message when a conversation opens. **Look for
the intro/greeting message setting on the Messenger and put the disclosure
there** — that satisfies S1–S3 natively and survives Intercom's updates.

Watch for: an intro message that shows only on the *first ever* conversation.
S5 requires the disclosure at the start of **each session**, so a
once-per-visitor greeting is not enough on its own. If that is the behaviour,
add the script as well.

Script fallback:

```html
<script src="disclosed.js"
        data-disclosed-target=".intercom-messenger"
        data-disclosed-position="top"></script>
```

Intercom's own AI agent answers questions about itself, but **verify check 4 in
your own workspace** — the answer depends on your configuration.

### 2. Tidio

Widely used by EU SMEs and the most likely platform in an agency's client book.

Prefer Tidio's own pre-chat / welcome message field if it renders inside the
chat window. If the welcome message is a *bot node* rather than a static label,
make it the **first** node so it fires before any user input.

Script fallback:

```html
<script src="disclosed.js" data-disclosed-target="#tidio-chat"></script>
```

**Tidio renders in an iframe in some configurations.** A script on the host page
cannot inject into a cross-origin iframe. If `#tidio-chat` resolves to an
`<iframe>`, the script cannot help you — use Tidio's own message settings.
This is a real limit, not a workaround we are hiding.

### 3. Crisp

EU-headquartered and a common default for EU agencies.

Crisp supports an automated first message. Use it. If you run Crisp's AI
answering, the disclosure belongs in the first message **and** the S9 prompt
belongs in the AI configuration.

Script fallback:

```html
<script src="disclosed.js" data-disclosed-target=".crisp-client"></script>
```

### 4. Drift

Higher-end; secondary ICP. Drift playbooks open with a message — put the
disclosure in the **opening message of every playbook that can reach a European
visitor**, not just the default one. Multiple playbooks is the usual failure
mode here: one gets the disclosure, six do not.

Script fallback:

```html
<script src="disclosed.js" data-disclosed-target="#drift-widget"></script>
```

### 5. Custom OpenAI / Anthropic API widget — **highest leverage**

The agency-built case. You control everything, there is no vendor to wait on,
and you are most likely the **provider** under Article 3(3) — including where
you supplied it *"free of charge"*, which the definition covers explicitly.

Render the disclosure as the first element of the chat panel:

```html
<div id="chat">
  <script src="disclosed.js"
          data-disclosed-target="#chat"
          data-disclosed-position="top"
          data-disclosed-link="/ai-transparency"></script>
  <!-- transcript, composer -->
</div>
```

Or skip the script entirely and put it in your own markup — it is three lines,
and one less dependency is one less thing to break:

```html
<p class="ai-notice" role="note">
  <strong>You are interacting with an AI system.</strong>
  Responses are generated automatically and may be inaccurate.
</p>
```

**Then add the S9 system prompt above.** This is the recipe where you can
actually satisfy check 4, which is why it is the one worth doing first.

### 6. WordPress chat plugins

Largest EU SME install base by volume, and the messiest — "WordPress chat
plugin" is fifty different products.

Two routes:

**A. The plugin has a welcome-message field.** Use it. Done.

**B. It does not.** Enqueue the script properly rather than pasting it into a
theme file that the next update overwrites:

```php
// functions.php of a CHILD theme, or a small site-specific plugin.
add_action( 'wp_enqueue_scripts', function () {
    wp_enqueue_script( 'disclosed', get_stylesheet_directory_uri() . '/js/disclosed.js', [], '1.0.0', true );
    wp_script_add_data( 'disclosed', 'data-disclosed-target', '#your-chat-container' );
} );
```

`wp_script_add_data` support for arbitrary attributes varies by WordPress
version. If the attributes do not appear on the tag, use the
`script_loader_tag` filter to add them, or copy `disclosed.js` and set the
defaults directly in the source — it is a single file with no build step,
which is precisely why it is shaped that way.

---

## What these recipes do **not** cover

- **Article 50(2)** — machine-readable marking of generated content. Different
  obligation, different deadline (2 December 2026 for systems already on the
  market before 2 August 2026; immediately for anything shipped after). Block 6.
- **Article 50(3)** — emotion recognition and biometric categorisation.
- **Article 50(4)** — deepfakes and AI-generated public-interest text.
- **Whether you are a provider or a deployer.** Article 50(1) binds *providers*;
  50(3) and 50(4) bind *deployers*. If you build the widget, you are likely the
  provider. If you install someone else's under your client's brand, it is more
  complicated. See `research/01-article-50-text.md`.
- **Anything outside Article 50.**

---

## Open items for this file

1. **Per-platform dashboard paths unverified.** Nothing in the recipes depends
   on a specific menu location, but pinning them per platform version would make
   these materially more useful.
2. **No recipe has been tested against a live installation of its platform.**
   The generic install and the widget are tested (`test.html`); the
   platform-specific selectors are best-effort and are exactly why every recipe
   ends with four checks the reader runs themselves.
3. **Tidio iframe behaviour** stated from general knowledge of embed patterns,
   not verified against a live Tidio install.

---

## Sources

- Regulation (EU) 2024/1689, Articles 3, 50 — `research/01-article-50-text.md`
- Regulation (EU) 2026/1744 and application dates —
  `research/03-application-dates-and-digital-omnibus.md`
- Commission Guidelines C(2026) 5054 final, 20 July 2026, paras (34)–(40),
  (142)–(144) — `research/04-commission-guidelines-article-50.md`