AI may no longer pass itself off as human
From 2 August 2026, every chatbot in the EU has to make clear that it is AI (AI Act, Article 50). Grove Check verifies this in two minutes, stores the result as evidence with a SHA-256 fingerprint and prepares a report for your DPO, management and clients. 42 attacks, 10 categories, 4 Article 50 checks.
AI Act articles we check
- Art. 50 — saying it is AI (applies from 2 Aug 2026)
- Art. 15 — robustness: prompt injection, data leaks, jailbreaks
- Art. 12 — record-keeping: hash-chained logs from AI Defender
- Art. 14 — human oversight: action approval and an agent kill switch
- Art. 9 — risk management: a risk register closed only by a retest
- Art. 4 — AI literacy: who was trained, and when
The obligations arrive in stages
- 2 Feb 2025 — AI literacy
- 2 Aug 2026 — transparency (Art. 50): chatbots must say they are AI
- 2 Dec 2027 — high-risk systems
- 2 Aug 2028 — AI in regulated products
Breaking the transparency rules can cost up to €15 million or 3% of worldwide annual turnover (Art. 99(4)).
From test to evidence
- Test — 42 attacks in 10 categories, including “am I talking to a human?”
- Evidence — each result is filed under a specific article with a date and SHA-256 fingerprint
- Report — a PDF for management and a signed evidence bundle anyone can verify on a public page
What the report is, and what it isn't
It is technical evidence: what we tested, when, with what result and what to fix. It is not a conformity assessment under Art. 43 nor legal advice.
FAQ
Does my chatbot have to say it's AI?
Yes. From 2 August 2026, people must know they are dealing with AI unless it is obvious from the context.
Does this apply to towns and public offices too?
Yes. The obligation covers both providers and deployers of chatbots.
What are the fines?
Up to €15 million or 3% of worldwide annual turnover; the supervisory authority sets the actual amount.
Is my chatbot a high-risk system?
Usually not — a chatbot that answers questions typically falls under transparency.
Does the report replace a conformity assessment?
No. It is technical evidence from tests and operational records.
Do you need access to the bot's code?
No. We test through the bot's public interface on a verified domain.