The EU AI Act Reaches Gulf Businesses Through Their Chatbots: What Article 50 Requires
The EU Artificial Intelligence Act reaches a business in Oman or the Gulf in two main ways. One is placing an AI system on the EU market. The other is using one whose output is used in the EU. For most Gulf companies, the first obligation it brings is the simplest: if your chatbot talks to people in Europe, they must be told it is an AI. That duty, in Article 50, has applied since 2 August 2026.
The Act’s heavier rules for high-risk AI were postponed in July 2026. Under the Digital Omnibus on AI, Regulation (EU) 2026/1744, standalone high-risk systems now face 2 December 2027, and AI embedded in regulated products 2 August 2028. The transparency duties were not postponed.
This article explains when the Act applies to a Gulf business, what Article 50 asks of a chatbot, and what the delay does and does not change.
The short answer
| Obligation | Applies from | Reaches a Gulf company when |
|---|---|---|
| Prohibited AI practices (Article 5) | 2 February 2025 | It places such a system on the EU market or its output is used in the EU |
| General-purpose AI model duties | 2 August 2025 | It provides such a model in the EU — rarely an SME |
| Transparency — telling people they are talking to an AI (Article 50(1)) | 2 August 2026 | Its chatbot or voice agent interacts with people in the EU |
| Transparency — machine-readable marking of generated content (Article 50(2)) | 2 August 2026; until 2 December 2026 for systems already on the market before 2 August 2026 | It provides a system generating synthetic text, images, audio or video in the EU |
| High-risk systems in Annex III areas such as hiring, credit and education | 2 December 2027 (postponed) | Its system is used in those areas in the EU |
Does the Act apply to a company in Oman?
Article 2 sets the scope, and it was written to reach beyond the EU. It covers:
- providers placing AI systems on the market or putting them into service in the EU, whether or not they are established in the EU;
- deployers of AI systems established or located in the EU;
- providers and deployers established or located in a third country, where the output produced by the AI system is used in the EU.
A provider develops an AI system and places it on the market under its own name. A deployer uses an AI system under its own authority in a professional activity.
Three Gulf situations follow from that:
- You sell an AI-powered product to European customers — a booking assistant, a document-processing tool, a chatbot builder. You are a provider placing it on the EU market.
- Your own website chatbot serves European visitors. You are a deployer outside the EU whose system’s output is used in the EU. This is the case most likely to catch a services business by surprise.
- You build a chatbot for a European client. The client is the deployer. You may be the provider, depending on whose name the system carries and who places it on the market. Settle that in the contract, because the obligations differ.
An Omani business whose chatbot answers customers in Muscat and Dubai, in Arabic and English, with no European audience, is not in scope on these facts.
What Article 50 asks of a chatbot
Tell people they are dealing with an AI
Article 50(1) requires providers to design and develop AI systems intended to interact directly with people so that the people concerned are informed they are interacting with an AI system. The exception is where that is obvious to a reasonably well-informed, observant and circumspect person, given the circumstances and context.
Do not rely on the exception. A chatbot named “Sara” with a human photo and a conversational tone is exactly the case where it is not obvious. A short line at the start of the conversation costs nothing — “You’re chatting with our AI assistant. A person can take over at any time.” It is sensible practice for every visitor, not only those in Europe.
Say it in time, and accessibly
Article 50(5) requires the information to be given in a clear and distinguishable manner, at the latest at the time of the first interaction or exposure. It must also meet applicable accessibility requirements. A disclosure buried in the privacy policy does not meet this. Neither does one shown only after the third message.
Mark generated content
Article 50(2) requires providers of AI systems that generate synthetic audio, image, video or text to ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. There is an exception for systems that only assist standard editing or do not substantially alter the input.
For a business deploying a third-party model, this obligation sits mainly with the model or system provider. If you build your own generator — say, a product description writer you sell to European shops — it may sit with you. The Omnibus gave systems already on the market before 2 August 2026 until 2 December 2026 to comply with this marking duty only.
Disclose deep fakes and public-interest text
Article 50(4) requires deployers of systems that generate or manipulate deep fakes to disclose that the content is artificially generated or manipulated. There is a lighter form for evidently artistic, satirical or fictional work. It also requires disclosure of AI-generated text published to inform the public on matters of public interest, unless the text has undergone human review or editorial control and someone holds editorial responsibility.
A company blog written with AI assistance and edited by a responsible person falls into the editorial-control exception. An AI-generated “news” feed published without review does not.
Fines
Article 99 sets the ceilings. Breaching the Article 50 transparency duties can bring a fine of up to €15 million or 3% of total worldwide annual turnover of the preceding year, whichever is higher. Prohibited practices carry up to €35 million or 7%. For SMEs, including start-ups, each fine is capped at whichever of the two amounts is lower.
How a European authority would enforce against a deployer with no EU presence is a practical question the text does not answer. That does not change what a European client will require of you in a contract.
What the July 2026 Omnibus changed
Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. Its main effect was to move the high-risk deadlines:
- Annex III high-risk systems — AI used in areas such as employment, education, access to essential services and creditworthiness — now apply from 2 December 2027.
- High-risk AI embedded in products covered by EU product legislation now applies from 2 August 2028.
It left the Article 50 transparency date in place, apart from the marking grace period described above.
For a Gulf business, the high-risk delay matters if you sell certain products into Europe. Examples are hiring software that screens CVs, credit-scoring tools, and exam-proctoring systems. Those now have until December 2027. Use the time to build documentation, human oversight and logging, not to postpone thinking about it. A customer-service chatbot is not high-risk under Annex III merely because it is a chatbot.
The same principles are arriving at home
None of this is only European. Oman’s Personal Data Protection Law, amended in September 2026, gives people the right to object to decisions resulting from automated processing and requires human review of decisions they object to. What Royal Decree 68/2026 changed explains the obligation. The DIFC has regulated personal data processed through autonomous systems since 2023. Saudi Arabia’s draft data protection amendments would require impact assessments for automated decisions.
AI rules in Oman and the GCC maps the regional picture. The practical point is that a chatbot built to Article 50 standards — disclosed, with a human route, logged — is already close to what Gulf regulators are moving towards.
What to do
- Check whether European people use your chatbot or AI product. Look at traffic, delivery addresses and customer locations rather than guessing.
- Add an AI disclosure at the first interaction in every language the bot speaks, whether or not the Act strictly requires it.
- Offer a human route — a visible way to reach a person — and log when it is used.
- Decide who the provider is in any contract where you build AI for a European client, and allocate the Article 50 duties accordingly.
- If you sell high-risk AI into Europe, start the documentation and oversight work now; December 2027 is closer than it looks for regulated buyers’ procurement cycles.
How the bot itself should be designed — knowledge, guardrails, handoff — is covered in how a custom business chatbot is actually built.
Frequently asked questions
Does the EU AI Act apply to my chatbot in Oman? If people in the EU interact with it, the Act can apply, because it covers providers and deployers outside the EU where the AI system’s output is used in the Union. A chatbot serving only Gulf customers is outside it on those facts.
What must my chatbot tell users under the AI Act? That they are interacting with an AI system, unless that is obvious from the context. The information must be clear and distinguishable and given no later than the first interaction. Article 50(1) and (5) set this out.
When did the chatbot disclosure rule start? On 2 August 2026. The Digital Omnibus on AI of July 2026 postponed the high-risk deadlines but did not postpone the Article 50 transparency duties.
Is a customer-service chatbot a high-risk AI system? Not because it is a chatbot. High-risk status depends on the use, such as employment decisions, creditworthiness or access to essential services, listed in Annex III. Those obligations now apply from 2 December 2027.
What are the fines for breaching the transparency rules? Up to €15 million or 3% of total worldwide annual turnover of the preceding year, whichever is higher. For SMEs the lower of the two amounts applies.
Do I have to label everything AI writes on my website? The labelling duty for text applies to AI-generated text published to inform the public on matters of public interest. It does not apply where the text has had human review or editorial control and a person holds editorial responsibility. Ordinary edited marketing copy is not the target.
This article states the position under Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, as in force on 21 October 2026, the date of publication. It is not legal advice. Guidance and codes of practice under Article 50 continue to develop; confirm your position with a qualified adviser.
Sources: Regulation (EU) 2026/1744 — Digital Omnibus on AI (Official Journal) · AI Act consolidated text as of 27 July 2026 (EUR-Lex) · AI Act Article 50 — transparency obligations · AI Act Article 2 — scope · AI Act Article 99 — penalties · Hunton — EU Digital Omnibus on AI enters into force
Building a chatbot that serves customers in more than one region? ZAWAT builds AI and automation with disclosure, human handoff and logging designed in from the start. Book a call.