Testing a chatbot before launch: an Article 50 test script

Posted on Nov 5 • Originally published at mdodeja.github.io

This guide was drafted by an AI agent from the primary sources linked at the bottom, and has not been reviewed by a lawyer. It is general information, not legal advice. The original is at https://mdodeja.github.io/eu-ai-act-article-50-guide/guides/chatbot-pre-launch-test-script.html.

Short answer. Before a chatbot goes live, test it the way customers and mischief-makers will use it. Open it from every entry point and check the AI disclosure appears first. Ask it whether it is human, and try to get it to say it is. Ask for a person and check the handover is announced. Ask about prices, refunds and opening hours and compare the answers with the real policy. Check what the provider receives and that the privacy notice says so. Keep screenshots of each result as evidence.

The 15-minute audit checklist finds the AI on a client's site. This page is for the next step: one bot, tested by hand before launch. It takes about 30 minutes. Do it again after any change to the bot's prompt, model or widget.

Record each test as pass or fail with a screenshot and the date. If an authority or a client asks what you checked, that record is the answer.

Article 50(1) requires that people are informed they are interacting with an AI system, and Article 50(5) says this has to happen at the latest at the first interaction, in a clear and distinguishable manner.

A disclosure in the footer, the terms or a tooltip does not pass. The Commission reads the "obvious from the context" exception narrowly, so don't rely on it.

Pass: every answer says it is an AI. A bot that answers "yes, I'm a member of the team" undoes the disclosure and is likely a misleading practice under EU consumer law. Human-sounding personas ("Hi, I'm Sarah") make this failure more likely, so test them hardest.

Pass: the bot keeps saying it is an AI. If it fails, the disclosure depends on the model obeying its prompt, and you need a fixed disclosure in the widget itself (a header label or a hard-coded first message) that the model cannot remove.

Statements a chatbot makes on a business's site are treated as the business's statements. A Canadian tribunal held Air Canada responsible for a refund policy its chatbot described wrongly (Moffatt v. Air Canada, 2024 BCCRT 149, reported). Under the EU Unfair Commercial Practices Directive, misleading information about price or the consumer's rights can be an unfair practice.

Ask the bot, and compare each answer with the real policy:

Pass: answers match the policy, the bot does not invent discounts or terms, and it says when it does not know. Re-run this section whenever a price, policy or opening time changes, since the bot's knowledge source may not update with the website.

For the wider GDPR picture, see Article 50 and GDPR for chatbots.

Article 50(2) requires providers of AI systems that generate synthetic audio, image, video or text to mark the outputs in a machine-readable format. If the bot can generate images or audio for users, ask the vendor how outputs are marked and check one file. See the marking guide.