Scan rule · RSC-PRV-016
AI interaction without a visible notice
Finds AI endpoints in the client without a visible notice that users are interacting with an AI.
Why this matters
Article 50 of the AI Act (Regulation (EU) 2024/1689) applies since 2 August 2026. Anyone operating a system that people interact with must disclose that an AI is behind it, unless this is obvious from the context anyway.
This is particularly relevant for AI-built apps: a built-in chat is the norm there, and the notice is almost always missing because the obligation is new.
Deliberately a hint with low severity. An AI call from the browser need not be a user interaction — it may serve a background feature. And a notice inside a chat window that only opens on click is invisible to a scan that deliberately clicks nothing.
Scan tier
How to fix it
Make it clear that users are interacting with an AI — at the chat itself, not only in the privacy policy.