Why AI disclosure compliance is not a one-time checkbox
Article 50 compliance work has a shape that fools people. There is a burst of effort — read the rules, find the setting, write the sentence and screenshot it — and then a clean result, and the item leaves the register.
It should not. Not because the law changes often, but because your site changes constantly, and nothing in your stack notices when a change removes a disclosure. The duty is continuous. Your evidence of meeting it is a single day.
Six ways a disclosure disappears without anyone deciding to remove it#
None of these are hypothetical failure modes invented to justify a product. They are the ordinary mechanics of running a website.
A vendor ships a change. Chat widgets update themselves. A new default greeting, a redesigned panel, a moved header label — all of it lands on your site without a deploy on your side and without a changelog anyone on your team reads.
Someone edits the greeting. The AI disclosure sits in the same field as the welcome message, which is marketing copy that gets optimised. "You're chatting with an AI assistant. How can I help?" becomes "Hi! 👋 How can I help?" in a conversion test, and the disclosure leaves with it. This is the most common single cause we see, and it is nobody's mistake — the person editing the field did not know it was load-bearing.
A redesign moves the furniture. New theme, new breakpoints, and the header label that carried the disclosure on mobile is now hidden below 768px.
A consent banner starts covering the launcher. A CMP update changes the overlay's position and now sits over the corner where the chat bubble lives. The disclosure is intact; the visitor never reaches it.
The pipeline starts stripping metadata. A new image optimiser, a CDN configuration change, a format conversion — and published media that carried provenance marking last quarter arrives bare.
A migration. New chat vendor, new CMS, new stack. Everything gets rebuilt and the disclosure is one of the small things nobody's ticket covered.
What these share: no error is raised and no test fails. No alert fires, and the site keeps working perfectly. The only way to find out is to look.
Point-in-time evidence proves a point in time#
The second reason this cannot be a one-off is evidentiary, and it is the one that costs money later.
The question you get asked is not "is your disclosure correct today?" — anyone can check that themselves in ninety seconds. It is "what did your site show in October?" A single screenshot from the day you did the work answers a question nobody asked.
What answers the real question is a series: the same check, run repeatedly, each run dated and recorded. A run every quarter across a year is a defensible position. A run from fourteen months ago is an anecdote.
There is a second-order benefit to a series that a single capture cannot give you. If a regression does occur, a cadence bounds it: you can show the disclosure was present on 1 March, absent on 1 June, and restored on 8 June. That is a remediation timeline. Without the cadence, the same facts look like "we don't know when it broke or how long it was broken," which is a materially worse story with exactly the same underlying conduct.
Which is also why the instinct to keep only the clean records is wrong. See how to prove your disclosure was live on a specific date.
What a monitoring cadence should cover#
Whatever tooling you use, the coverage matrix is the same one a manual audit needs — it just has to survive being run repeatedly:
- Both viewports
- Desktop and mobile as separate checks. Mobile is where the regressions are.
- More than the homepage
- Widgets are configured per page more often than teams remember.
- The interaction, not the page
- The disclosure lives after a click. A check that fetches HTML and never opens the widget is not checking the thing.
- All four duties
- Chat disclosure, machine-readable marking on published media, visible labels on article-like pages, AI-use policy page.
- Change detection, not just status
- "Still fine" is not information. "This changed since the last run" is.
And the cadence itself: quarterly as a floor, monthly as a sensible default, plus an explicit check either side of any redesign, widget migration, or CMS change. Those are the moments regressions actually happen, and they are moments you know about in advance.
Manual, if you prefer#
There is no requirement to buy anything, and a small site with one page and one widget can run this by hand. The audit procedure is the full manual version, and the printable checklist covers all four duties.
Be realistic about what a manual cadence survives. It needs an owner, a calendar entry, and a place to file the results that will still exist next year — and it competes with everything else that owner does. The failure mode is not that someone runs it badly; it is that the second quarter's run does not happen, and nobody notices for a year.
Automate when the matrix stops fitting in a morning: several sites, several entry points, two viewports on a repeating schedule. The records have to survive long enough to produce later.
What we do#
Our Pro plan runs the scan on a schedule for your site and alerts you when a finding changes between runs — a disclosure that was detected last month and is not detected now. Each run produces its own dated, sealed record, so the series accumulates into the evidence trail described above rather than overwriting itself. Pricing.
Three honest limits, because a monitoring product that oversells itself is worse than none:
- A scan is a sample
- It observes what a visitor could observe at that moment, from outside. A widget that behaves differently for a specific geography or a logged-in state can differ from what we see.
- A change alert is not a verdict
- It tells you something moved. Findings are recorded as detected, not detected, or could not verify, and never as "compliant".
- It does not cover what a crawler cannot see
- Editorial review under Article 50(4), internal notices under 50(3), and your own process records remain yours to keep.
Start with a free homepage scan and see what today's check says. The cadence question only matters once you know where you are standing.
Common questions
How does an AI disclosure disappear on its own?
Six common ways, none of which raises an error or fails a test: a chat vendor ships a redesign or a new default greeting, someone edits the welcome message in a conversion test, a redesign hides the header label below a breakpoint, a consent banner starts covering the launcher, an image pipeline change starts stripping provenance metadata, or a migration rebuilds everything and the disclosure is the small thing nobody's ticket covered.
How often should we re-check our AI disclosure?
Quarterly as a floor, monthly as a sensible default, plus an explicit check either side of any redesign, widget migration or CMS change. Those are the moments regressions actually happen, and they are moments you know about in advance.
Why is a series of checks better than one good screenshot?
Because the question you get asked is historical. A single capture from the day you did the work answers a question nobody asks. A series lets you bound any regression — present on 1 March, absent on 1 June, restored on 8 June — which is a remediation timeline. Without the cadence, the same facts read as "we don't know when it broke or how long it was broken".
Should we keep records of failed checks?
Yes. A record showing a gap and a later record showing it fixed is more useful than an unbroken run of clean captures that conveniently starts after you fixed everything. Deleting the failures removes the evidence of remediation along with the evidence of the gap.
What can automated monitoring not tell us?
It observes what a visitor could observe at that moment, from outside, so a widget that behaves differently for a specific geography or a logged-in state can differ from what a scan sees. A change alert says something moved. It does not say anything is compliant or in breach. And duties that leave no external trace — editorial review under Article 50(4), internal notices under 50(3) — remain yours to record.
Sources and further reading
- Article 50 — Transparency obligations (EU AI Act)
- The State of AI Disclosure 2026 — full method and exclusions
Last updated September 2026. Informational only, not legal advice: this page describes what the text of the EU AI Act says and what an external check can observe, not whether any particular site complies. Corrections welcome at hello@disclosureproof.com.