Do AI-written emails need to say so? The EU AI Act’s disclosure rule

If an AI agent emails people and corresponds with them itself, then in the EU, since 2 August 2026, it generally has to tell them they’re dealing with an AI, unless that’s obvious. The European Commission’s guidelines on the rule add that it should name the person it acts for. An email a person writes with AI help, reviews and sends as their own is different: the Commission puts that outside the duty to tell people. This guide explains where things stand in October 2026. It’s general information, not legal advice.

What does Article 50 say?

Article 50 of the AI Act (Regulation (EU) 2024/1689) sets out transparency duties. Four of its paragraphs matter for email:

• 50(1), talking to people. Providers must design AI systems meant to interact directly with people so that those people are informed they’re interacting with an AI system, unless that’s obvious to a reasonably well-informed, observant and circumspect person in the circumstances.
• 50(2), machine-readable marking. Providers of systems that generate synthetic audio, images, video or text must mark the output in a machine-readable format, so it can be detected as AI-generated, unless the system only assists with standard editing or doesn’t substantially change what it’s given.
• 50(4), public-interest text. Deployers must disclose AI-generated text published to inform the public on matters of public interest, unless a person has reviewed it and someone holds editorial responsibility.
• 50(5), how and when. Clearly and distinguishably, at the latest at the first interaction or exposure, and accessibly.

Article 50 has applied since 2 August 2026. An amendment in July 2026 gave generative systems already on the market before then until 2 December 2026 for the marking in 50(2), and nothing else. Breaches can be fined up to €15 million or 3% of worldwide annual turnover, whichever is higher, or whichever is lower for small and medium-sized companies. Each EU country sets its own penalties within those limits.

Does it apply to AI agents that send email?

An agent that writes to people, reads their replies and answers them is interacting with them directly, which is what 50(1) covers. The Commission’s guidelines on Article 50 name managing correspondence among the jobs AI agents do, and say agents must disclose both that they’re artificial and the person on whose behalf they act. They count email as a way of interacting, and their example of a good disclosure is an AI agent’s email with an AI label at the top. A mention only in terms and conditions, or only in metadata people can’t see, isn’t enough.

The Commission approved the guidelines’ content on 20 July 2026; they apply once it formally adopts them in every EU language. Like all such guidelines they aren’t binding, and only the EU’s Court of Justice can interpret the Act with authority, but they show how regulators read it.

In practice, few people who get an email from billing@ assume an AI wrote it, so the “obvious” exception rarely helps. Say it.

AI-assisted or AI-sent: which emails need a label?

Separately, 50(2) asks whoever provides a system that generates text, an email tool’s AI writing feature included, to mark that text in a machine-readable way, unless the system only does standard editing such as fixing grammar or translating. That marking is for software to detect, the Commission’s code of practice sets out how, and it doesn’t replace telling the person.

Who is responsible: the email provider, the agent’s maker or you?

The duty in 50(1) sits with the provider: whoever develops an AI system, or has it developed, and puts it into service under its own name. The Commission’s guidelines say a company that builds a chatbot in-house and runs it under its own name is its provider, and an email agent is no different. If you use an agent someone else built, they’re likely its provider and you’re its deployer. Either way, the disclosure has to reach the person reading the email, so check that the tool you use adds it, and that nothing in your setup removes it.

What should the disclosure say, and where?

• That it’s an AI, and for whom. Name the agent and the person or company it works for: “Sent by Billing assistant, an AI agent working for Ana Ruiz at Acme.”
• Where people will see it. In the email itself, not only in a header or your terms. The guidelines’ example puts the label at the top of the email. A line at the end is visible too, but in a long email the top is read first.
• In every email. The rule asks for it at the first interaction at the latest, and the guidelines suggest one prominent notice is often enough. But emails get forwarded and threads pick up new people, so putting it in every email is simpler and safer.
• Where the agent can’t remove it. Add it after the agent has written the email, outside its control, so a mistake or a manipulated agent can’t hide or delete it (prompt injection by email).
• Plus a header for machines. Useful for filters and audits, as an addition to the visible line, never a replacement.

What about outside the EU?

The AI Act also covers providers and deployers outside the EU when their AI system’s output is used in the EU, so an agent that emails people in the EU can be covered wherever it runs. Elsewhere, the rules vary:

• California makes it unlawful to use a bot online to mislead someone about its artificial identity to get them to buy something or to influence a vote, unless the bot discloses what it is. The law is written for public-facing websites and apps; whether it reaches one-to-one email is untested.
• Utah requires a business using generative AI with consumers to say so if they clearly ask, and people in regulated occupations to disclose high-risk AI interactions up front.
• Maine treats using a chatbot in a way that could make a consumer think they’re dealing with a human as an unfair trade practice, unless it’s clearly disclosed.
• US federal law has no AI disclosure rule for email, but commercial email must follow CAN-SPAM whoever writes it, and each email that breaks it can cost up to $53,088.

If your agent writes to people in several countries, a clear line in every email is the simplest way to meet all of them.

How does SuperMailOS handle it?

Every email an agent inbox sends ends with a line naming the agent and the person and company it works for, like “Sent by Billing assistant, an AI agent working for Ana Ruiz at Acme.” It’s added after the agent has written the email, in both the HTML and the plain-text versions, and the agent’s HTML is sealed first so nothing it writes can hide, restyle or cover the line. Each email also carries a header saying an AI agent sent it. The line is on by default, and only a workspace admin can turn it off. The agent inboxes guide has the details.

Sources

• Regulation (EU) 2024/1689 (the AI Act): Article 2 (scope), Article 3 (definitions), Article 50 (transparency), Article 99 (penalties) and Article 113 (dates), and the amending Regulation (EU) 2026/1744.
• European Commission, Guidelines on the transparency obligations of providers and deployers of AI systems (content approved 20 July 2026), and the Code of Practice on AI-generated content.
• California Business and Professions Code sections 17940–17943; Utah Code title 13, chapter 77; Maine Revised Statutes, title 10, section 1500-DD.
• US Federal Trade Commission, CAN-SPAM Act: a compliance guide for business.

Questions