Does the EU AI Act apply to Chrome extensions?

Last checked 23 October 2026 · About 8 minutes · Not legal advice

Are you a "provider" if you just call OpenAI's API?

Most AI extensions don't train a model. They send text to OpenAI, Anthropic, Google or another service and show the result. It's tempting to think the AI Act is the model company's problem. It isn't only theirs.

The Act defines a provider as anyone who develops an AI system and offers it under their own name, "whether for payment or free of charge" (Article 3(3)). It also names the exact case of building on someone else's model: a "downstream provider" is a provider of an AI system that integrates an AI model, including one supplied by another company (Article 3(68)). Your extension is that AI system. The model company has its own duties; you have yours.

Being outside the EU doesn't take you out

The Act covers providers that put AI systems on the EU market wherever they are based, and also providers in other countries when the system's output is used in the EU (Article 2(1)(a) and (c)). If people in the EU can install your extension from the Chrome Web Store, assume you're in scope.

Neither does being free or open source

The provider definition covers free products. The Act also has an exemption for AI systems released under free and open-source licences, but it explicitly does not apply to systems that fall under Article 50 (Article 2(12)). A free, open-source AI chat extension still has these transparency duties.

What Article 50 asks of you

1. Tell people when they're interacting with AI

If your extension is meant to interact directly with people, like a chat panel, an assistant or an AI agent, it must tell them they're dealing with an AI system (Article 50(1)). The notice must be clear and must come at the latest at the first interaction (Article 50(5)).

In practice: a plain line at the top of the chat, a visible badge near the input box, or the first message. A sentence in your terms of service isn't enough, and neither is a vague label like "Assistant". For example:

"You're chatting with an AI assistant. It can make mistakes, so check important information."

There's an exception when it's obvious from the context that you're dealing with AI. Don't lean on it: in its draft guidelines the Commission read it narrowly, asking providers to think about their actual users, including less tech-savvy ones. A one-line notice is cheaper than an argument.

2. Mark AI-generated content in a machine-readable way

Providers of AI systems that generate synthetic text, images, audio or video must make sure the output is marked in a machine-readable format and detectable as AI-generated (Article 50(2)). This is the duty with the 2 December 2026 deadline for systems already on the market.

The rule asks for solutions that are effective, interoperable, robust and reliable "as far as this is technically feasible", taking into account the type of content, cost and the state of the art. That matters for text, where reliable marking is still hard. What's reasonable today:

• Images, audio and video: keep or add C2PA Content Credentials or IPTC "digital source type" metadata. Some image APIs already embed it, so check that your own resizing or download step doesn't strip it.
• Text: ask your model provider whether its output carries a watermark you can rely on. According to a law-firm summary of the Commission's final guidelines, a downstream provider may rely on marking done at the model level but still has to show that it works. Where your extension creates files, add metadata to them.
• Either way: write down the method you chose, why, and how you tested it. The Commission expects providers to document these choices and revisit them as the technology improves.

The editing exception

Article 50(2) does not apply where the AI only performs an assistive function for standard editing, or does not substantially change the user's input or its meaning. According to the same summary, the Commission's guidelines give AI translation and standard editing that doesn't change substance or meaning as examples.

So a pure grammar and spelling checker may not need marking. A "rewrite this to sound more confident" button is less clear, and "write a reply to this email" is generating new content. If you run a writing tool, list your features, sort them into "edits" and "writes", and keep that reasoning on file.

3. Your users have their own duty

People who publish AI-generated text to inform the public on matters of public interest, or who share realistic AI images, audio or video (deepfakes), must disclose that (Article 50(4)). The text duty doesn't apply where a person reviewed the text and someone holds editorial responsibility for it. People using AI for purely personal, non-professional purposes are outside the Act's deployer duties (Article 2(10)).

This duty sits with your users, not with you. But if your extension writes posts, comments or articles, a short help-page note or a "copy with AI label" option is a cheap way to help them.

Key dates

What are the fines?

Breaching Article 50 can cost up to €15 million or 3% of worldwide annual turnover, whichever is higher. For SMEs and start-ups, the cap is whichever of the two is lower (Article 99(4) and (6)). Enforcement is done by national market surveillance authorities.

A 30-minute checklist

1. List your AI features. For each one: does it chat with users, write new content, or only edit what the user wrote? What does it output: text, images, audio, video?
2. Find your launch date. When did each AI feature first become available to EU users? Before or after 2 August 2026 decides your marking deadline.
3. Add the AI notice. Wherever users interact with the AI, add a clear one-line notice that shows up at or before the first interaction.
4. Decide on marking. For each feature that generates content, pick a marking method, or write down why the editing exception applies.
5. Keep a record. One page: your role, features, notice, marking method, editing reasoning, date. It's what you'd show an authority that asks.
6. Update your store listing and privacy policy. Name the AI services that receive user text. That's good practice anyway, and EU data protection law may require it.

Common questions

My extension is free. Does the AI Act still apply?

Probably. The provider definition covers AI systems offered "whether for payment or free of charge", and the open-source exemption does not cover systems that fall under Article 50.

Users bring their own OpenAI or Gemini API key. Am I still the provider?

Very likely. Being a provider depends on developing the AI system and offering it under your own name, not on who pays for the model calls. Your extension is still the product that talks to users and generates their content.

My extension only fixes grammar. Do I need to mark its output?

Possibly not, thanks to the editing exception above. Rewrites that change meaning, or features that write new text, are different. Write down which features you treat as editing and why.

Does Chrome's built-in AI (Gemini Nano) change anything?

Not your role. If your extension uses the on-device model to chat or write for users, it's still your AI system offered under your name. Running locally helps with privacy, not with Article 50.

Is the Cyber Resilience Act the same thing?

No. The CRA is a separate EU law about the cybersecurity of products, including paid browser extensions. It applies whether or not you use AI. Here's what it asks of extension developers.

Sources

• Regulation (EU) 2024/1689 (AI Act), Articles 2, 3, 50 and 99, on EUR-Lex. Consolidated text with Omnibus labels: AI Act Service Desk.
• European Commission, Guidelines on transparency obligations for providers and deployers of AI systems (20 July 2026).
• European Commission, Code of Practice on transparency of AI-generated content.
• Stephenson Harwood, European Commission adopts guidelines on Article 50 transparency obligations.
• White & Case, EU AI Omnibus enters into force, amending the AI Act.
• William Fry, AI Act Articles 50(1) and 50(2): transparency obligations (on the draft guidelines).