Yes: since 2 August 2026, the transparency rules of Article 50 of the EU AI Act apply, and a chatbot must make clear to users that they are dealing with an AI system, at the latest at the first interaction. The only exception is where this is already obvious to a reasonably well-informed user.
For most customer-service and website chatbots, that disclosure is the core obligation, and it is easy and inexpensive to meet. A chatbot that helps decide on job applicants, credit or access to essential services is a different matter: it may be a high-risk system, with much stricter rules that apply from 2 December 2027. Below we explain what changed, how to classify your chatbot and what to do now, including the overlap with the GDPR.
Table of contents
What changed on 2 August 2026?
The transparency obligations in Article 50 of the AI Act became applicable. For chatbots, this means users must be clearly informed that they are interacting with an AI system, at the latest at the moment of the first interaction or exposure (Article 50(1) and (5) of Regulation (EU) 2024/1689).
The information must be clear and distinguishable and must meet accessibility requirements. A line in your terms and conditions, cookie banner or page footer is not enough. If a reasonable user could think they are chatting with a human, the chatbot does not comply. Do not rely lightly on the exception for situations where the AI nature is obvious.
A related deadline follows. Providers of AI systems that generate synthetic audio, images, video or text must mark that output in a machine-readable format so that it can be detected as artificially generated (Article 50(2)). For systems placed on the market before 2 August 2026, the AI Omnibus, in force since 27 July 2026, allows until 2 December 2026 to comply. If your chatbot generates content that could pass for human-made, this deadline is relevant to you or your vendor.
Earlier phases already apply. The prohibited AI practices in Article 5 have applied since 2 February 2025, and the obligations for general-purpose AI models since 2 August 2025.
Is your chatbot limited-risk or high-risk?
Most customer-service and website chatbots are not high-risk; they fall under the transparency rules only. What matters is how you use the chatbot, not how advanced the underlying model is.
For a standard support or FAQ bot, telling users they are dealing with AI may be close to the whole story under the AI Act. A chatbot becomes high-risk if it is used to make or materially support important decisions about people in an area listed in Annex III, for example:
- employment decisions, such as recruitment, screening, promotion or dismissal;
- assessing creditworthiness or establishing a credit score;
- deciding on eligibility for or access to essential public or private services and benefits, such as social benefits or certain life and health insurance;
- other Annex III uses that affect fundamental rights.
High-risk systems are subject to much stricter requirements, including risk management, data governance, technical documentation, logging, human oversight and a conformity assessment. The AI Omnibus postponed the Annex III obligations to 2 December 2027. If your use case is heading in that direction, design for those requirements now, because rebuilding a system later is more expensive.
A quick self-assessment
Ask yourself three questions:
- Does the chatbot only inform, guide or route, for example answering FAQs, tracking orders or handing over to a human? Then it is very likely limited-risk; focus on transparency.
- Does it decide, score or control access for individuals, for example approving or rejecting, ranking candidates or assessing risk? Then it may be high-risk; take legal advice before you deploy it.
- Does it generate text, images or audio that could look human-made? Then check the machine-readable marking duty and the 2 December 2026 deadline for existing systems.
Who is responsible: you or your vendor?
It depends on your role. The disclosure duty for chatbots in Article 50(1) rests on the provider, the party that develops the AI system or has it developed and places it on the market or puts it into service under its own name.
A business that builds its own chatbot on top of a third-party language model and offers it under its own name will often itself be the provider of that chatbot. A business that simply uses a vendor’s ready-made chatbot is usually a deployer. In both cases the chatbot runs on your website, so a missing notice reflects on you. Agree in writing with your vendor who does what, and check the result in the chat window itself.
How do you make your chatbot compliant?
Start with a clear AI notice in the chat window, then put oversight, records and vendor arrangements in place. In the Netherlands, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) and the Dutch Authority for Digital Infrastructure (RDI) are expected to coordinate AI supervision.
Tell users at the first interaction
Add an unambiguous notice before or at the start of the conversation, in the chat window itself: in the opening message, the header, or both. A link to a policy is not enough. Examples of wording:
- Hello, I am the AI assistant of [company]. I can help with common questions and put you in touch with a colleague if needed.
- You are chatting with a virtual (AI) assistant, not with an employee.
Provide human oversight and a route to a person
Offer a clear and easy route to a human, such as a button to talk to a colleague. Make sure staff can review, correct and take over conversations, especially where the bot deals with complaints, contracts, payments or vulnerable users.
Keep records and monitor
Keep records of conversations and system behaviour so that you can check performance, investigate complaints and detect errors or misuse. Monitor for made-up answers and inappropriate output, and set thresholds for human review. Keep in mind that chat logs contain personal data, so set retention periods.
Check your vendor
Most businesses buy their chatbot rather than build it. Ask your vendor to confirm in writing that the system supports the AI Act transparency rules and, where relevant, machine-readable marking of synthetic content by 2 December 2026. Record in the contract who is the provider and who is the deployer, and allocate responsibilities, warranties and indemnities accordingly.
Support AI literacy among staff
Under Article 4 of the AI Act, as amended by the AI Omnibus, providers and deployers must take measures to support a sufficient level of AI literacy among the people who operate AI systems on their behalf. Train the teams that manage, supervise or rely on the chatbot, so that they understand its limits, the escalation rules and how data is handled.
Document your choices
Keep a short internal record: what the chatbot does, its risk classification, the notice used, the oversight measures, the vendor and the data it processes. That record is your evidence if a regulator or customer asks questions.
Does the GDPR also apply to your chatbot?
Yes. A chatbot can comply fully with the AI Act and still breach the General Data Protection Regulation (GDPR). The two regimes apply side by side, and you must meet both.
- Lawful basis: identify a valid basis under Article 6 GDPR, usually legitimate interest or consent, for processing the personal data users type into the chat.
- Privacy notice: your privacy statement must explain that a chatbot processes personal data, for which purposes, how long it is kept and whether it is used to train AI models.
- Data minimisation: do not collect more than you need, and do not invite users to share special categories of data, such as health information.
- Rights and transfers: make sure requests for access or erasure can be handled, and check where your vendor stores and processes the data, particularly outside the European Economic Area.
The AI Act notice that the user is talking to an AI and the GDPR notice explaining how you use their data are separate obligations. You need both.
What are the penalties?
The AI Act sets high maximum fines in Article 99. For companies, the higher of the fixed amount and the percentage of worldwide annual turnover applies; for SMEs and start-ups, the lower of the two.
- up to €35 million or 7% of total worldwide annual turnover for prohibited AI practices;
- up to €15 million or 3% for breaches of most other obligations, including the transparency rules in Article 50;
- up to €7.5 million or 1% for supplying incorrect, incomplete or misleading information to authorities.
For a limited-risk chatbot, the more immediate risk is an order to comply and damage to your reputation. A missing AI notice is a visible failing that a regulator or complainant will spot quickly, and it is easy to fix.
What should you check as a provider?
If you build the chatbot or offer it under your own name, the Article 50 duties rest on you. Check:
- The AI notice appears in the chat window at the first interaction, not only in your terms.
- Generated text, audio or images are marked in a machine-readable format (Article 50(2)), for existing systems by 2 December 2026.
- The chatbot’s use does not fall under Annex III; if it might, plan for the high-risk requirements that apply from 2 December 2027.
- Your technical records show what the system does and how it is monitored.
- Your customers receive what they need to inform their own users.
What should you check as a deployer?
If you use a vendor’s chatbot, you still answer for what happens on your website. Check:
- The contract states who is provider and who is deployer, with warranties on AI Act compliance.
- The notice is actually visible in your chat window.
- Staff who supervise the chatbot have had AI literacy training (Article 4).
- Users can reach a person, and sensitive questions are routed to staff.
- Your privacy statement covers the chat data, with a lawful basis under Article 6 GDPR and a retention period.
What can we do for you with chatbot compliance?
Our IT lawyers review chatbots under the AI Act and the GDPR.
- We classify your chatbot: limited-risk or high-risk under Annex III.
- We draft the AI notice and the privacy statement for the chat function.
- We review and negotiate the vendor contract, including roles, warranties and indemnities.
- We set up the internal record of choices, oversight and retention periods.
- We advise on the marking duty for generated content before 2 December 2026.
Summary
- Since 2 August 2026, users must be told clearly, at the first interaction, that they are dealing with an AI chatbot.
- Most customer-service chatbots are limited-risk; chatbots used for decisions on employment, credit or essential services may be high-risk, with rules applying from 2 December 2027.
- Existing systems that generate synthetic content must support machine-readable marking by 2 December 2026.
- Agree roles with your vendor in writing, support AI literacy and document your choices.
- The GDPR applies alongside the AI Act; you need both an AI notice and a privacy notice.
Frequently asked questions
Do the chatbot rules really apply now?
Yes. The transparency obligations in Article 50 of the AI Act have applied since 2 August 2026. The AI Omnibus, in force since 27 July 2026, did not postpone them.
Do I have to tell users my chatbot is AI?
Yes, clearly and at the latest at the first interaction, unless it is obvious to a reasonably well-informed user. Put the notice in the chat window itself, not in your terms and conditions.
Is my customer-service chatbot high-risk?
Usually not. It may become high-risk if it is used for important decisions about people in an Annex III area, such as employment, creditworthiness or access to essential services; those rules apply from 2 December 2027.
We use a third-party chatbot. Are we still responsible?
Partly. The disclosure duty rests on the provider, but if you offer the chatbot under your own name you may be the provider yourself, and as a deployer you have your own obligations, such as supporting AI literacy. Agree the roles with your vendor in writing.
Does compliance with the AI Act mean I comply with the GDPR?
No. They are separate regimes and you must meet both, including a lawful basis for processing chat data under Article 6 GDPR and a clear privacy notice.
