Chatbots on your site: what they must tell visitors from August 2026.

The EU’s regulation on artificial intelligence (Regulation 2024/1689, known as the AI Act) has one article on transparency, Article 50. Its first paragraph covers every AI system that interacts directly with people: it must be designed so that the person learns they are talking to AI.

The fifth paragraph says how. The information is given in a clear and distinguishable way, at the latest at the first interaction, and it must be accessible to people with disabilities too.

On 20 July 2026, the European Commission published guidelines on Article 50. They aren’t law, but they show how the Commission reads the Act. Among the examples they name explicitly are customer-service chatbots and chatbots in e-commerce.

Article 50 applies from 2 August 2026, to every chatbot, even one added to the site before that date.

On 27 July 2026, Regulation 2026/1744, the so-called AI Omnibus, came into force and postponed the rules for high-risk systems. Article 50 was not postponed. The only transition period concerns the machine-readable marking of content an AI system produces, and the guidelines state explicitly that it doesn’t cover telling people they’re talking to AI.

Dates are day/month/year. A chatbot that answers questions about orders and returns isn’t a high-risk system. The last two rows concern AI that, for example, assesses candidates for a job.

Machine-readable marking is the second, technical obligation of Article 50: anyone who builds an AI system that writes text or creates images, audio or video must mark what it produces in a way computers can recognise. It may also apply to a chatbot that writes its own answers. Visitors don’t see it; it’s a matter for whoever sets up the chatbot, and it’s worth asking how they cover it.

The Act doesn’t require the notice when it’s obvious that you’re talking to AI, to a reasonably well-informed, observant person. The guidelines want this exception kept narrow: it applies only when there’s almost no doubt, for the whole public that may use the system, including older people and those who know little about AI.

As examples where the exception applies, they give assistants for programmers and internal tools for trained staff. As an example where it doesn’t, they give precisely the chatbots on customer-service pages, where visitors may take the answers for a person’s. For a chatbot on your site or eshop, don’t rely on the exception.

The Act doesn’t prescribe specific wording. The guidelines, though, give plenty of examples of what is enough and what isn’t enough on its own:

In some conversations, one notice at the start isn’t enough. When the conversation is about complaints, money, insurance, health or legal matters, or when the chatbot may talk with children or older people, the guidelines consider it likely that reminders are needed during the conversation too.

Article 50 puts the obligation on whoever builds the system, or has it built, and puts it into service under their own name. The Act calls them the “provider” of the system. In practice there are three cases:

• A ready-made chatbot service that you add to your site as it is. Responsibility for the notice lies mainly with the company that offers it under its own name. But check that the notice shows correctly on your own site, because that’s where your customers will see it.
• A chatbot built for you, by your team or a partner, that runs under your business’s name. Then the Act considers your business responsible.
• A ready-made system that you changed substantially, for example with new training data, and run under your name. Then you become responsible for the new system too.

Whichever your case, the notice is a few lines of text. Put it in, and ask whoever supplies your chatbot to tell you in writing how they cover Article 50.

Not everything called a chatbot is AI. According to the guidelines, the Article 50 notice isn’t needed for:

• Chatbots with buttons and ready-made answers, which follow fixed rules, with no AI.
• AI that helps your team draft replies, when a person checks and sends them. But if the AI answers on its own and a person can merely step in, the notice is needed.
• Product recommendations, eshop search and automatic translation, which don’t converse with the visitor.

Product descriptions written by AI aren’t a conversation, so the chatbot notice doesn’t apply to them. Article 50 also asks for marking on AI-generated text published to inform the public on matters of public interest. The guidelines, however, explicitly exclude adverts and product descriptions, unless they make claims about health, consumer safety or sustainability.

Telling visitors they’re talking to AI doesn’t replace what the GDPR asks; the guidelines say so explicitly. Visitors type names, emails, addresses and order numbers into the chatbot, so the conversations are personal data. Four things are needed:

• The privacy policy mentions the chatbot: what it keeps, for what purpose, for how long and who processes it.
• The chatbot asks only for what it needs, and conversations are kept for a set period, not forever.
• A data processing agreement with the company that hosts the chatbot or the model, since it processes data on your behalf.
• A check before any personal detail. If the chatbot shows orders, it first asks for the order number and the email, so that nobody sees someone else’s details.

Since 2 February 2025, Article 4 on AI literacy has applied. As amended in 2026, it asks those who build or use AI systems to take measures so that their team understands the tools it works with. It doesn’t ask you to guarantee a specific level of knowledge for each person. How we do it in practice: AI training for teams.

For a chatbot, in practice this means that whoever manages it knows what it does well, where it can go wrong, and which documents it must not be given.

For Article 50, fines reach €15 million or 3% of worldwide annual turnover, whichever is higher. For small and medium-sized businesses the lower of the two applies, and the authorities take into account how serious the breach is and how the business cooperated.

In the chatbots we set up, the notice is part of the design from day one. Visitors see that they’re talking to an AI assistant before they type anything, the “AI” label stays beside the field where they type, and the question “are you human?” gets a clear answer.

The chatbot answers only from the business’s own documents, shows the source of every answer, and hands over to a person whatever it doesn’t know. See an AI chatbot for businesses step by step.

1. Open the chatbot on your phone, as a visitor. Do you see that it’s AI before you type the first message?
2. See where the notice is. It must be inside the chat window, near the field where you type, and not only in the terms of use.
3. Ask it “Are you human?”. The answer must be clear.
4. Remove the human name and photo, if the chatbot has them.
5. Check the notice with a screen reader, TalkBack on Android or VoiceOver on iPhone.
6. Find out who is responsible. Ask whoever supplies the chatbot to tell you in writing how they cover Article 50, including machine-readable marking.
7. Sort out personal data: the privacy policy, how long conversations are kept and the data processing agreement.
8. Decide when a conversation passes to a person, especially for complaints and money, and tell your team what the chatbot does and doesn’t do.