Website chatbots and the AI Act: what to say and where

What the law asks

Article 50 of the European regulation 2024/1689, the AI Act, says people interacting with an AI system must be told so, unless it's obvious. The information has to be clear and distinguishable, at the latest at the first interaction, and must meet accessibility requirements. As a regulation it applies directly in Italy and across the EU.

Whoever publishes deepfakes must disclose them. Fines for article 50 go up to EUR 15 million or 3% of worldwide turnover, and for small and medium companies the lower of the two applies (article 99).

Where I usually find it

• the chatbot on the site, with no word to say it isn't a person;
• WhatsApp and Messenger, where the first message looks written by a shop assistant;
• automatic email replies signed with an employee's name;
• the voice answering the phone;
• AI-generated photos of people, used as testimonials.

What I do

I list the points where your customers meet an AI, including the ones an agency installed years ago. Then I add the notice to the first message, as real text so a screen reader can read it. I add a way to reach a person, which the law doesn't ask for but usually heads off complaints, and I update the privacy notice if messages go through an outside supplier.

If the chatbot is still to be built, I build it this way from the start: it answers from your texts and price lists, says it's an AI, and hands the conversation to you when it doesn't know. There's more in AI for business.

What this doesn't cover

The AI Act has other parts, such as high-risk systems for hiring or credit: those need a consultant, and my work doesn't reach that far. This page summarises rules as read on 30 October 2026 and is not legal advice.

If your site is Swiss and you have EU customers, see Swiss online shop with EU customers.

Frequently asked questions

Wasn't the AI Act delayed?

In part. Regulation 2026/1744 moves high-risk systems to 2 December 2027, and those built into products to 2 August 2028. The transparency rules in article 50 apply from 2 August 2026. The exception is the machine-readable marking of generated content, with time until 2 December 2026 for systems already on the market.

The chatbot comes from a supplier. Is the duty theirs or mine?

The duty to inform people falls on the provider of the system. If you have a chatbot developed and put it into service under your own name, you may be the provider. I check what shows on the site; who answers for what depends on the contract, read by a lawyer.

What if the chatbot has a person's name and photo?

Article 50 only leaves out cases where it's obvious you're dealing with an AI. A fake assistant with a name and a photo points the other way, so I put a visible notice in the very first message.

Do I have to label blog posts written with AI?

The duty on text covers content published to inform the public on matters of public interest, and it falls away if a person has reviewed it and holds editorial responsibility. A company's articles, reread by whoever publishes them, are usually outside. Deepfakes, meaning images, audio and video that look real, do have to be disclosed.

Read more

• The service: Integrations and automation
• More pages like this: New rules to comply with