Website chatbot: what Article 50 of the AI Act requires

Since 2 August 2026, a person who writes to an artificial intelligence (AI) chatbot on a website must be informed that they are not talking to a human, unless this is obvious. This follows from Regulation (EU) 2024/1689 on artificial intelligence (the AI Act): providers shall ensure that AI systems intended to interact directly with people are designed so that those people are informed of this (Article 50(1) of the AI Act). The AI Act generally applies from that date (Article 113, second paragraph, of the AI Act), and the amendment that entered into force on 27 July 2026 – Regulation (EU) 2026/1744 – did not change Article 50(1) to (6) (Article 1, point (20), and Article 4 of Regulation (EU) 2026/1744).

The duty falls on the provider, so the first question is what you are under the AI Act. The second is what the General Data Protection Regulation (EU) 2016/679 (the GDPR) requires for chat transcripts. How the two regulations interact, we explain in the article AI tools and personal data at work.

Are you a provider or a deployer

A provider is whoever develops an AI system or has it developed and places it on the market or puts it into service under its own name or trademark (Article 3(3) of the AI Act). A deployer is whoever uses an AI system under its authority (Article 3(4) of the AI Act).

If a company had a chatbot developed for it and put it into service on its website under its own name, it may be a provider. Both conditions are needed: the system was developed on its instruction, and it was put into service under its name or trademark. If a company only uses a chatbot, for example by embedding another vendor’s ready-made widget that it did not develop or have developed, under the wording of the definitions it is a deployer, and the Article 50(1) duty falls on the widget’s provider. If the company built the chatbot itself, even on another vendor’s language model, and uses it under its own name, it is the chatbot’s provider (Article 3(3) and (68) of the AI Act).

One more question is whether the chatbot is an AI system at all. An AI system is one that infers, from the input it receives, how to generate outputs such as content or recommendations (Article 3(1) of the AI Act). A bot that only shows pre-written answers according to the button pressed may fall outside this definition. What counts is how the system works, not what it is called.

What must be disclosed and when

People must be informed that they are interacting with an AI system. There is no duty where this is obvious to a reasonably well-informed, observant and circumspect person, taking into account the circumstances and the context of use (Article 50(1) of the AI Act). If the chatbot introduces itself with a human name and writes like a consultant, it is hard to argue that this is obvious. The other exception covers only law enforcement systems.

How to inform is set by Article 50(5): the information is provided in a clear and distinguishable manner, at the latest at the time of the first interaction, and must conform to the applicable accessibility requirements. In our assessment, a notice in the chat window itself, visible before the person types their first message, meets this requirement.

If you are a deployer, the Article 50(1) duty does not apply to you directly. Our suggestion (this is not a legal requirement): provide in the contract with the vendor that the widget shows this notice, and do not hide it through your website settings.

When the chatbot generates text

If the chatbot writes its own answers, another provider duty applies. Providers of AI systems generating synthetic text, image, video or audio content ensure that the outputs are marked in a machine-readable format and detectable as artificially generated (Article 50(2) of the AI Act). The duty does not apply where the system performs an assistive function for standard editing or does not substantially alter the input data provided by the deployer or its semantics.

This duty has a transition period: providers of systems placed on the market before 2 August 2026 must comply by 2 December 2026 at the latest (Article 111(4) of the AI Act). There is no such period for informing people that they are talking to AI (Article 50(1)).

If you publish AI-generated text to inform the public on matters of public interest, you must disclose that it was artificially generated, unless it underwent human review or editorial control and someone holds editorial responsibility (Article 50(4), second subparagraph, of the AI Act).

Chat transcripts are personal data

A name, an email address, an order number and any other chat content relating to a visitor who can be identified is personal data (Article 4(1) GDPR). It is processed by the organisation on whose website the chatbot runs: it determines the purposes and means of processing, so it is the controller (Article 4(7) GDPR).

Information. Where data is collected from the person, the controller must, at the time the data is obtained, provide the information listed in Article 13(1) and (2) GDPR, including the purposes and legal basis of processing (Article 13(1)(c) GDPR), the recipients (Article 13(1)(e) GDPR) and the storage period (Article 13(2)(a) GDPR). When and how to update a privacy policy, we explain in the article Privacy policy: is it mandatory and when to update it.

The vendor as processor. A chatbot vendor that processes the chats on your behalf is a processor (Article 4(8) GDPR). You need a contract with it providing that it processes the data only on your documented instructions (Article 28(3)(a) GDPR). What that contract must cover, we explain in the article Data processing agreement: when it is required and what happens without one.

Transfers outside the EEA. If the servers of the vendor or of the model it uses are outside the EEA, the transfer rules apply (Article 44 GDPR), and people must be informed of the transfer (Article 13(1)(f) GDPR). When a transfer needs standard contractual clauses, we explain in the article on transferring personal data outside the EEA.

Storage. Chat transcripts are kept no longer than the purpose requires (Article 5(1)(e) GDPR).

Automated decisions. If the chatbot itself takes a decision that produces legal effects for the person or similarly significantly affects them, Article 22(1) GDPR applies (see the question below).

What can happen

The first risk is an AI Act fine. Non-compliance with the transparency obligations under Article 50, by whichever of the provider or deployer bears the duty, is subject to fines of up to fifteen million euros or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(4)(g) of the AI Act). For SMEs and small mid-cap enterprises the lower of these limits applies (Article 99(6) and (6a) of the AI Act). Member States lay down the rules on penalties and their enforcement (Article 99(1) of the AI Act). If a company had the chatbot developed and uses it under its own name, this risk may fall on the company itself.

The second risk is GDPR fines. Infringing the information duty and other data subject rights may lead to a fine of up to twenty million euros or, for an undertaking, up to 4 % of total worldwide annual turnover, whichever is higher (Article 83(5)(b) GDPR); the same applies to breaches of the transfer rules (Article 83(5)(c) GDPR). For the absence of a processor contract – up to ten million euros or up to 2 % (Article 83(4)(a) GDPR).

The third risk is damages. Any person who has suffered material or non-material damage as a result of a GDPR infringement has the right to receive compensation from the controller or processor (Article 82(1) GDPR).

When to call a lawyer

• when an outside developer builds or adapts the chatbot for you and you need to establish whether you are the provider;
• when you are choosing a chatbot vendor and need to assess the contract, the server location and what the vendor uses the chats for;
• when the chatbot takes decisions on orders, requests or the provision of services.