Website chatbots and the AI Act: what a small business should do

Since 2 August 2026, anyone using an AI chatbot must be told they are not talking to a person. The rule is in Article 50 of the AI Act, the EU’s AI regulation, and it already applies. The EU’s package of amendments from July 2026, Regulation (EU) 2026/1744, did not move the date. The duty falls on the system’s provider, which may be the tool’s maker or your own business. Chat data is a separate matter under the GDPR.

What to do this week

Start with your own chat. If you are only planning a chatbot, do the same before launch.

1. Open the chat as a customer would. Check the AI notice appears before the first message. Ask the chatbot whether it is human.
2. Send your vendor the questions in this article and ask for written answers.
3. Check you have a data processing agreement with the vendor.
4. Add the chatbot to your privacy notice and set how long chats are kept.
5. If you use a ready-made tool, complete the UODO list and keep it.

When the rule covers your chatbot

Article 50(1) covers AI systems intended to interact directly with people. The European Commission’s guidelines cite chatbots in customer support and e-commerce. The Commission approved their content on 20 July 2026 and said formal adoption, from which they will apply, would follow once all language versions are ready. Its web page already says they were adopted, but we found no notice of the formal adoption. They are not binding, and the final word lies with the Court of Justice of the EU. We treat them as the best guidance available.

Under the guidelines, the duty does not cover automation without AI, such as out-of-office replies or rule-based quick answers. Nor does it cover staff who talk to the customer themselves with help from AI. The fact that a person could step in does not remove the duty. In a mixed chat, mark AI replies unless a person checks and sends them.

No notice is needed where AI is obvious, but the Commission limits that to cases with almost no doubt. For a chatbot on a public website, assume the exception does not apply.

Who is responsible for the AI notice

Our advice is the same in each case. Make sure the AI notice is visible. Below we explain who is formally responsible.

Two of the roles in the regulation matter here, and one business can hold both. A provider develops a system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer is a business that decides whether and how to use a system. It does not need technical control over it. The Article 50(1) duty falls on the provider. In our view a deployer’s other Article 50 duties, such as labelling deepfakes, do not arise in an ordinary customer chat.

• A vendor’s ready-made chatbot, unchanged. The Commission treats the company offering it under its own brand as the provider. In our view you are the deployer.
• Built in-house, under your name. The guidelines make you the provider, even if you build on another company’s model.
• Built for you by a contractor. The definition covers anyone who has a system developed and puts it into service under their own name, so in our view that is usually the client. The definition says nothing about changing the role by contract. Use the contract to settle who builds the AI notice and who maintains it.
• Someone else’s system, modified. Under the guidelines, a company that modifies a system, for example with new training data, and puts it into service under its own name becomes the provider of a new system. We found no official answer on whether uploading documents or changing instructions in a ready-made tool counts.

If you are the provider and the chatbot writes its own replies, Article 50(2) may apply to you too. Replies must then be marked in a machine-readable format and be detectable. You may rely on the model provider’s solution, but showing compliance stays with you. The transition period for these duties ends on 2 December 2026. The regulation refers to systems placed on the market before 2 August 2026, and the guidelines add those put into service, such as systems built for own use. A chatbot launched later gets no transition period. This date does not extend the chat notice.

We advise showing the notice even if you are not the provider, although Article 50(1) does not directly require it of a business that only uses someone else’s tool. Consumer law applies separately and bans misleading people about a service’s main characteristics. Under the guidelines, AI can be such a characteristic where the service is AI-driven. They do not say this about an ordinary support chat.

Article 4 applies in both roles. You must take steps to support AI literacy among the people who run the system. No set level of knowledge is required. A short note on what the chatbot does and where it goes wrong is a reasonable start.

How to tell people it is AI

This section follows the European Commission’s guidelines unless we say otherwise.

The notice must be clear and distinguishable, at the latest at the first interaction. One prominent notice before the first exchange is likely to be enough in most cases, given at least once at the start of a session. So show it at each new chat, not only on the first visit. The Commission recommends placing it near the input field. Sample wording (ours, not from the law):

This is an AI chat. You are not talking to a person. Answers may contain mistakes.

If a person takes over the chat, change this message. That is our advice, not a line from the guidelines.

These are not enough on their own:

• a line only in the terms and conditions,
• the bare word “assistant” or a human-like figure that may mislead,
• a general “services on this website use AI”,
• a technical “this system uses LLMs”.

Also check, even if the chatbot is already live:

• The question “are you human?”. The system must then disclose that it is AI. Test it.
• Sensitive topics. Reminders during the chat are likely to be necessary with finance, insurance, legal matters, health and complaints, and with children, older people and people with disabilities.
• Accessibility. Article 50 adds no requirements of its own. Those that already apply to you still do, for example under the Polish Accessibility Act. Even if that Act does not cover you, the guidelines expect the notice to be accessible to people with disabilities too.

What to ask your chatbot vendor

If your chatbot is live, ask now, because older systems get no transition period for Article 50(1). Get written answers on:

• Role. Whether the vendor regards itself as the provider, how it meets Article 50(1) and (2) and whether the notice can be switched off. We would leave it on.
• A data processing agreement, under which the vendor handles data only on your instructions. The question list for small and medium-sized businesses (a Word file, in Polish) from UODO, the Polish data protection authority, says one is mandatory when a vendor processes data on your behalf, which covers most cloud AI services.
• Model training. Whether chats train its models and whether you can turn that off. The list says a vendor using the data for its own purposes becomes a controller to that extent, answerable for why and how it uses that data.
• Location and retention. Where the data sits, whether it leaves the EEA and how long chats and attachments are kept.
• Incidents. How quickly it will report a breach to you. A controller must normally notify the authority within 72 hours.

What to do with chat data

Chats often hold names, email addresses and descriptions of problems. Where these relate to an identifiable person they are personal data, so the GDPR applies, and the AI notice does not replace your GDPR information duties. In our view the business that decides why and how the chat is used is the controller.

• Privacy notice. Add the chatbot: purpose, legal basis, recipients including the vendor, and retention period. The UODO list also expects a mention of AI and of how the system works.
• Legal basis. Record the basis on which you process chat data. The list names consent, contract, legal obligation and legitimate interest, and if you are unsure it points to a data protection officer or a lawyer.
• Retention. The GDPR sets no number of days, only that data is kept no longer than necessary. The UODO list adds that this includes chat history and attachments. Choose a period, record it and set it in the tool.
• Access and rights. Use named accounts and two-factor authentication. Check you can find a chat if someone asks to see it or have it deleted.

You can ask visitors not to type sensitive data, but that does not close the issue. The data protection authorities’ ChatGPT taskforce says terms cannot pass responsibility to users, and that people will sooner or later enter personal data. The report is a preliminary view about one service, and applying it to a company chatbot is our own reading.

If you use a ready-made tool, complete the UODO list now, or before launch if the chatbot is not live yet. The list says this takes about 30 minutes. Keep the completed copy, but it does not confirm GDPR compliance and is not a binding interpretation. The list is not enough if you train a model on your own data, if the tool affects people’s legal position, if sensitive or children’s data is involved, or if data leaves the EEA. It then points to an extended version or a specialist.

Who enforces this and what is at stake

In Poland, the Act on AI Systems has been in force since 11 August 2026, and its provisions on inspections, proceedings and fines since 28 October 2026. These rules are enforced by the Commission for the Development and Security of Artificial Intelligence (KRiBSI). The Act gives it until 11 November 2026 to hold its first meeting. We found no official notice that this has happened. Individuals and businesses can complain to it.

Breaching Article 50 duties can bring a fine of up to EUR 15 million or 3% of worldwide annual turnover. For small and medium-sized businesses the lower figure applies. On a turnover of PLN 2 million the ceiling is PLN 60,000, by our own calculation. A fine falls on whoever holds the duty, and for the chat notice that is the provider. The amount depends on factors such as how serious the breach was, how long it lasted and how far you cooperated. During proceedings KRiBSI may also issue a warning saying what to fix.

Chat data is supervised separately by UODO, and fines for it come from Article 83 of the GDPR.

When to talk to a lawyer

Talk to a lawyer if your chatbot answers questions about health, money or legal matters, talks to children, or helps with recruitment, customer scoring or education. The UODO list says recruitment, scoring, education and health may mean a high-risk system. If the tool makes decisions about people on its own, the list says to change how you use it or stop.

This describes the position on 5 November 2026. The European Commission’s guidelines may change. This article is not legal advice. If you are planning a chatbot or want to change the one on your site, write to us.