Your chatbot must state that it is an AI — from August 2026 onwards

The transparency requirements of the EU’s AI Regulation came into force on 2 August 2026. There is one practical requirement for a typical business: if a website has a chatbot, the user must be aware that they are speaking to a machine. Most of the other obligations fall on the tool provider, not you — and marketing text written by AI but checked by a human is not covered by these obligations at all. This article sets out what applies to you and what does not.

Provider or implementer — it all depends on this

The regulation divides the obligations between two different parties, and this division explains the vast majority of the exaggerated interpretations circulating on the subject.

Role	Who is it, in practice?
Supplier	The person who develops the AI system and brings it to market. Chatbot service provider, language model developer
Implementer	Someone who uses a ready-made system in their own business. A company that adds a purchased chatbot to its website

If you purchase a chatbot as a service, you are a user. If you build your own bot on top of a language model and offer it to your customers, you are also a provider. This distinction determines what you need to do.

What Article 50 requires

To the supplier

• A system designed for direct interaction with humans must be designed in such a way that the user is aware they are interacting with artificial intelligence.
• A system that generates synthetic audio, images, video or text must label its output as AI-generated in a machine-readable format.

The second point is the one that has caused the most confusion. Machine-readable markup is the responsibility of the provider — it is added by the creator of the language model or image generator to their own output. A company using the tool does not need to build a tagging system.

For the end user

There are three obligations on the part of the implementer, and they are more limited than is often assumed:

Obligation	Does this apply to a standard business?
Identity recognition and biometric systems: those at risk must be informed	No, unless such services are used
Deepfake content: must state that the content is generated by artificial intelligence or has been manipulated	Yes, if you publish a deepfake
Text generated by artificial intelligence, published to provide information on a matter of public interest	Rarely — and even then, the exception proves the rule

The last line is important. The obligation applies to text published to provide information on a matter of public interest — not to all text written by artificial intelligence. And there is an explicit exception to this: the obligation does not apply if the content has undergone human verification or editorial oversight and someone is responsible for its publication.

A product description, service page text or blog article that you have written with the help of AI and proofread before publication does not, therefore, require an ‘AI-generated’ label. If someone is selling you a labelling service on this basis, ask them about the exemption clause in the article.

The one thing you should do today

If the site has a chatbot, check that it states it is an AI. It takes a minute to check:

• Open the website in a new tab and click to open the chat.
• Is it apparent from the first message or the window title that the respondent is an AI?
• If it doesn’t appear, change the welcome message. In most services, this is a single text field in the settings.

A simple design is sufficient: “Hi, I’m an AI assistant. I answer general questions — you can reach a human on this number …” No separate legal text is required.

The regulation also provides for an exception in situations where the matter is obvious to a reasonably informed user. It is not advisable to rely on this: it is open to interpretation, and the alternative is a single-sentence amendment.

When is a bot not artificial intelligence at all?

Not all chat windows are AI systems. An old-style menu-based chatbot, which offers three options and follows a pre-written path, does not generate responses but retrieves them. It is not an AI system as defined by the Regulation, and Article 50 does not apply to it.

The dividing line lies in whether the system generates the response itself. A practical test: ask the bot something that isn’t in its instructions. A menu-based bot will simply offer the same menu again. A language model-based bot will come up with a response — and that is precisely why the user needs to know who they are talking to.

There are mixed formats: many services start with a menu and switch to a language-based interface if no answer is found in the menu. In such cases, an AI system is at work, even if the initial view does not appear to be one.

Chat brings with it another obligation

This isn’t an AI setting but a data protection issue, yet it stems from the same decision and is often overlooked: chat conversations constitute personal data. Customers enter their name, telephone number and, often, details of their enquiry that they would not disclose elsewhere.

Three things worth sorting out at the same time as setting up your chatbot’s greeting:

• Include the chat service in the privacy policy. Specify what data is collected, how long it is retained, and to whom the data is transferred. If the chat service is located outside the EU, the transfer must be disclosed.
• Decide on the retention period. Most services retain conversations indefinitely by default. It’s a setting that nobody has chosen.
• Take a look at what’s being fed into the bot. If the bot is given access to a customer database or price list that isn’t public, it will eventually end up in the response.

Three claims that go too far

Claim	How does it work?
“All content generated by artificial intelligence is significant”	Machine-readable labelling is the provider’s obligation. The user’s obligation relates to deepfakes and certain types of public interest information, and there is an exception for human verification
“Websites need an AI statement”	Article 50 does not recognise such a document
“Fines will be imposed immediately”	Transparency requirements will apply from 2 August 2026. The other parts of the Regulation will come into force in stages until 2028

The timeline in which this fits

Day	Where to start
1.8.2024	The regulation came into force
2.8.2025	Obligations relating to general-purpose AI models
2.8.2026	Transparency requirements (Article 50)
2.8.2027	Models launched before 2 August 2025
2 December 2027 and 2 August 2028	Requirements for high-risk systems, step by step

In demand

Should a blog post written by artificial intelligence be labelled as such?

Not in the usual circumstances. The operator’s obligation applies to text published to provide information on a matter of public interest, and there is an exception to this if a person has checked the content and is responsible for its publication. The company’s own marketing content, which you have read through, falls outside the scope of this.

What about the AI-generated images on the site?

The machine-readable metadata is generated by the image generator provider, not by you. The user’s own duty to provide information applies to deepfakes, i.e. content that depicts a real person, place or event in a way that appears genuine but is not. An illustrative image that does not depict anyone real is not a deepfake.

Is a mention in the privacy policy sufficient?

Not in the case of a chatbot. The requirement is that the user receives the information whilst interacting with the system — that is, when they open the chat, not on a separate subpage. The information should appear in the chat window.

Does the regulation also apply to small businesses?

Unlike in accessibility regulations, Article 50 does not provide for a micro-enterprise exemption. However, the obligation is so limited that this is not the decisive factor: a chatbot’s welcome message constitutes the same task whether in a company with one employee or one hundred.