For most business chatbots, the EU AI Act requires one main thing: tell people they are talking to an AI, clearly and from the first interaction, under Article 50, which applies from 2 August 2026. Generative systems may also need machine-readable marking of output, with a grace period to 2 December 2026 for systems already on the market. High-risk obligations apply only to listed uses such as recruitment or credit decisions, and were moved to 2 December 2027 by the Digital Omnibus. GDPR still applies alongside. Transparency breaches carry fines up to EUR 15 million or 3% of turnover. Not legal advice.
Does the EU AI Act apply to a small business running a chatbot?
Yes, if the chatbot is used by people in the EU - even if your company is not based there. For a typical customer-support or website chatbot, though, the obligations are light. The rule that matters most is Article 50: people must be told they are talking to an AI. The heavy high-risk obligations only apply if the chatbot is used for one of the specific purposes the Act lists, such as screening job applicants or deciding access to credit.
This is a checklist for engineers and business owners, not legal advice. Dates and article numbers were checked against the European Commission's pages on 16 October 2026. Confirm your own position with counsel, and read our EU AI Act compliance page for how we build these requirements into systems.
What are the EU AI Act dates that matter for chatbots?
According to the Commission's AI Act overview and its Article 50 FAQ:
| What | Applies from | Relevance to a chatbot |
|---|---|---|
| AI Act enters into force | 1 August 2024 | The clock starts |
| Prohibited practices (Article 5) and AI literacy (Article 4) | 2 February 2025 | Rules out certain uses; staff using AI need suitable understanding |
| General-purpose AI model obligations | 2 August 2025 | Falls on the model providers, not on you |
| Transparency obligations (Article 50) | 2 August 2026 | The main obligation for most chatbots |
| Machine-readable marking (Article 50(2)) for generative systems already on the market before 2 August 2026 | 2 December 2026 | A grace period for marking only, not for disclosure |
| High-risk systems listed in Annex III | 2 December 2027 | Only if the chatbot is used for a listed purpose |
| High-risk AI embedded in regulated products (Annex I) | 2 August 2028 | Rarely relevant to a chatbot |
The two high-risk dates were moved by the Digital Omnibus on AI, which the Commission states entered into force on 27 July 2026. The Commission's pages describe Article 50 transparency as applying from 2 August 2026, with the grace period above as the only transition for it.
What is the EU AI Act checklist for a business deploying a chatbot?
1. Work out whether you are the provider or the deployer
Under the Act, the provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name. The deployer uses an AI system under its own authority. If you built or commissioned the chatbot and run it under your brand, you are very likely its provider. If you switched on a vendor's chatbot product, the vendor is the provider of that product and you are a deployer. The Article 50(1) duty to tell people they are talking to an AI sits with the provider - but as the business whose customers see it, you should check it is there either way.
2. Check the chatbot is not doing something prohibited
Article 5 bans a short list of practices, including inferring people's emotions in the workplace or in education. A support chatbot will not normally be anywhere near this list, but a chatbot built to judge how employees or students feel would be.
3. Check it against the high-risk list, not your intuition
High-risk is a defined list in Annex III, not a judgement about how important the system feels. A chatbot answering product questions is not high-risk. The same chatbot used to screen job applicants, assess creditworthiness or decide access to essential services is in a high-risk category, with far heavier obligations from 2 December 2027. If your chatbot makes or shapes decisions like these, get legal advice now.
4. Tell people they are talking to an AI - at the first interaction
Article 50(1) requires that people are informed they are interacting with an AI system, unless it is obvious to a reasonably well-informed person. The Commission's FAQ says the "obvious" exception should be read restrictively, so do not rely on it. Article 50(5) requires the information to be clear and distinguishable, given at the latest at the first interaction, and accessible.
- Show it in the chat window itself, not only in your terms of service.
- Put it in the chatbot's own first message as well as the interface, so a redesign cannot remove it.
- Carry it into every channel the bot reaches: email replies, WhatsApp, SMS.
- Make it readable by screen readers and in your users' languages.
5. Check whether machine-readable marking applies
Article 50(2) requires providers of systems that generate synthetic audio, image, video or text to mark the output in a machine-readable way, with exceptions for systems that perform an assistive function for standard editing or do not substantially alter the input. How this applies to a given chatbot's text replies is set out in the Commission's guidelines on AI-generated content and the voluntary Code of Practice. If your chatbot generates images, audio or video, this is squarely in scope. Ask your model provider what marking they already apply.
6. Label AI-written content you publish
Separately, Article 50(4) requires deployers to disclose deepfakes, and to disclose AI-generated text published to inform the public on matters of public interest - unless it has had human review or editorial control and someone holds editorial responsibility. If you use AI to write articles or announcements, an editor signing them off is the simplest route.
7. Make sure staff who run it understand it
Article 4 on AI literacy has applied since 2 February 2025 to providers and deployers. Commentary on the Digital Omnibus reports that it softened this to a duty to take measures supporting AI literacy rather than to guarantee a level of it; check the current text. Either way, a short written briefing for the people who configure and supervise the chatbot is cheap and sensible.
8. Remember GDPR still applies
The AI Act sits alongside data protection law, not instead of it. A chatbot that handles personal data needs a lawful basis, an updated privacy notice, a data processing agreement with each vendor in the chain and, where the risk is high, a data protection impact assessment.
9. Keep a short file on the system
Write down what the chatbot is for and what it must not be used for, which vendors and models it uses, how you tested it before launch, how a person takes over, and what has changed since. It is required for high-risk systems and useful for every other one - the same documentation that answers a regulator also makes the system maintainable.
What are the penalties for getting chatbot transparency wrong?
The Commission's quick facts on transparency give fines of up to EUR 15 million or 3% of worldwide annual turnover for breaches of the transparency rules. Article 99 sets those maximums as whichever is higher for most companies, and caps fines for SMEs and start-ups at whichever is lower. The top tier of EUR 35 million or 7% applies to prohibited practices. Enforcement is by national market surveillance authorities.
For most small businesses the realistic risk is not the maximum fine. It is a complaint to a regulator, or a customer who discovers they were talking to a bot that never said so. A disclosure line costs almost nothing to add.
What should a small business do about the EU AI Act this week?
- Write down whether you are the provider or the deployer of your chatbot.
- Confirm it is not used for any purpose on the Annex III high-risk list.
- Add a clear AI disclosure to the chat window and the bot's first message, in every channel.
- Ask your chatbot and model vendors how they handle Article 50 disclosure and marking, in writing.
- Label any AI-written public-interest content you publish, or put an editor in the loop.
- Brief the staff who run it, and start a one-page file on the system.
If you are building rather than buying, the disclosure and logging patterns belong in the system from the start - see AI agent development and our security and data handling page.
What does the EU AI Act require of a business chatbot?
For most business chatbots, the EU AI Act requires one main thing: tell people they are talking to an AI, clearly and from the first interaction, under Article 50, which applies from 2 August 2026. Generative systems may also need machine-readable marking, with a grace period to 2 December 2026 for systems already on the market. High-risk obligations apply only to listed uses such as recruitment or credit decisions, and were moved to 2 December 2027. GDPR still applies alongside. This is not legal advice; dates were checked against Commission pages on 16 October 2026.