Guide

AI chatbot and the EU AI Act: disclosure requirement

Since August 2026, the transparency obligations of the EU AI Act apply. What that means specifically for an AI chatbot, who it affects, and what actually needs to be done in implementation.

Request assessment ↗AI chatbot

Quote upon request2 to 4 weeksStatus 2026

In short

Since August 2026, the transparency obligations under Article 50 of the EU AI Act apply: anyone communicating directly with an AI system must be able to recognize it. We build in the disclosure as standard. For an AI chatbot, this means: disclosure is mandatory, not optional, and applies regardless of company size — a sole proprietor is affected just as much as a corporation. What matters is purpose and risk, not headcount.

01 — Legal situation

EU AI Act: what applies

Since August 2026, the transparency requirements from Article 50 of the EU AI Act apply: Anyone communicating directly with an AI system must be able to recognize it. We build in the labeling as standard.

The AI Act doesn't distinguish by company size: A sole proprietorship with an AI system in customer contact is affected just as much as a corporation. What matters is purpose and risk, not headcount.

There's also the obligation to ensure adequate AI competence for the people working with it. That's not an examination requirement, but it should be documented — a training session with a participant list is the simplest proof.

02 — Data protection

What GDPR requires

As soon as personal data is processed — and that happens faster than expected, for instance as soon as someone enters a name or phone number — the usual obligations apply: name the legal basis, define the purpose, maintain data minimization, define retention periods, inform data subjects.

In practice, this means for an AI chatbot: a data processing agreement with every service provider involved, checking where processing takes place, a documented deletion period, and an understandable passage in the privacy policy. Three things are almost always missing in practice: the defined deletion period, the notice at the point where data is collected, and clarification of whether the provider uses the data for its own training.

A data protection impact assessment is only required when there's likely high risk — not for most projects of this type. The review itself should still be documented so that if questions arise, it's clear why it was omitted.

03 — Risks

What can go wrong

The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
No one maintains it. The biggest risk of all — and the most easily avoidable.
Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.

04 — Questions

Frequently asked questions

Do we have to label the chatbot as AI?

Yes. Since August 2026, the transparency requirements of Article 50 of the EU AI Act apply: Anyone communicating directly with an AI system must be able to recognize it. We build the labeling in as standard, it costs nothing extra.

How much work does this create for us?

At the start, about two to three hours for gathering content and one alignment round. After that, nothing regular — unless you want to add new topics, which works through a simple document.

Does this also work on a WordPress site?

Yes. The integration is a single code snippet in the footer and works the same on WordPress, Shopify, Webflow, Wix, TYPO3, or a custom-built site.

Doesn't an AI chatbot just make up answers?

A free-running language model does. That's why we build the bot so it only answers from a verified knowledge base and provides the source. If it finds nothing, it says so and redirects — that's the most important part of the configuration.

What happens to our customers' data?

The conversations run through servers in the EU, no training is done with your data, and we write the appropriate section for your privacy policy. On request, chat logs are automatically deleted after a set period.

Can we turn the bot off again?

Anytime, with one click. The snippet remains, the bot is gone. There's no minimum term that binds you.

Does this even pay off for us?

The calculation is simple: requests per week times processing time times hourly rate. With twenty repeat questions per week and seven minutes each, that's a good two hours of work — every week. We calculate this with your real numbers before the quote.

05 — Next

AI chatbot by region

Next step

Initial assessment, no obligation.

Briefly describe what you need. You'll get an honest answer about what's realistic and what it will roughly cost.

Send inquiry ↗ office@pipeline-solutions.at OR +43 681 207 64 203