Guide

WhatsApp Chatbot and the EU AI Act: Labeling requirement

Since August 2026, the transparency obligations of the EU AI Act apply. What that means concretely for a WhatsApp chatbot, who it affects, and what actually needs to be done in implementation.

Request assessment ↗WhatsApp chatbot

Quote on request2 to 3 weeksAs of 2026

In short

Since August 2026, the transparency obligations from Article 50 of the EU AI Act apply: Anyone communicating directly with an AI system must be able to recognize it. We build in the labeling as standard. For a WhatsApp chatbot, this means: Labeling is mandatory, not optional, and applies regardless of company size — a sole proprietor is affected just as much as a corporation. What matters is the purpose and risk, not the number of employees.

01 — Legal situation

EU AI Act: what applies

Since August 2026, the transparency requirements from Article 50 of the EU AI Act apply: Anyone communicating directly with an AI system must be able to recognize it. We build in the labeling as standard.

The AI Act doesn't distinguish by company size: A sole proprietorship with an AI system in customer contact is affected just as much as a corporation. What matters is purpose and risk, not headcount.

There's also the obligation to ensure adequate AI competence for the people working with it. That's not an examination requirement, but it should be documented — a training session with a participant list is the simplest proof.

02 — Data protection

What GDPR requires

As soon as personal data is processed — and that happens faster than expected, for instance as soon as someone enters a name or phone number — the usual obligations apply: name the legal basis, define the purpose, maintain data minimization, define retention periods, inform data subjects.

In practice, that means for a WhatsApp chatbot: a data processing agreement with each service provider involved, checking where data is processed, a documented deletion period, and a clear section in the privacy policy. Three things are almost always missing in practice: the defined deletion period, the notice at the point where data is collected, and clarification of whether the provider uses the data for its own training.

A data protection impact assessment is only required when there's likely high risk — not for most projects of this type. The review itself should still be documented so that if questions arise, it's clear why it was omitted.

03 — Risks

What can go wrong

The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
No one maintains it. The biggest risk of all — and the most easily avoidable.
Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.

04 — Questions

Frequently asked questions

Do we need a dedicated smartphone for it?

No. The Business access runs through the number you specify, and the shared inbox is accessible via browser or app for the entire team — not tied to a single device.

What happens when switching providers?

The phone number remains your property and can be moved to another Business provider. Histories and templates need to be set up again, that's the only effort.

Can multiple people reply at the same time?

Yes, that's one of the main reasons for switching. The shared inbox shows who's handling which chat and prevents duplicate replies.

How quickly do we need to respond to messages?

There's no Meta requirement, but customer expectations on WhatsApp are minutes, not hours. The automatic replies handle exactly this expectation until someone takes over personally.

Is WhatsApp even GDPR-compliant for business use?

Through the official Business API with a European provider, yes, with a data processing agreement and opt-in. The private WhatsApp app on an employee's phone is the version that causes problems — that's exactly what we replace.

Can we receive images and documents?

Yes. Especially in skilled trades, that's the practical part: customers send a photo of the damage, the bot assigns it to the case, and you see immediately what it's about.

What happens to our existing number?

A number already used in the regular WhatsApp app needs to be migrated — the history is lost in the process. Many businesses therefore get a second number and redirect gradually.

05 — Next

WhatsApp Chatbot by Region

Next step

Send us a few sentences about your project.

We read every inquiry ourselves and respond personally. No sales team, no callback form into the void.

Send inquiry ↗ office@pipeline-solutions.at OR +43 681 207 64 203