Since 2 August 2026, Article 50 of the AI Act applies: a chatbot must not pass for a human. What it means for a business website, GDPR, and a checklist.
Dawid Zmarzlak/Published/6 min read
On 2 August 2026 the transparency rules of the AI Act started to apply -
Article 50 of Regulation (EU) 2024/1689. For a business with a chatbot on
its website, the key change is simple: people have to know they are
talking to an AI. Below: what the rules actually say, who they cover, what
GDPR adds, and how it looks on my own site.
What applies from 2 August 2026
Telling people they talk to an AI (Art. 50(1)). An AI system
intended to interact directly with people must be designed so that the
person knows they are dealing with an AI - unless that is obvious to a
reasonably well-informed, observant user in the circumstances.
When and how (Art. 50(5)). The information must be clear,
distinguishable and given at the latest at the first interaction, in line
with accessibility requirements.
Labelling AI content (Art. 50(2) and (4)). Providers of text, image,
audio and video generators mark outputs in a machine-readable format.
Whoever publishes a deepfake must disclose it. AI-generated text
published to inform the public on matters of public interest must also
be disclosed - unless it went through human editorial review and someone
holds editorial responsibility for it.
Fines (Art. 99(4)). Breaching the Article 50 obligations can cost up
to EUR 15 million or 3% of total worldwide annual turnover. For small and
medium-sized companies the lower of the two applies (Art. 99(6)).
The Digital Omnibus simplification package (Regulation (EU) 2026/1744,
in force since 27 July 2026) postponed the deadlines for high-risk systems,
but left Article 50 at 2 August 2026. The only exception: providers of
content generators already on the market before 2 August 2026 have until
2 December 2026 for technical marking.
Who it covers - sole traders included
The AI Act distinguishes the provider - whoever develops an AI system,
or has it developed, and puts it into service under their own name - from
the deployer, who uses an AI system in a professional capacity. Both
definitions include natural persons, so sole traders are covered too. Only
purely personal, non-professional use is excluded.
In practice:
If you commission a chatbot built for your business and run it on your
website under your name, you may be treated as its provider - then the
Art. 50(1) duty applies to you directly.
If you paste in an off-the-shelf widget from another company, the
Art. 50(1) duty rests mainly with that company. But you decide what the
customer sees: don't switch off the AI notice, and don't give the bot a
human name or photo that suggests a member of staff.
AI literacy - Article 4 after the changes
Since February 2025, Article 4 has required providers and deployers to look
after the AI literacy of the people who operate AI systems on their behalf.
The Digital Omnibus rewrote it: it is now a duty to take measures that
support developing that literacy, not a guarantee of a specific level. In
a small business a sensible minimum is: the person responsible for the
chatbot knows how it works, where it gets things wrong, how to fix its
knowledge base and when to hand a conversation to a human. Write that down
in one paragraph of an internal note.
GDPR still applies
The AI Act does not replace the GDPR. A chatbot processes personal data the
moment someone types a name, an e-mail or a description of their case.
A data processing agreement (Art. 28 GDPR) with the model provider
and with the contractor who maintains the system.
A data flow map: what goes to the model, where it is stored, for how
long, and who can read the chat history.
Model and region choice: a provider processing data in the EU, or a
locally hosted model if the data is sensitive. Transfers outside the EEA
need a basis under Chapter V of the GDPR.
The information duty (Art. 13 GDPR): the privacy policy describes the
chat - purpose, recipients and retention period.
Data minimisation: the bot does not ask for national ID numbers, bank
details or health data unless they are actually needed.
Polish implementing law
Poland's act on artificial intelligence systems, passed on 3 July 2026,
sets up the Commission for AI Development and Security (KRiBSI) as the
national AI supervisory authority. According to GDPR.pl's summary of the
act, its financial penalty provisions apply from 28 October 2026. The
Article 50 duties themselves come straight from the EU regulation and
apply from 2 August 2026.
How it looks on my site
The chat on this site opens by saying it is an AI assistant and lets you
leave your contact details for me. Every assistant I build has, as
standard: an AI notice in the first message, a hand-over to a human, a
data processing agreement, a choice of model (EU region or a local model)
and provider accounts opened in the client's name. The costs are broken
down in how much AI implementation costs,
and the full offer is on the AI and automation page.
Checklist for a website with a chatbot
The bot's first message says plainly that it is an AI - not just a robot
icon.
The bot has no human name or photo suggesting a member of staff.
There is an easy way to reach a human: a form, an e-mail or a phone.
The AI notice is text that a screen reader can read.
You have a data processing agreement with the model provider and the
contractor.
The privacy policy describes the chat.
You know in which region conversations are processed.
Someone in the company owns the bot's knowledge base and knows how to fix
it.
AI-generated texts published to inform the public are edited by a human
or labelled.
