Yes, unless it is obvious from the circumstances. Article 50(1) of the AI Act applies from 2 August 2026 and requires a system intended to interact directly with people to be designed so that the person concerned learns that they are interacting with AI. The duty falls on the provider of the system, and that is generally also the company that has a chatbot developed for it and operates it under its own name, even though it is built on a third party’s language model. The information must be given clearly and no later than at the first interaction.
An e-shop or a service company puts a chatbot on its website to answer questions about orders, prices or complaints. The answers sound natural and the customer often has no idea whether they are writing to a person. From 2 August 2026, this is no longer merely a matter of courtesy towards the customer. The Artificial Intelligence Act (AI Act) applies generally from that date and its Article 50 introduces transparency obligations. Regulation (EU) 2026/1744 deferred the deadlines for high-risk systems, but it did not postpone the rules for chatbots.
What exactly the Regulation requires
The basic rule for systems that interact with people reads as follows:
Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use.
It is unwise to rely on the “unless this is obvious” exception. A window headed “Write to us” bearing an operator’s name does not tell the customer that a machine is answering; if the assistant introduces itself at the outset as a virtual assistant, the customer knows and the duty is discharged. Under Article 50(5), the information must be provided in a clear and distinguishable manner at the latest at the time of the first interaction and must meet accessibility requirements. A note in the privacy policy is therefore not enough; the information belongs in the chat window itself.
Who is the provider where the chatbot runs on someone else’s model
The duty under Article 50(1) falls on the provider. Under Article 3(3), that is the person who develops an AI system, or has one developed, and puts it into service under its own name or trade mark. Putting into service also covers supplying a system for own use (Article 3(11)). A company whose agency builds a chatbot on a third-party language model, and which operates it on its own website under its own brand, is therefore generally the provider of that chatbot, even though it did not develop the model itself.
The position differs where the company merely embeds a finished supplier product on its website which appears under the supplier’s name. The provider is then the supplier and the company is a deployer (Article 3(4)). Even then, it is worth expressly agreeing in the contract with the supplier that the product displays the AI notice, and checking that before launch, because the customer perceives the chatbot as part of your website.
What else Article 50 adds
Anyone using AI to create content has further duties. A deployer that uses AI to generate a deep fake, that is, an image, audio or video appearing genuine, must disclose that the content has been artificially generated or manipulated (Article 50(4)). The same applies to text published to inform the public on matters of public interest, unless it has undergone human editorial review and someone bears editorial responsibility for it. Machine-readable marking of synthetic content under Article 50(2) is a duty of providers of generative systems; those who placed their system on the market before 2 August 2026 have until 2 December 2026 to comply (Article 111(4) as amended).
Chatbots and personal data
The AI Act does not replace the GDPR. If a customer enters a name, order number or email address in the chat, the company processes personal data and must inform the customer under Article 13 GDPR, that is, about the purpose, legal basis, recipients including the model supplier, and the retention period. If the supplier processes the conversations on the company’s behalf, it is its processor and a contract under Article 28 GDPR is required. When the AI Act affects a company that merely uses AI is summarised in when the AI Act applies and to whom.
What to do now
Go through every point at which AI communicates with people: the website chat, an email assistant, a voice line. For each, record who the provider is and add a clear notice to the interface in the very first message. We assess your AI tools and prepare the wording and supplier contracts through our AI Act and deploying artificial intelligence service; we align the information duties relating to conversation data through GDPR and personal data protection.
This answer provides general information on the law as at 12 September 2026. It does not constitute legal services or replace an assessment of an individual case. The details of your situation may differ. Book a consultation to discuss them.
