Does the EU AI Act apply to my chatbot?

Alexis Balland — Thu, 11 Jun 2026 20:55:33 +0000

I originally published this on disclosekit.dev — I'm building tooling for this deadline and the research surprised me enough to share.

June 2026 · 5 min read

Short answer: if your chatbot talks to people in the EU, probably yes. From August 2, 2026, Article 50(1) of the AI Act requires you to tell users they are interacting with an AI system. Not in your terms of service. At the start of the conversation, where they can actually see it.

The test is where your users are, not where you are

A Delaware C-corp with a support bot used by customers in Berlin is covered. A French SaaS whose bot only serves a US audience is, for this rule, not. The AI Act follows the people affected, the same extraterritorial logic GDPR uses. If you can't rule out EU users, the safe assumption is that you have them.

Deployer, not just provider

A common misreading: "this is OpenAI's problem, I just use their API." No. The Act distinguishes providers (who build the AI system) from deployers (who put it in front of people). If you embedded a GPT-4-powered support widget on your site, you deployed an AI system that interacts with natural persons. The disclosure duty under 50(1) sits with whoever exposes the bot to users.

What you actually have to do

Inform users they are interacting with an AI system, in a clear and distinguishable way, at the latest at the first interaction. In practice that means a notice inside or directly next to the chat window when the conversation starts. The patterns emerging from the draft Code of Practice on Transparency look like this:

A first message or persistent label: "You're chatting with an AI assistant"
In the user's language, not English-only for a German audience
Visible without scrolling, hovering, or opening a settings panel

A line buried in your privacy policy fails the "clear and distinguishable" bar. So does naming your bot "Julia" with a
human avatar and no label.

The exception everyone asks about

You can skip the disclosure when it's "obvious from the point of view of a reasonably well-informed, observant and circumspect natural person" that they're talking to a machine. Regulators wrote that with deliberately narrow intent. A robot icon is not obviousness. If your bot writes fluent, human-sounding prose (every modern LLM does), assume the exception doesn't cover you. The cost of a label is so low that betting on this exception is a strange place to take legal risk.

What about voice agents and internal tools?

Voice counts. An AI phone agent answering your support line interacts with natural persons and needs the same disclosure, spoken at the start of the call. Purely internal tools that only your employees touch carry much lower exposure, though labelling them is still good practice once externals (contractors, clients in a shared workspace) can reach them.

What to do this month

Take the free 2-minute checker to see which Article 50 duties apply to your product. If the chatbot one does, you have two jobs before August: show the disclosure, and keep a record proving when you started showing it. The second one is what people forget. When a regulator or an enterprise procurement team asks "since when?", a screenshot from last week is not an answer.

That banner-plus-record combination is exactly what DiscloseKit ships as one script tag.