What does the EU AI Act require from your website chatbot?
The EU AI Act requires your website chatbot to tell visitors it is an AI. The information must be given clearly and distinguishably at the latest at the time of the first interaction, and these transparency obligations have applied since 2 August 2026. In Finland they are supervised mainly by Traficom, which published its guidance on 20 August 2026.
This page explains what the obligation means in practice for a one-person company: who is responsible for what, what is not covered, and what to ask your bot vendor. Checked on 20 September 2026 against public sources from the European Commission, Traficom and the regulation itself.
This is not legal advice. We build websites, not legal services. Verify your own situation with an authority or a lawyer if it matters to you.
What exactly does the law require?
The requirement comes from Article 50 of the AI Act. Paragraph 1 says that AI systems intended to interact directly with natural persons must be designed and developed so that those people are informed they are interacting with an AI system.
There are three separate requirements on that information, and they are worth reading one at a time:
- Timing. At the latest at the first interaction — not halfway through the conversation and not only on request.
- Manner. Clear and distinguishable. Traficom's guidance accepts text, sound, a visual symbol or a combination, as long as it is easy to notice.
- Accessibility. The information has to meet accessibility requirements, which means it also has to reach a screen reader.
Traficom's guidance also says plainly what is not enough: information in the terms of use or documentation alone generally does not satisfy the requirement. This is the part most often missed — a sentence added to the privacy policy does not replace the visitor seeing it in the chat.
The obligation covers chatbots, voice assistants, AI agents, avatars and interactive robots. A chat widget on a website is the common case.
When is disclosure not needed separately?
There is an exception, but it is narrow. No separate disclosure is needed when the situation makes it obvious to a reasonably well-informed, observant and circumspect person. The Commission instructs that this exception be interpreted restrictively.
In practice you cannot lean on it for a chat bubble in the corner of a site. The visitor does not know whether the other end is the owner with a phone or a language model. Plenty of Finnish small businesses answer their own chat, so the assumption "this must be a bot" is not a safe one.
Who is responsible: the vendor or you?
This is the question a sales call usually answers around rather than through. The regulation and Traficom's guidance split the responsibility in two.
| Role | Who that is in practice | Responsible for |
|---|---|---|
| Provider | The company that built the bot or placed it on the market | Designing the system so the AI disclosure can be given |
| Deployer | The company whose website the bot runs on | The information actually reaching the visitor |
The consequence is uncomfortable but clear: buying the bot from someone else does not move the whole responsibility away from you. If the vendor's bot does not say it is an AI, it fails to say so on your site, to your visitor.
That is also why this is worth checking yourself rather than trusting a brochure. Open your own chat as if you were a customer and read what the first screen says.
Did the Digital Omnibus postpone the deadline?
No — and this is the most common misunderstanding left over from the summer of 2026. Regulation (EU) 2026/1744 amending the AI Act entered into force on 27 July 2026 and deferred part of the obligations, but the transparency obligations were not among them.
| Obligation | Original date | Status now |
|---|---|---|
| Article 50: transparency, incl. chatbots | 2 August 2026 | Unchanged, applied since 2 August 2026 |
| High-risk systems, Annex III | 2 August 2026 | Deferred to 2 December 2027 |
| High-risk systems, Annex I | 2 August 2027 | Deferred to 2 August 2028 |
For a small business this is good news twice over. The high-risk rules, which cover things like recruitment and credit decisions, most likely do not touch you at all. The one thing that does touch you — chatbot transparency — is also the easiest to handle: it is two sentences in the bot's interface.
Do AI-written texts have to be labelled?
This question almost always follows the chatbot one, so let us settle it here.
Ordinary marketing copy about your own services is outside Article 50(4). That paragraph obliges the deployer to disclose two things: deep fake image, audio or video content, and text published to inform the public on matters of public interest. Even for that text, the obligation falls away when the content has undergone human review and a natural or legal person holds editorial responsibility.
A price list, a service description or a blog post about your own trade is not informing the public on a matter of public interest. If you publish news-like content on societal topics, the situation is different and worth checking properly.
Machine-readable marking of AI-generated content is a separate obligation under Article 50(2), and it is addressed to the provider of the generative system — in practice the company behind the AI service you used — not to you as the site owner. Generative systems already on the market before 2 August 2026 were given until 2 December 2026 to implement that marking.
A chatbot is the exception in the sense that it applies to you regardless. The bot interacts directly with a human, and that is exactly the situation Article 50(1) governs.
What can non-compliance cost?
Under Article 99(4) of the AI Act, breaching Article 50 can draw an administrative fine of up to EUR 15 000 000 or up to 3 % of total worldwide annual turnover for the preceding financial year, whichever is higher. For small and medium-sized enterprises Article 99(6) applies, and the cap becomes the lower of the two.
In Finland the supervisory framework has been in place since the start of the year. The Act on the supervision of certain AI systems (1377/2025) entered into force on 1 January 2026, and the powers of the authorities supervising the AI Act took effect at the same time. Supervision of the transparency obligations sits mainly with Traficom.
Keep the scale in mind. These caps are written for serious infringements, and a two-chair barbershop in Riihimäki is not the primary target of enforcement. The obligation is still the same for everyone, and meeting it costs nothing.
Checklist for your site
These five checks take ten minutes and you can do them yourself.
- Open the chat as a customer would. Does the first view say that an AI is answering?
- Read the bot's first message. Does it state it is an AI assistant, or does it use a name that sounds like a person?
- Check the header line. "Online" or "we reply instantly" says nothing about AI.
- Make sure it is not only in the terms. According to Traficom that is generally not enough.
- Look at it on a phone. On a narrow screen the header line is usually the first thing to break.
What to ask your bot vendor
If you are buying a bot, or already have one, ask these three questions in writing.
- At which point in the conversation does the bot say it is an AI, and in which languages?
- Is the information in the bot's interface, or only in documentation?
- Which of us is the provider under the regulation, and which is the deployer?
The third question is the revealing one. A vendor who cannot answer it has not read the regulation.
How this is handled in our bots
In the bots we deliver the information sits in two places: the chat header says it is an AI assistant, and the bot says so again in its first message. It works the same way in all three languages, and the customer does not have to do anything about it.
You can check it on this page: our own bot, Aleksi, is in the bottom right corner. Ask it anything and see how it introduces itself. Pricing and a comparison with Finnish chatbot services is on the chatbot page, and all add-on prices are on the add-on services page.
Sources
- European Commission: Transparency obligations under Article 50 of the AI Act
- Traficom: When AI use must be disclosed (in Finnish)
- Traficom, 20 August 2026: new guidance on AI transparency (in Finnish)
- Act on the supervision of certain AI systems 1377/2025
Frequently asked questions
Does a chatbot have to say it is an AI?
Yes. Article 50(1) of the EU AI Act requires that people are informed they are interacting with an AI system. The information must be given clearly and distinguishably at the latest at the time of the first interaction. These transparency obligations have applied since 2 August 2026.
When is separate disclosure not needed?
Only when it is already obvious to a reasonably well-informed, observant and circumspect person from the situation itself. The European Commission says this exception is to be interpreted restrictively, so it is a weak thing to rely on. A chat bubble in the corner of a website does not reveal by itself whether a human or a machine is answering.
Is a mention in the terms of service enough?
Usually not. Traficom's guidance states that information in the terms of use or documentation alone is generally not sufficient, because it has to be clear and easy to notice at the latest at the first interaction. The right places are the chat header and the bot's first message.
Who is responsible — the bot vendor or the business using it?
Both, for different things. Article 50(1) is addressed to the provider: the system must be designed so the information can be given. Traficom states that the deployer is responsible for the information actually reaching the visitor. If you bought the bot from someone else, a contract does not move that part away from you — check what your visitor sees.
Did the Digital Omnibus postpone the 2 August 2026 date?
Not for Article 50. Regulation (EU) 2026/1744 entered into force on 27 July 2026 and deferred high-risk obligations: Annex III systems to 2 December 2027 and Annex I systems to 2 August 2028. The transparency obligations were left untouched and have applied since 2 August 2026.
Do AI-written marketing texts have to be labelled?
Ordinary marketing copy about your own services falls outside Article 50(4). That paragraph covers deep fake image, audio and video content, and text published to inform the public on matters of public interest — and even there the obligation falls away when the content has had human review and a person or company holds editorial responsibility. A chatbot is different: it is always covered.
What are the penalties?
Under Article 99(4) of the AI Act, breaching Article 50 can draw an administrative fine of up to EUR 15 000 000 or, for an undertaking, up to 3 % of total worldwide annual turnover for the preceding financial year, whichever is higher. For SMEs Article 99(6) applies the lower of the two. In Finland supervision of the transparency obligations sits mainly with Traficom.