The EU AI Act for websites and chatbots: what your business must do

If your website has a chatbot, an AI assistant, AI-written content or AI-generated images, the EU AI Act now applies to you. Not in a distant future: the transparency rules that matter most for websites started on 2 August 2026. The good news is that for most businesses the obligations are short and practical. The bad news is that many sites are already out of line without knowing it.

This guide explains what the AI Act asks of a normal business website, what changed with the Digital Omnibus amendments in July 2026, and a checklist you can work through in an afternoon.

The AI Act in one paragraph

The AI Act (Regulation (EU) 2024/1689) is the EU's law on artificial intelligence. It sorts AI systems by risk. A few uses are banned outright, such as manipulative techniques or social scoring. "High-risk" systems, used for example in hiring, credit scoring or medical devices, face heavy requirements. Everything else, which covers almost every website chatbot and content tool, mainly has transparency duties: people must know when they are dealing with AI or looking at AI-generated content.

It applies to businesses inside the EU and also to businesses outside the EU whose AI systems or outputs are used in the EU. A US or UK company with a chatbot serving European visitors is in scope.

The dates that matter for a website

The Act phases in over several years. In July 2026 the EU adopted the "Digital Omnibus on AI" (Regulation (EU) 2026/1744, in force since 27 July 2026), which moved some deadlines. Here is where things stand:

Date	What applies
2 February 2025	Banned AI practices and the AI literacy duty
2 August 2025	Rules for general-purpose AI models (the providers of models like GPT, Claude or Gemini)
2 August 2026	Transparency rules (Article 50): chatbot disclosure, labelling of deepfakes and some AI text
2 December 2026	Machine-readable marking deadline for generative AI systems already on the market before 2 August 2026
2 December 2027	High-risk rules for stand-alone systems (Annex III), postponed from August 2026
2 August 2028	High-risk rules for AI built into regulated products (Annex I)

The headline of the Omnibus was the delay of the high-risk rules. What did not move is the part most websites care about: the Article 50 transparency duties have applied since 2 August 2026.

What Article 50 asks of your website

Article 50 has four parts. Not all of them land on you, because some fall on the company that builds the AI system (the "provider") and some on the business that uses it (the "deployer"). On a typical website you are the deployer, and often partly the provider too if your agency built a custom assistant for you.

1. Tell people when they are talking to an AI

AI systems that interact directly with people must be designed so that people are informed they are interacting with an AI, unless it is obvious from the context. For a website chatbot, a voice agent on your phone line or an AI that replies to emails, the safe reading is simple: say it clearly, at the start of the conversation.

Good practice:

• A short line in the chat window before the first message: "You're chatting with our AI assistant."
• A visible label on the widget itself, not hidden in your privacy policy.
• For phone agents, a spoken sentence at the start of the call.
• An easy route to a human for anything the AI should not handle.

A chatbot with a human name and photo and no disclosure is exactly what this rule exists to stop.

2. Mark AI-generated content in a machine-readable way

Providers of systems that generate synthetic audio, images, video or text must make the output detectable as AI-generated, for example with watermarks or metadata. This duty sits mainly with the companies that build generative tools. If you only use those tools, your job is not to strip the marking out. If your agency built a custom generator into your site, ask how the outputs are marked. Systems already on the market before 2 August 2026 have until 2 December 2026.

3. Label deepfakes

If you publish images, audio or video that look like real people, places or events and were generated or manipulated with AI, you must disclose that. An AI-generated "customer testimonial" video of a person who does not exist, or a realistic product scene that never happened, needs a clear label. Obviously artistic, satirical or fictional work gets a lighter treatment, but it still needs a disclosure that does not ruin the work.

4. AI-written text on matters of public interest

AI-generated text published to inform the public on matters of public interest must be disclosed as AI-generated, unless a human has reviewed or edited it and a person or company holds editorial responsibility for it. For most business blogs, the practical lesson is: keep a human editor in the loop and stand behind what you publish. That is also what search engines and readers reward.

The AI literacy duty

Since February 2025, businesses that provide or use AI systems must take steps on the AI literacy of the people who operate them. The Omnibus softened the wording: you must now take measures to support the AI literacy of your staff, and the Act does not require any specific level of knowledge for each person.

In practice, keep it proportionate and written down:

• A short internal guide on which AI tools are approved and what they may be used for.
• Clear rules on what data may never go into an AI tool (client data, health data, passwords).
• A named person who looks after your chatbot's answers and settings.
• A short briefing for anyone who edits the assistant's knowledge base.

Is your chatbot "high-risk"?

Almost certainly not. A chatbot that answers questions about your services, books appointments or qualifies leads is a limited-risk system with transparency duties. It becomes a different story if the AI makes or heavily shapes decisions in areas the Act lists as high-risk, for example:

• Screening job applicants or ranking CVs
• Deciding creditworthiness or insurance pricing for individuals
• Deciding access to education or essential public services
• Acting as or within a regulated medical device

If your website uses AI for any of these, take legal advice now. Those rules now apply from 2 December 2027, but building the documentation, risk management and human oversight takes time.

Fines

The AI Act has three levels of fines. Using a banned practice can cost up to €35 million or 7% of worldwide annual turnover. Breaking most other obligations, including the Article 50 transparency rules, can cost up to €15 million or 3%. Giving regulators incorrect or misleading information can cost up to €7.5 million or 1%. For SMEs, each fine is capped at the lower of the two amounts.

Realistically, regulators will start with the clear cases: undisclosed bots, deceptive deepfakes and banned practices. A visible notice costs nothing to add and removes the most obvious risk.

The AI Act does not replace GDPR

Most website chatbots process personal data: names, emails, phone numbers and whatever visitors type into the chat. That means GDPR applies alongside the AI Act. You still need a legal basis, a privacy notice that mentions the assistant, a data processing agreement with your AI provider, sensible retention of transcripts and a lawful setup for any transfer outside the EU. We cover this in detail in our guide to using an AI chatbot under GDPR.

A checklist for your website

Work through this list once, then review it every time you add an AI feature:

1. List every AI feature on your site and in your customer channels: chat widget, voice agent, email assistant, AI search, product recommender, content generator.
2. Add a clear AI notice to every conversational feature, shown before or at the first interaction.
3. Offer a human route (form, phone, email) for complaints, sensitive topics and anything the AI cannot answer.
4. Check your images and videos for realistic AI-generated people or scenes, and label them.
5. Keep a human editor on AI-assisted articles and pages, and name who is responsible.
6. Ask your provider or agency how generated outputs are marked and how they meet Article 50.
7. Check the high-risk list if your AI touches hiring, credit, insurance, education or health decisions.
8. Write a one-page AI policy for staff: approved tools, forbidden data, who owns the chatbot.
9. Update your privacy notice to describe the assistant and the provider behind it.
10. Review quarterly. Guidance from the Commission and national authorities is still arriving.

How we build AI features

When we build an AI assistant or a voice agent like fraxBOT, disclosure is part of the design, not a footnote: the assistant says it is an AI, answers only from your approved content, hands over to a human when it should and keeps logs you control. If you want an AI feature on your site, or a review of one you already run, see our AI integration service.