A chatbot on your website: what the AI Act requires

Since 2 August 2026, anyone chatting with an AI on your website has to be told it is an AI, at the latest when the conversation starts. If you installed a ready-made chat widget, that duty sits with the vendor who built it, and your job is to check that the notice actually shows on your site. If you built the bot yourself on a language model and run it under your own name, the duty is yours. Two things are on you whatever tool you use: labelling realistic AI-generated images and video, and labelling AI-written texts on matters of public interest that nobody reviewed.

Where the rules come from

They are in Article 50 of the AI Act, Regulation (EU) 2024/1689, and apply from 2 August 2026 under Article 113. In July 2026 the Commission published guidelines on Article 50 with examples of what is and isn't covered. They aren't law, but they show how the rules will be read.

Article 50 splits the duties between two roles. The provider (Article 3(3)) develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, paid or free. The deployer (Article 3(4)) uses an AI system under its authority, unless the use is purely personal.

Which one are you

You installed a ready-made widget

The vendor is the provider. Article 50(1) requires it to design the system so that people know they are talking to an AI. Because the bot also generates text, Article 50(2) machine-readable marking of its output is on the vendor too. You are the deployer, and Article 50 doesn't put that notice on you. But visitors meet the bot on your site, so if your settings switch the vendor's notice off or your design hides it, the problem is on your page.

You built the bot yourself on an LLM API

"Putting into service" includes supplying a system for your own use (Article 3(11)). The guidelines (paragraph 11) call a company that develops a chatbot in-house and runs it in the EU under its own name a provider. Belgium's FPS Economy reads it the same way on its page for AI developers: you are a provider if you "integrate an existing model into your application". Then the Article 50(1) notice is your job.

You publish AI-generated images, video or text

You are the deployer, and Article 50(4) applies to you whoever made the tool.

What a proper notice looks like

Article 50(5) asks for information that is "clear and distinguishable", given at the latest at the first interaction and meeting the applicable accessibility requirements. The guidelines (paragraphs 36 to 38) suggest a first-turn greeting or a label such as "You are interacting with an AI system", ideally placed next to the input field. FPS Economy's guide says a simple statement like "You are chatting with an AI assistant" is enough. They say these are not enough on their own:

• a mention only in the terms or the privacy policy;
• a vague word like "assistant";
• a site-wide line such as "Services on this website use AI";
• a technical note like "this system uses LLMs".

A human name and photo on the bot also works against you: the guidelines treat human-like representations as potentially misleading.

One notice at the start of a conversation usually suffices. Where people are more easily misled, the guidelines expect repeated reminders, and they name legal assistance, financial advice, insurance, health advice and complaints handling. That covers many lawyers', accountants' and advisers' sites. The bot should also answer honestly when someone asks whether they are talking to a person.

The "obvious" exception

Article 50(1) drops the notice when it is obvious to a reasonably well-informed, observant and circumspect person that they are dealing with an AI. The guidelines (paragraphs 42 to 45) want it read restrictively and rule it out when the general public, older people and children included, may use the system. Their examples of where it applies are code assistants for developers and internal tools for trained staff. A helpdesk chatbot on a public website is listed as a case where it does not. On a business website, assume you need the notice.

What you label as the site owner

Deepfakes come first. Article 50(4) requires a disclosure when AI-generated or manipulated image, audio or video content resembles real people, objects, places or events and would falsely appear authentic. According to the guidelines (paragraph 113), it is enough that the subject could plausibly exist, and "events" include depictions of professional services. By our reading, a photorealistic AI "team photo", an office that doesn't exist or a staged "client meeting" needs a visible label. Colour correction or a tidied background usually doesn't. The vendor's invisible machine-readable marking does not replace your visible label (paragraph 117).

Then texts. The second subparagraph of Article 50(4) covers AI-generated text published to inform the public on matters of public interest, such as law and justice, public administration, health or consumer safety. Ad copy and product descriptions are outside it (paragraph 131). By our reading, a lawyer's article on a new law is inside. No label is needed if a person reviewed the text in substance, checking facts and not just spelling, and someone holds editorial responsibility for publishing it. The guidelines (paragraph 138) add that this person or function should be easy to find on the site.

Article 50(3) also puts emotion recognition and biometric categorisation on the deployer, but small business sites rarely use them.

What the Digital Omnibus changed

Regulation (EU) 2026/1744, the Digital Omnibus on AI, has been in force since 27 July 2026. It pushed the high-risk rules back to 2 December 2027 and 2 August 2028. Article 50 still applies from 2 August 2026. The omnibus added one transition, in Article 111(4): providers of generative systems already on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking rule in Article 50(2). It covers only providers and only 50(2). The guidelines (paragraph 153) confirm the chatbot notice under 50(1) has applied since 2 August.

Fines and supervision in Belgium

Breaching Article 50 can cost up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)(g)). For SMEs it is whichever is lower (Article 99(6)). Article 99(7) lists what sets the amount, including cooperation and the steps taken to limit the harm.

Enforcement is national. On 5 October 2026 the Commission's list of national contact points for AI market surveillance (last updated 7 September 2026) had no entry for Belgium. FPS Economy runs an AI Act section for businesses and published a guide in September 2026, and neither names a supervisor. The obligations apply anyway. Which Belgian authority will enforce them is not yet settled.

Checklist

• The bot says it is an AI before or in its first message, and the notice shows on a phone too.
• The bot has no human name or photo and answers "are you a person?" honestly.
• You asked the widget vendor in writing how it meets Article 50(1) and 50(2), and checked that your settings don't hide the notice.
• If you built the bot yourself, you wrote down who the provider is and how the notice works.
• Photorealistic AI images of people, premises or services carry a visible label.
• A person checks every AI-assisted article on law, tax, health or safety, and the site names who is editorially responsible.
• The people who run the bot or publish AI content know the basics. Article 4, as amended by the omnibus, asks providers and deployers to support their staff's AI literacy.

The AI Act doesn't replace the GDPR. Chat transcripts usually hold personal data, so your privacy policy has to cover them under Article 13 GDPR. In Belgium that is supervised by the Data Protection Authority (GBA/APD).

What a new site costs is on the pricing page, and how we build them on the website development page. Whether to build a site with an AI builder or a studio is covered in a separate article.