Chatbot on your website: do you have to tell customers it’s AI?

Yes, your chatbot has to say so, and the obligation falls on its provider, which may be the software company or you. Since 2 August 2026, Article 50 of the EU AI Act has applied: a chatbot, AI agent or avatar that interacts directly with your customers has to let them know they’re talking to an AI, from the start of the first exchange, unless it’s obvious to them. That’s what the European Commission says in its questions and answers on Article 50, updated on 24 July 2026. In practice, the chat bubble or the agent has to make it clear to the customer, from the first exchange, that they aren’t talking to a human, and not just in your terms of use.

One example runs through this article: a heating engineer working alone in Noisy-le-Grand. On his website, a chat bubble answers questions about servicing prices and offers appointment slots. On WhatsApp, an agent replies to messages in the evening. The Commission lists both uses among those Article 50 covers: chatbots for customer service, e-commerce or complaints handling, and AI agents that make bookings or manage correspondence, according to its guidelines published on 20 July 2026.

Who has to tell your customers: the chatbot company or you?

The text gives this obligation to the “provider” of the system, as the consolidated version of Article 50 as of 27 July 2026 shows. The paragraphs addressed to “deployers”, those who use the system, cover other cases: emotion recognition, biometric categorisation, deepfakes and certain texts published to inform the public. The same article states that it leaves untouched the other information obligations that EU or national law places on deployers.

Consumer law still applies too, the guidelines point out: it prohibits misleading people about the main characteristics of a service, and requires them to be set out clearly before the contract. Where the service being sold is itself AI-driven, such as a subscription chatbot, the fact that it’s AI may be one of those characteristics, whether or not the interaction is obvious.

The Commission’s guidelines define the provider as whoever develops an AI system, or has it developed, and places it on the market or puts it into service under their own name or trademark, whether for payment or free of charge. They give three examples that help you find your own case:

• A software company that sells a chatbot under its brand to businesses, which use it as it is, is the provider.
• A business that develops a chatbot itself and puts it into service for its own use, under its own name, is also a provider.
• A business that takes an existing generative AI system, modifies it, for example with new training data, then puts it into service under its own name, becomes the provider of that new system, without the original provider losing its own responsibilities.

For the heating engineer, that means two situations. If he has simply switched on the chat module of off-the-shelf software, it’s the software company that should have built in the message. If he has had an assistant built under his name by a contractor, the definition also covers whoever has a system developed and puts it into service under their own name, but none of the Commission’s examples describes this exact case. Either way, it’s on the heating engineer’s website that his customers see the message or don’t: in both cases, it’s in his interest to check for himself that it appears, as the list below describes.

Your customers know it’s a bot: are you exempt?

Rarely. The exception applies when an average person, reasonably well-informed and observant, can tell for themselves that they’re talking to an AI, and the Commission asks for it to be read strictly, in its questions and answers. Its guidelines limit it to cases where there’s almost no doubt, and add three points:

• Knowing that chatbots exist isn’t enough to recognise one during an exchange.
• Where the audience may include elderly people, children or people who aren’t comfortable with AI, the exception can’t be relied on for them.
• A profile picture showing a person is one of the factors in this assessment, and a chatbot in an online helpdesk whose replies could pass for human ones is among the examples where the obligation applies.

The Commission gives five examples of “obvious” AI: a coding assistant only available to developers, an internal assistant for trained staff, a diagnostic support tool only for trained health professionals, AI built into a home appliance and limited to running it, and a character in a single-player video game, where its AI nature is obvious to all players, vulnerable people included. The heating engineer isn’t in any of these cases: his chat bubble is open to members of the public of all ages. The message needs to be there.

What should the message say, and when?

The message comes at the latest at the start of the first exchange, at least once per conversation, clearly and distinctly from everything else, and accessible to people with disabilities, according to the guidelines. The regulation doesn’t require any particular wording. The Commission gives as examples a chatbot’s first message saying it’s based on AI, a banner such as “You are interacting with an AI system”, a visible badge near the input field, and for a voice agent a sentence spoken at the start of the call, a simple sound not being enough.

It also lists what isn’t enough on its own:

• a notice placed only in the terms of use, a link or documentation;
• a vague word such as “assistant”, or a human face that could mislead;
• a general sentence such as “Services on this website use AI”;
• a technical description (“this system uses LLMs”) that doesn’t explain that the reply comes from a machine.

A single prominent message before the first exchange is enough in most cases, according to the same text. Reminders during the exchange are likely to be needed in more sensitive contexts: when the system interacts with vulnerable people, such as children, elderly people or people with disabilities, for complaints handling, insurance or financial advice, and when there’s a need to stay aware of and in control of an AI agent’s actions. The system also has to say so when a customer asks whether they’re talking to a machine, or when it can be assumed the customer is mistaken about it. For the heating engineer, the prominent first message is the starting point: the guidelines don’t say whether a chat bubble that books appointments for a tradesperson counts among these more sensitive contexts.

What if an AI agent messages your customers on WhatsApp or books their appointments?

An AI agent that makes bookings, manages correspondence or negotiates on your behalf is covered as soon as it interacts with people. It has to be designed to say it’s an AI, and also on whose behalf it’s acting, in every situation where it’s reasonably likely to interact with a person, according to the guidelines. The Commission gives the example of an email written and sent by an agent, with an AI label at the top.

The same text rules out three situations:

• automatic replies without AI, such as an out-of-office message or quick replies based on fixed rules;
• an AI tool that helps an employee write, when it’s the employee who replies to the customer;
• replies written by AI then properly reviewed and sent by a person, who remains the customer’s point of contact. The mere possibility that someone might review them isn’t enough.

For the heating engineer, the evening WhatsApp agent that replies on its own is covered, with the name of the business it’s writing for. The quick replies he saved himself in the app, without AI, aren’t.

Who enforces it, and what are the risks?

Fines can reach 15 million euros or 3 % of worldwide turnover, and the Commission says proportionality may apply to small and medium-sized businesses, in its questions and answers. Its guidelines specify that for an SME, it’s the lower of the two caps that counts, and that market surveillance authorities can act on their own initiative or following a complaint from anyone who has grounds to think the rule isn’t being respected.

In France, the plan published by the Directorate General for Enterprise on 9 September 2025 gives enforcement for AI systems that interact directly with people to the DGCCRF and Arcom, subject to its adoption by Parliament, according to its page on the competent authorities. That page doesn’t say whether the text has been adopted since.

The regulation’s simplification text, which came into force on 27 July 2026 according to the Commission’s page on the regulation, doesn’t give you extra time for the message. It gives systems put into service before 2 August 2026 until 2 December 2026 for the technical marking of generated content, but informing people who talk to an AI system has been required since 2 August 2026, the guidelines specify. A chatbot installed in the spring is therefore covered today.

What you can do this week

In order, for a chatbot on your website or an agent on a messaging app. The first five steps check what the guidelines ask for, the last one is to find out who has to set up the message:

1. Open your website on your phone, in a private window, and open the chat bubble without typing anything. Check whether a message says it’s an AI before your first question.
2. If there isn’t one, look in the tool’s settings for the welcome message and write a sentence that includes the word AI and the name of your business, for example “Hello, you’re chatting with the AI assistant for”, followed by your business name. The word “assistant” on its own isn’t enough. If you can’t find this setting, keep the question for step 6.
3. If the bubble shows a person’s photo or first name, replace them with the business logo or add the AI label next to them.
4. Send a message to your WhatsApp or Messenger agent from another phone: its first reply should say it’s an AI and which business it’s replying for.
5. Ask it “Are you a human?” and check that it says no.
6. Write to the software company or contractor behind the tool to ask who the provider is within the meaning of Article 50, and where the information message is set.

What the texts don’t say yet

The guidelines don’t say whether feeding an off-the-shelf chatbot your prices, opening hours or documents makes you a provider: their example refers to a system that has been modified, for example with new training data, and put into service under another name. They aren’t binding, and only the Court of Justice of the European Union can give the authoritative interpretation, as their introduction points out, published on 20 July 2026 with the Commission’s documents. Until this point is settled, the simplest thing for the heating engineer is still to check that the message appears, whoever is supposed to provide it.

At Demain Solutions, we set up AI agents that answer your customers on your website, WhatsApp and Messenger. See our AI agents.

Published on 20 October 2026. Written by the AI agent of Demain Solutions, translated from French.