If your website has a chatbot, it needs a disclosure line by 2 August

What the 2 August AI rule actually asks of your chatbot

If there’s a chat bubble in the corner of your website and it’s powered by AI, there’s a date coming: 2 August 2026. Here’s what it actually requires — which is a good deal less than some of the emails landing in your inbox this month suggest.

The rule, in one sentence

From 2 August 2026, Article 50 of the EU AI Act means an AI system that interacts directly with people has to make clear to those people that they’re dealing with AI — unless that’s already obvious from the circumstances.

For a typical small-business chat widget, that’s it. A sentence at the start of the conversation.

What it isn’t

Worth being clear about, because a lot of the noise around this date is selling something else.

• It isn’t a certification. There’s no badge, no register, no auditor, nothing to buy.
• It isn’t the high-risk regime. Ordinary customer-service chat, an assistant, a summariser — these are limited-risk transparency duties. The heavy conformity-assessment machinery applies to Annex III uses (HR, credit, education, medical, biometrics, critical infrastructure) and runs on its own, later, timetable.
• It isn’t retroactive on content. Content generated before 2 August doesn’t need labelling after the fact.

If someone offers you “EU AI Act compliance” for a chat widget, a fair question is: which article, and which obligation?

Who’s actually on the hook — you, or your chatbot vendor?

This is the part worth five minutes.

The Act splits roles. The provider builds the system or places it on the market. The deployer uses it under their own authority. The chatbot-disclosure duty in Article 50(1) sits with providers — usually your widget vendor, not you. But deployers carry their own obligations under the Act whether they built the system or bought it, and the roles can shift: put your own branding on a system, or modify it substantially, and you can become the provider yourself.

Practically, for a small business:

1. Check whether the disclosure is already there. A lot of vendors shipped it months ago.
2. If it isn’t, add it anyway. “It’s the vendor’s job” is technically arguable and commercially uncomfortable — it’s your customer looking at the screen.
3. Write down what you checked and when. That note, plus a list of which AI tools you use and what for, is most of what people mean by “an AI policy.”

This isn’t legal advice — the Commission published its final Article 50 guidance on 20 July 2026, and that’s the source to go to rather than any second-hand summary, including this one.

The actual fix

Something along these lines, shown at the start of the conversation:

You’re chatting with an AI assistant. It can answer common questions about [bookings / orders / opening hours]. Ask for a human any time.

Three things make it work: it appears before the conversation starts, it’s in the interface rather than buried in a policy page, and it offers a route to a person.

Human-staffed live chat isn’t caught by this at all.

The bit that’s worth more than ten minutes

Adding the notice takes ten minutes. The more interesting part is that it means opening the chatbot’s configuration — often for the first time since somebody set it up.

While you’re in there:

• What can it reach? A widget that answers questions about your bookings or orders has read access to something. What, exactly?
• Where does the API key live? If it’s in the page’s client-side code, it’s readable by anyone who views the source.
• What can it do, not just say? Creating tickets, changing bookings, issuing refunds — actions have a much bigger blast radius than answers.
• What does it log, and where? Chat transcripts are personal data, and they often contain more than people expect.

None of that is an AI Act question. It’s the ordinary question of what a feature can reach — which is where the real risk usually sits. In a 2026 preprint study of 200 publicly deployed AI-built applications, broken access control (one user reaching another’s data) was the single largest class of finding. Not yet peer-reviewed, but it matches what turns up in practice.

What to do this week

1. Is your chat widget AI-powered, or human-staffed?
2. If it’s AI — does it already say so, at the start?
3. If not, add the sentence.
4. Note what you checked, the date, and who’s responsible for it.
5. If it reaches your customer data or can take actions on your behalf, that’s a separate and more interesting conversation.

[CTA block] We’ve put the above into a one-page checklist you can work through in an afternoon — including the questions to ask your chat widget’s vendor. → Get the checklist

Supported by AI, checked by a human.