The EU AI Act and chatbots: what transparency obligations apply, and since when

What is the EU AI Act and when does it apply?

It's Regulation (EU) 2024/1689 of June 13, 2024, known as the Artificial Intelligence Act or AI Act. It was published in the Official Journal of the European Union on July 12, 2024 and entered into force on August 1, 2024. As a regulation, it applies directly in every EU country, without a national law to transpose it.

Its obligations arrive in stages. According to the European Commission's official timeline:

• February 2, 2025: prohibited AI practices and AI literacy.
• August 2, 2025: obligations for general-purpose AI models and each country's penalty rules.
• August 2, 2026: most of the regulation, including the Article 50 transparency obligations that affect chatbots.
• December 2, 2027 and August 2, 2028: high-risk systems, following the amendment known as the “Digital Omnibus.”

What does Article 50 say about chatbots?

Article 50(1) says providers must ensure that AI systems intended to interact directly with people are designed and developed so that those people are informed they are interacting with an AI system.

There are two exceptions. The first is when this is obvious to a reasonably well-informed, observant and circumspect person, given the circumstances and context of use. The European Commission says to read it restrictively. The second covers systems authorized by law to detect or investigate crimes, which doesn't apply to customer service.

A WhatsApp, website or Instagram chatbot that answers customers is exactly the case this paragraph regulates.

How and when do you have to disclose that it's AI?

Article 50(5) sets the form: the information must be provided in a clear and distinguishable manner, at the latest at the time of the first interaction or exposure, and meet applicable accessibility requirements.

In its transparency guidelines, published in July 2026, the Commission gives the example of a chatbot that opens the conversation by saying it's AI-based. In practice, the safest approach is for the first message to say it plainly, for example: “Hi, I'm Marta, [your business name]'s AI virtual assistant.”

Who is responsible: whoever builds the bot or the business that uses it?

Article 50(1) places the obligation on the provider, which the regulation defines as whoever develops an AI system, or has it developed, and puts it into service under its own name or trademark. If an agency builds the assistant and your restaurant runs it under its own name and number, it's worth putting in writing who is who and, above all, making sure the notice is on from the first message.

The other paragraphs of Article 50 cover other cases: marking AI-generated content, emotion recognition and biometric categorization, deepfakes, and AI-generated text published to inform the public on matters of public interest. A bot that answers opening hours or takes reservations doesn't fall into those.

Does it affect businesses outside the European Union?

It can. Under Article 2, the regulation applies to providers that put AI systems into service in the EU wherever they're based, and also to providers and deployers outside the EU when the system's output is used in the Union.

For a business in the US or Latin America serving customers in Spain, the prudent move is to comply anyway: saying it's AI costs nothing and builds trust in any country.

Is a customer service chatbot a high-risk system?

Generally, no. High-risk systems are those in areas such as employment, education, credit, biometrics or access to essential services, which carry much stricter obligations. An assistant that answers questions, takes reservation requests or hands the conversation to a person has, in principle, only the transparency obligations. If your bot makes decisions in one of those areas, the analysis changes and you should consult a lawyer.

What are the fines for non-compliance?

Article 99(4) sets fines for breaching the Article 50 obligations of up to €15 million or, if higher, 3% of total worldwide annual turnover for the preceding financial year. For SMEs and start-ups, Article 99(6) applies whichever of the two amounts is lower.

Each country sets its own penalty rules, and enforcement falls mainly to national market surveillance authorities, according to the Commission.

What good practices do we recommend?

• Have the first message say it's an AI virtual assistant, in the customer's language too.
• Never let it deny being AI when a customer asks.
• Let the customer ask for a person at any time, and make sure that actually works.
• Don't let the assistant make things up: if it doesn't know, it says so and hands off to your team.
• Remember the AI Act doesn't replace the GDPR: your customers' data follows its own rules.

Where can I read the official text?

• Regulation (EU) 2024/1689 on EUR-Lex, the official portal for EU law.
• The European Commission's AI Act Service Desk: the text article by article, the application timeline and FAQs.
• The Commission's FAQ on the Article 50 transparency obligations and its July 2026 guidelines.

How we do it at Ikusa Media

Our WhatsApp assistants never pretend to be people: if a customer asks, they don't deny being AI and they offer to connect them with someone on the team. In Europe, they also introduce themselves as a virtual assistant from the first message. This guide is for information only and isn't legal advice. If you want an assistant that complies from day one, message Sofía on WhatsApp or tell us about your case in the planner.