The EU AI Act and your business website: AI chatbots, texts and images. What must be disclosed (as of November 2026)

Does the AI Act apply to a small business at all

The AI Act distinguishes two roles. A provider is whoever develops an AI system, or has it developed, and puts it on the market or into service under its own name or trademark. A deployer is a business or person using an AI system in a professional capacity. Purely personal use is excluded, but a sole proprietor who regularly earns money while using AI already counts.

A small business using off-the-shelf tools is usually a deployer. The European Commission's guidelines note that a business remains the deployer even when a contractor or freelancer operates the tool on its behalf. On the other hand, a business that simply orders an ad from an agency, without deciding whether or how the agency uses AI, is not a deployer.

For a website, three obligations matter: telling people they are talking to AI, labeling deepfakes, and labeling certain texts published on matters of public interest. On top of that comes AI literacy under Article 4.

A chatbot on your site: one sentence, in the right place

Article 50(1) requires an AI system intended to interact directly with people to be designed so that people know they are interacting with AI, unless this is obvious. Formally, this duty sits with the provider. If you buy a ready-made chat widget, the provider is usually its maker. But if the chatbot was built for your business and runs under its name, the Commission's guidelines give exactly that case as an example of a provider. Either way, visitors see the chat on your site, so it is worth checking yourself that the notice actually appears.

The notice must be clear and distinguishable, given at the latest at the first interaction, and meet accessibility requirements. The Commission says the "it's obvious" exception should be read narrowly. Simple rule-based automation, such as a classic auto-reply, is not an AI system under the regulation. As good practice, the Commission points to a chatbot greeting that states upfront that AI is answering, combined with a persistent label placed near the input field. For example: "I'm an AI assistant. My answers are automated and may contain mistakes. If you'd rather talk to a person, use the contact form."

According to the Commission's guidelines, the following are not enough on their own:

• a notice hidden only in the terms of service, privacy policy or documentation,
• generic labels like "assistant" or a human name and photo that may mislead users,
• a blanket statement such as "services on this website use AI",
• purely technical descriptions, such as "this system uses LLMs", without explaining that a machine is responding.

AI images and video: when you have to label them

The labeling duty covers deepfakes: AI-generated or manipulated images, audio or video that resemble existing people, objects, places or events and would falsely appear authentic. The deployer must then disclose that the content was generated or manipulated, at the latest when the viewer first sees it, in a way that is perceivable without special tools. An invisible watermark added by the tool is not enough.

One example from the Commission's guidelines matters for businesses: an AI-generated image of a product in an ad or on packaging that can mislead people about how the product really looks or what it is like, for example by making it look better than in real life, is a deepfake. A clearly fantastical scene, like a sphinx flying over the Eiffel Tower, is not. For evidently artistic, satirical or fictional content, a disclosure that does not spoil the work is enough.

What this means for an apartment rental, a salon or a cafe: interior, food or treatment-result images generated or substantially altered by AI are safest to label, and better still to replace with real photos. Ordinary color correction, cropping or removing dust spots from the lens counts as standard editing under the guidelines. The Commission has also published a set of EU icons for labeling AI-generated content that you can use.

AI texts: what the rules do not require

There is no general duty to label every text written with AI help. Article 50(4) covers only text "published with the purpose of informing the public on matters of public interest", for example on public health, public security or politics. Even such text needs no label if the AI-generated content "has undergone a process of human review or editorial control" and someone holds editorial responsibility for the publication.

The Commission's guidelines explicitly list text that is part of a company's advertising or product descriptions as falling outside the duty, except for claims related to, for example, health, consumer safety or sustainability. So an apartment description or a salon's service page usually needs no label.

Be careful with blog posts about health or safety, for example at a practice or clinic. What counts here is genuine review of the substance by someone with relevant knowledge. According to the Commission, spell-checking or grammar correction alone is not human review. Content published before August 2, 2026 does not need to be labeled retroactively.

Deadlines, 2026 changes and fines

In 2026 the EU adopted a package of amendments known as the Digital Omnibus on AI. The consolidated AI Act text including these changes is dated July 27, 2026. The Omnibus postponed the deadlines for high-risk systems, but it did not postpone the Article 50 transparency obligations. As of November 2026, the situation is:

• Article 50 applies from August 2, 2026: the AI chatbot notice, labeling of deepfakes and of public-interest texts,
• only providers of generative tools placed on the market before August 2, 2026 have until December 2, 2026, and only for technical, machine-readable marking of content; this does not affect the obligations of businesses that use those tools,
• Article 4 on AI literacy has applied since February 2, 2025; as amended, it still requires providers and deployers to take measures supporting AI literacy among people using AI on their behalf, but does not require them to guarantee any specific level of it,
• fines for breaching Article 50 reach up to EUR 15 million or, for a company, up to 3% of total worldwide annual turnover, whichever is higher; for small and medium-sized businesses the lower of the two applies, and the amount takes into account, among other things, company size, cooperation with the authority and whether the breach was intentional,
• in Poland, the Act of July 3, 2026 on artificial intelligence systems has been in force since August 11, 2026; the market surveillance authority is the Commission for the Development and Security of Artificial Intelligence (Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji), and the provisions on inspections, proceedings and fines took effect on October 28, 2026,
• under the Polish act, where there is a reasonable suspicion of a breach, the Commission may issue a warning stating what needs to be fixed; the business then has 21 days to report that it has done so.

A checklist for your business website

If the chatbot collects a name, email, phone number or the content of an inquiry, GDPR also applies. In August 2026, the Polish data protection authority (UODO) published a checklist for small and medium-sized businesses using off-the-shelf AI tools. UODO says that before a tool is used on customer data, you need a contract with the vendor, an established legal basis for processing, information for the people whose data goes into the tool, and knowledge of where the data is stored. The checklist is filled in separately for each use, and it is worth keeping as evidence.

• The chatbot's first message says plainly that AI is answering, and there is a persistent label by the input field.
• The chat has no human name or photo suggesting you are talking to an employee.
• The notice is readable on a phone and by screen readers.
• AI images and video that could pass for real photos of your offer are labeled or replaced with real photos.
• Posts on health or safety get a substantive review by a person who is responsible for them.
• You keep a short note: which AI tools the business uses, for what, and who operates them. It helps during an inspection and with Article 4 staff training.
• You have a data processing agreement with the chat vendor and know whether data leaves the European Economic Area.
• Your privacy policy describes the chat: what data it collects, for what purpose and how long it is kept.

When I set up AI assistants on client websites, I go through these points one by one before the chat goes live for visitors. If you would like someone to review your site from this angle, write to me through the contact form.

Frequently asked questions