EU AI Act chatbot rules: what your webshop must disclose
Your webshop’s chatbot talks to customers directly – answering product questions, checking orders, sometimes closing a sale. Since 2 August 2026, EU law has required you to tell those customers they’re talking to AI. Miss it, and the fine can reach €15 million or 3% of global turnover, whichever is higher. Most merchants still haven’t checked whether their chat widget complies.
The good news: for a typical webshop chatbot, the obligation is narrow and easy to meet. Here’s exactly what applies, and how Corelex is built to handle it by default.
Key takeaways
Does the EU AI Act apply to your webshop’s chatbot?
Yes, if the chatbot interacts directly with people in the EU – regardless of where your business is registered. The AI Act sorts AI systems into risk tiers, and a customer-facing shopping or support chatbot almost always falls into the lightest one: limited risk. That means it isn’t subject to the heavy certification and documentation rules that apply to “high-risk” AI (things like credit scoring or biometric ID). It’s subject to a single, specific transparency duty under Article 50.
According to the European Commission’s own guidance, four conditions have to be met together for this duty to apply: the system qualifies as AI, it’s built for a genuine two-way exchange (not just automated form responses), the AI communicates with the person directly rather than through a human, and the person on the other end is a natural person – a customer, not another machine. A WooCommerce chat widget powered by an AI agent meets all four.
What exactly do you have to disclose?
Article 50(1) of the AI Act requires that people are informed they’re interacting with an AI system, “unless this is obvious” to a reasonably well-informed, observant person given the context. For most webshop chat widgets, it isn’t obvious enough to skip – so disclosure is the safer, and generally required, path.
The Commission’s guidance is specific about timing: people must be notified from the start of the first interaction, in a manner that’s clear and distinguishable – not buried in a terms-of-service page they’ll never read. In practice, EU guidance suggests a plain sentence is enough: something like “Hi, I’m a virtual assistant. I can help you find products or check your order.”
Two things worth noting: this obligation is separate from GDPR. Meeting one doesn’t automatically satisfy the other, and both apply if you’re processing EU customer data through an AI system. The AI Act also sets a separate deadline of 2 December 2026 for machine-readable marking of AI-generated content. That’s a different obligation, covering generated images, audio, video and text – not the duty to tell a customer they’re talking to AI. The chatbot disclosure obligation has applied in full since 2 August 2026.
Did the Digital Omnibus change the chatbot rule?
No. The Digital Omnibus on AI – Regulation (EU) 2026/1744, adopted 8 July 2026 and in force since 27 July 2026 – amended several parts of the EU AI Act, but the Article 50 transparency duty for chatbots still applied from 2 August 2026. If you were waiting to see whether the date would move, it didn’t.
The amendments that got the most attention concern high-risk AI systems and the national regulatory sandboxes member states have to set up – neither of which applies to a webshop chat widget. For a limited-risk chatbot, nothing about what you have to say to your customers changed.
The separate deadline for machine-readable marking of AI-generated content remains 2 December 2026. If your store publishes AI-generated product descriptions or images, that one is worth reading the regulation on directly.
What happens if you don’t comply?
Enforcement sits with national market surveillance authorities in each EU member state, not a single central regulator – the Commission publishes the list of designated authorities per country. Fines for breaching Article 50 can reach €15 million or 3% of global annual turnover for the previous financial year – whichever figure is higher – though authorities are expected to apply proportionality for small and medium-sized businesses.
For a small webshop, the realistic risk isn’t a headline fine – it’s the reputational and legal exposure of a chatbot customers didn’t know was AI, especially if it gave advice they later relied on. The fix costs nothing to implement and takes minutes to configure. The deadline has passed – if your chat widget doesn’t disclose today, it isn’t compliant today.
How Corelex handles this by default
Corelex was built with this disclosure requirement in mind, through two features that work together – both already part of the widget, not an add-on you have to build yourself.
An AI badge and tooltip in the chat header. Every Corelex chat window carries a small “AI” tag next to the window title. Hovering or tapping it shows a tooltip stating plainly that the visitor is chatting with an AI agent. It’s visible from the moment the widget opens – before the customer has typed a single word.
A configurable, translatable opening greeting. When the chat opens, the first message the visitor sees is the greeting – and the store admin controls exactly what it says. That makes it the natural place to state outright that this is an AI-powered assistant, in whatever wording fits the shop’s tone. Because greetings are configurable per language and the widget already follows the page’s language automatically, that disclosure travels with the customer whether they’re browsing in English, Dutch, French, or German.
Together, the badge and the greeting put the disclosure exactly where EU guidance says it needs to be: clear, distinguishable, and present from the first interaction – not a fine-print disclaimer the customer has to go looking for.
One caveat worth being direct about: Corelex gives you the tools to disclose clearly, but the wording of your greeting is yours to write. A generic default greeting is a starting point, not a finished compliance statement – take a minute to make sure it actually says the agent is AI-powered in your own words.
Test our AI chat agent yourself on our demo website
Frequently asked questions
Does the EU AI Act apply to my webshop if my business isn’t based in the EU?
Yes. The obligation is tied to where the AI system interacts with people, not where the business is registered. If EU customers use your chatbot, Article 50 applies to that interaction.
Is a small “AI” icon in the chat window enough, or do I need a full disclosure message?
EU guidance calls for the disclosure to be clear and distinguishable from the first interaction. A persistent, visible AI badge combined with a greeting message that states outright the visitor is talking to AI is a reasonable way to meet both the “clear” and “at the start” parts of the requirement together.
Did the Digital Omnibus delay the AI Act’s chatbot rules?
No. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and amended several parts of the AI Act. The Article 50 transparency duty for chatbots was not among the provisions postponed – it applied from 2 August 2026 as originally scheduled.
Does complying with GDPR also cover the AI Act’s disclosure rule?
No. The two are independent obligations. A GDPR-compliant data processing setup doesn’t automatically satisfy Article 50’s transparency requirement, and vice versa – you need to address both.
Is there a grace period for the chatbot disclosure obligation?
No. The chatbot disclosure duty has applied in full since 2 August 2026. A separate deadline of 2 December 2026 applies to machine-readable marking of AI-generated content – a different obligation, covering generated images, audio, video and text rather than telling a customer they’re talking to AI.
Do I need to redo this for every language my shop supports?
Yes, in effect – the disclosure needs to be understandable to the person seeing it. Corelex’s greeting and tooltip are configurable per language, so the disclosure updates automatically with the widget’s language rather than only existing in one.
The bottom line
Every AI chatbot talking to EU customers has to say so – clearly, and from the first message. That has been the law since 2 August 2026, and the Digital Omnibus didn’t change it. It’s a narrow requirement for most webshops, not a compliance overhaul, but it does need to actually be there. Corelex ships the AI badge and configurable greeting needed to meet it out of the box; take a moment to check your greeting text actually says what it needs to say. See how Corelex chooses where your store data lives →
Published 29 July 2026 · Updated 3 August 2026 by UCPro BV, Hasselt, Belgium. This article explains general legal requirements under the EU AI Act and is not legal advice – consult a qualified advisor about your specific situation.
