The EU Artificial Intelligence Act (Regulation EU 2024/1689) is now the world's first binding horizontal law governing AI systems. Full enforcement landed on 2 August 2026. If your organization deploys a chatbot — for customer support, lead generation, HR self-service, financial guidance, or any other purpose — and that chatbot is accessible to people in the European Union, you are in scope.
Most chatbots fall into the "limited risk" tier and face one primary obligation: tell users they are talking to an AI. But the use case determines the tier, and some chatbot deployments land squarely in the high-risk category with a much heavier compliance burden. The penalties are real: up to €35 million or 7% of global annual turnover for the most serious violations. This article walks you through the enforcement timeline, risk classification, Article 50 transparency rules, high-risk triggers, GPAI obligations for vendors, the penalty structure, and a practical compliance checklist — so you can assess your exposure and act before an enforcement action does it for you.
TL;DR — Key takeaways
- August 2026: full AI Act enforcement, including Article 50 transparency for all chatbots using NLP or LLMs
- Most chatbots = limited risk: core obligation is a clear "you are talking to AI" disclosure at the start of each interaction
- High-risk triggers: recruitment screening, credit scoring, educational assessment, public-service eligibility — if your chatbot does any of these, Annex III applies
- GPAI rules: foundation model providers (OpenAI, Anthropic, Google) face obligations since August 2025; chatbot deployers using those models inherit documentation requirements
- Penalties scale by tier: €7.5M / 1% for transparency failures, up to €35M / 7% for prohibited practices
- The AI Act stacks on top of GDPR — both apply simultaneously to most chatbot deployments
Table of Contents
- AI Act Enforcement Timeline: What Is Active Now
- Risk Classification: Where Chatbots Typically Land
- Article 50 Transparency: The "You Are Talking to AI" Obligation
- High-Risk Use Cases That Pull Chatbots into Annex III
- GPAI and Foundation Model Obligations for Chatbot Vendors
- Penalty Structure: Up to €35M or 7% of Global Turnover
- Compliance Checklist for Chatbot Buyers and Deployers
- Vendor Due Diligence Questions
- Heeya's AI Act Posture
- Further Reading
- FAQ
AI Act Enforcement Timeline: What Is Active Now
The AI Act was adopted by the European Parliament on 13 June 2024 and entered into force on 1 August 2024. Enforcement has rolled out in three distinct waves. Understanding which wave applies to your situation is the first step in any compliance assessment.
| Date | What Became Enforceable | Who Is Directly Affected |
|---|---|---|
| 2 February 2025 | Article 5 prohibited practices: subliminal manipulation, social scoring, real-time remote biometric identification in public spaces, exploitation of vulnerable groups | All providers and deployers in the EU — any organization running AI in scope must avoid these practices immediately |
| 2 August 2025 | Title III (GPAI): obligations for general-purpose AI model providers — technical documentation, copyright transparency, safety evaluations for systemic-risk models | Foundation model providers (OpenAI, Anthropic, Google DeepMind, Mistral, Meta AI, etc.) — not chatbot deployers directly, but the documentation they produce flows downstream |
| 2 August 2026 | Full enforcement: Annex III high-risk system obligations, Article 50 transparency for chatbots and deepfakes, all remaining titles and recitals | Every deployer of an AI chatbot accessible in the EU — this is the date that governs your customer-facing or employee-facing AI |
| 2 August 2027 | Obligations for high-risk AI embedded in products already covered by existing EU product safety directives (machinery, medical devices, automotive) | Hardware and embedded AI product manufacturers — largely irrelevant for pure software chatbot deployments |
The date that governs most enterprise chatbot deployments is 2 August 2026. Article 5 prohibitions have been active since February 2025 — if your chatbot uses subliminal or manipulative techniques to influence user behavior against their interests, that is already a violation. For everything else: August 2026 is the enforcement horizon. The European Commission's official AI Act page maintains the authoritative regulatory calendar and guidance documents.
Risk Classification: Where Chatbots Typically Land
The AI Act organizes AI systems into four tiers. The tier determines the obligations. Unlike GDPR, which applies uniformly to all personal data processing, the AI Act scales its requirements to the potential harm posed by the AI system in its specific deployment context.
| Risk Tier | Definition | Chatbot Examples | Core Obligations |
|---|---|---|---|
| Unacceptable (Article 5) | Practices that pose an unacceptable threat to fundamental rights | A chatbot that uses subliminal techniques to manipulate purchasing behavior; a bot that builds social-scoring profiles of users | Prohibited outright — no compliance path |
| High Risk (Annex III) | Significant impact on health, safety, or fundamental rights in defined sectors | CV screening bots, creditworthiness assessment bots, educational grading bots, public-benefit eligibility bots | Conformity assessment, technical documentation, human oversight, risk management system, data governance, post-market monitoring, EU registration |
| Limited Risk (Article 50) | Direct interaction with users; limited potential for harm but transparency required | Most customer support, lead generation, FAQ, and internal helpdesk chatbots | Transparency disclosure: users must be informed they are interacting with AI at or before the first message |
| Minimal Risk | No meaningful risk to rights or safety | Spam filters, basic product recommendation engines with no natural language interaction | No mandatory obligations (voluntary codes of conduct encouraged) |
The practical default for a customer-facing chatbot using NLP or an LLM is limited risk. Your support bot, lead qualification assistant, or FAQ agent almost certainly lands here — and the primary obligation is the Article 50 transparency disclosure. The exception is deployment context: the same underlying chatbot technology deployed in a recruitment screening workflow or a credit assessment process enters Annex III high-risk territory regardless of how the vendor markets it. For enterprise teams evaluating the business case for AI adoption alongside compliance costs, our guide on generative AI enterprise ROI and use cases provides the full picture.
Purely rule-based chatbots — button flows, decision trees, keyword matching without natural language understanding — fall outside the definition of an "AI system" under the Act and carry no obligations. The moment you add an LLM, NLP engine, or any component that processes free-form language to generate responses, you are inside the regulation.
Article 50 Transparency: The "You Are Talking to AI" Obligation
Article 50(1) of the AI Act states that providers of AI systems intended to interact directly with natural persons must ensure those systems are designed so that the natural persons are informed, before the interaction begins, that they are interacting with an AI system. The obligation applies unless it is obvious from the context.
In practice, for a website chatbot, this means the following requirements must be met by 2 August 2026:
1. The disclosure must be proactive and pre-interaction
You cannot wait for the user to ask "Am I talking to a bot?" The disclosure must appear before or at the start of the conversation. A visible badge on the chat widget, an automated first message stating the system is AI-powered, or both — either approach satisfies the requirement. An "AI" label that requires the user to scroll or search for it does not.
2. The disclosure must be clear, not buried in terms
A reference to AI in your privacy policy or terms of service is not sufficient as a standalone disclosure. The AI Act requires that the user be "informed" at the point of interaction. The language must be plain: "You are chatting with an AI assistant" or "This is an AI-powered support agent" qualifies. Marketing language like "Our smart assistant" does not.
3. Capability and limitation signaling
Users should be able to understand what the chatbot can and cannot do. If the bot is not authorized to provide personalized legal or medical advice, it must say so and direct users to an appropriate human contact. Unrestricted responses on topics outside the system's validated knowledge base create both AI Act exposure and liability risk.
4. Human escalation pathway
Users must have a clear way to reach a human. The chatbot cannot be the sole contact channel. This does not require a live handoff — a visible "Contact our team" option, an email address, or a form submission path satisfies the requirement — but the pathway must exist and be accessible.
5. Technical documentation
You must be able to document: which AI model or system powers the chatbot, what data sources inform its responses, and what human oversight measures are in place. This documentation is not filed with a regulator by default, but it must be producible if an enforcement authority requests it.
High-Risk Use Cases That Pull Chatbots into Annex III
Annex III of the AI Act enumerates the specific application areas where AI systems are classified as high-risk. A chatbot that performs functions in any of these areas — regardless of what the vendor calls it — is subject to the full high-risk obligation set: conformity assessment, technical documentation, risk management, human oversight, data governance, accuracy and robustness requirements, and EU registration before deployment.
| Chatbot Use Case | Annex III Category | Risk Tier | Key Obligations |
|---|---|---|---|
| CV screening, applicant ranking, interview scheduling automation | Employment, workers management, access to self-employment (Annex III §4) | High risk | Conformity assessment, human oversight, bias testing, registration in EU AI database |
| Creditworthiness evaluation, loan eligibility, insurance risk profiling via chat | Access to private financial services (Annex III §5b) | High risk | Accuracy and robustness requirements, explainability, human review pathway |
| Adaptive learning platforms, student grading or assessment bots | Education and vocational training (Annex III §3) | High risk | Data governance, technical documentation, human oversight |
| Benefits eligibility screening, government service access, social welfare assessment | Access to essential private and public services (Annex III §5a) | High risk | Full Annex III obligations; registration mandatory |
| Medical triage, personalized diagnosis support, treatment recommendation | Medical devices, health and safety (Annex III §2 / MDR overlap) | High risk | MDR and AI Act dual compliance; clinical validation may be required |
| Customer support, lead generation, FAQ answering, internal IT helpdesk | None — outside Annex III | Limited risk | Article 50 transparency disclosure only |
The critical compliance question for any chatbot deployment is not "what is the bot called?" but "what decisions does the bot influence?" A customer support bot that also collects data used to score a customer's creditworthiness is in the high-risk category. An HR chatbot that routes applicants based on keyword matching in their CV responses is in the high-risk category. When in doubt, apply the precautionary principle: document your system as if it were high-risk, implement human oversight, and conduct a bias assessment. These are good practices regardless of tier.
GPAI and Foundation Model Obligations Affecting Chatbot Vendors
The AI Act introduced a new regulatory category: General-Purpose AI (GPAI) models, also called foundation models — large-scale AI trained on broad data capable of performing a wide range of tasks. This category covers the LLMs that power virtually every modern chatbot: GPT-4o, Claude 3, Gemini 1.5, Llama 3, Mistral Large, and their equivalents.
GPAI obligations became active on 2 August 2025 and apply primarily to the model providers, not directly to chatbot deployers. However, this distinction matters for vendor selection:
- Technical documentation: GPAI providers must produce and maintain documentation describing training data, computational resources, capabilities, and limitations. Chatbot deployers building on these APIs should request access to this documentation — it is part of your own compliance file.
- Systemic risk models: Models above 10^25 FLOPS training compute (currently affecting the largest frontier models) face additional obligations including adversarial testing, cybersecurity incident reporting, and energy consumption reporting. If you deploy a chatbot powered by one of these models, your vendor's compliance status under this provision is a legitimate due diligence question.
- Copyright transparency: GPAI providers must publish a summary of training data sources. This has implications for regulated sectors where provenance of training data affects output admissibility.
- Downstream deployer obligations: Even though you are not the model provider, Article 25 makes clear that deployers remain responsible for the AI Act compliance of the system they deploy. You cannot outsource your Article 50 transparency obligation to your LLM vendor. The vendor's GPAI compliance reduces your risk but does not eliminate your obligations.
For chatbot buyers evaluating vendors: your vendor should be able to name the foundation model(s) used, confirm the model provider's GPAI compliance status, and provide a Data Processing Agreement that addresses AI Act obligations alongside GDPR. For a deeper look at GDPR-compliant AI chatbot architecture, including how EU data residency and model selection interact, that guide covers the data layer in detail.
Penalty Structure: Up to €35M or 7% of Global Annual Turnover
The AI Act establishes three penalty tiers, scaled by the severity of the violation. These are maximum figures — enforcement authorities apply proportionality, particularly for SMEs — but the structure makes clear that the legislator views AI Act violations as more serious than equivalent GDPR infractions.
- Prohibited practices (Article 5 violations): up to €35 million or 7% of global annual turnover, whichever is higher. This tier covers the use of subliminal manipulation, social scoring, and other banned practices. For large technology groups, 7% of global turnover exceeds €35M, making this the effective cap.
- High-risk system non-compliance (Annex III violations): up to €15 million or 3% of global annual turnover. Applies to organizations that deploy Annex III high-risk chatbots without completing conformity assessments, maintaining required documentation, or implementing human oversight.
- Transparency obligation failures (Article 50 violations): up to €7.5 million or 1% of global annual turnover. The tier most likely to affect organizations deploying standard customer-facing chatbots that fail to disclose AI interaction at the start of conversations.
For SMEs and startups, penalties are capped at the lower of the turnover percentage or the fixed amount. The fixed amounts are the floor, not the ceiling, for large organizations. Enforcement will prioritize large-scale, high-harm violations in the early years, but national enforcement authorities — which each EU member state must designate — have the power to act on any in-scope deployment. The compliance cost for a limited-risk chatbot is minimal: a disclosure banner, technical documentation, and an accessible human contact. The enforcement cost of ignoring the regulation is not. If you are deciding whether to build a custom AI-Act-compliant chatbot or purchase a certified platform, our guide on custom AI chatbot build vs. buy covers the compliance cost implications of each path. For enterprise teams exploring the more advanced agentic AI capabilities that attract higher-risk classifications, see our guide on agentic RAG implementation for enterprise.
Compliance Checklist for Chatbot Buyers and Deployers
The following checklist applies to organizations deploying AI chatbots in the EU, or accessible to EU users, as of 2 August 2026. Items marked for limited-risk chatbots are the baseline. Organizations with potential high-risk deployments should treat those items as a starting point, not a ceiling.
Article 50 transparency — required for all AI chatbots
- The chat widget displays a visible AI indicator (badge, label, or icon) before the first message
- The chatbot's first automated message explicitly states it is an AI assistant, not a human
- The disclosure language is plain and unambiguous — no marketing euphemisms
- A human contact pathway (email, form, phone, or live agent option) is accessible from the chat interface
- The chatbot's scope limitations are communicated when a user asks about topics outside its validated knowledge
Technical documentation — required for all AI systems
- The AI model or system powering the chatbot is identified (vendor name, model version or API)
- The data sources informing chatbot responses are documented (knowledge base files, URLs, databases)
- Oversight procedures are defined: who is responsible for reviewing chatbot performance, how often, and what the escalation path is
- Conversation logs are retained and accessible for audit purposes
- The GPAI model provider's technical documentation has been reviewed and filed
Risk classification — required before deployment
- A formal use-case review has been conducted to determine whether any Annex III category applies
- If high-risk: a conformity assessment has been completed or is underway
- If high-risk: the system has been or will be registered in the EU AI database before deployment
- The risk classification and rationale are documented and signed off by a responsible individual
Data governance — required where personal data is processed (AI Act + GDPR overlap)
- A Data Processing Agreement with the chatbot vendor is in place
- EU data residency is confirmed or a valid cross-border transfer mechanism (SCCs) is documented
- Conversation data retention and deletion policies are defined and aligned with your GDPR Record of Processing Activities
- Users are informed about data processing through your privacy notice, updated to cover AI interaction data
Vendor Due Diligence Questions
If you are evaluating a chatbot platform for EU deployment, the following questions should be on your shortlist before signing a contract. A vendor that cannot answer them clearly in writing is a compliance risk.
- Which foundation model powers the platform, and what is that model provider's GPAI compliance status under the AI Act? — You need the model name (e.g., GPT-4o via OpenAI API, Gemini via Google AI API) and a statement that the provider has met August 2025 GPAI obligations.
- Where is conversation data processed and stored? — EU hosting eliminates cross-border transfer complexity. US hosting requires active SCC documentation. Ask for the data residency specification in writing.
- Is a Data Processing Agreement available, and does it address AI Act obligations explicitly? — GDPR DPAs are standard. AI Act-specific provisions (technical documentation availability, oversight support) are increasingly expected from compliant vendors.
- Does the platform provide native Article 50 transparency features? — Ask whether the platform includes configurable AI disclosure banners, opening message templates, and audit logs out of the box, or whether compliance configuration is entirely your responsibility.
- Can the platform provide technical documentation for my compliance file? — The documentation you need to produce under the AI Act depends partly on documentation your vendor must supply. Confirm this is available before you need it.
- Has the vendor undergone any third-party AI Act conformity review? — For high-risk use cases, third-party conformity assessment is mandatory. For limited-risk deployments, voluntary third-party review is a meaningful signal of a vendor's compliance maturity.
For a broader assessment of the EU compliance landscape across chatbot platforms, our comparison of AI chatbot platforms in 2026 covers vendor-by-vendor GDPR and AI Act positioning. The guide on GDPR-compliant AI chatbot architecture addresses the data governance layer in depth.
Heeya's AI Act Posture
Heeya was built from the start for European regulatory requirements. The following describes our current AI Act posture as of August 2026.
- Article 50 transparency built in: every Heeya widget displays a clear AI identifier before the first interaction. The opening message is configurable, but the AI disclosure is a required element — it cannot be removed. Deployers are not responsible for implementing the disclosure separately.
- Conversation logging and audit trail: all interactions are logged and accessible in your dashboard. Logs are retained according to your configured retention policy and support the technical documentation obligation under Article 50 and Annex III.
- EU data residency by default: conversation data, knowledge base content, and user interaction data are processed and stored within EU infrastructure. No US data transfer is involved in the core conversation pipeline. A signed Data Processing Agreement is available on all paid plans.
- Transparent knowledge base: Heeya uses Retrieval-Augmented Generation — responses are grounded in documents you upload and control. You know exactly which sources inform each answer. There is no opaque training data that cannot be documented. This architecture is directly supportive of the technical documentation requirement: the data informing your chatbot is fully auditable.
- Human escalation pathway: Heeya's built-in contact form tool provides a configurable human contact option within the chat interface, satisfying the requirement that users be able to reach a person.
- Human oversight controls: you retain full control — modify instructions, review conversations, update the knowledge base, restrict topics, or disable the agent. No decision by the AI is irreversible without human review.
For organizations in regulated sectors — financial services, healthcare, legal, public services — where Annex III classification may apply, Heeya's documentation supports your conformity assessment process. See pricing for plan details or start a free trial to evaluate the platform.
For context on how Heeya compares to Intercom on EU compliance dimensions, our Heeya vs Intercom Fin comparison covers the regulatory and commercial differences in detail. If you are evaluating Crisp as an alternative, see our Heeya vs Crisp comparison. For a broader look at SMB alternatives to Intercom, see Intercom alternatives for SMBs in 2026.
Further Reading
- GDPR-Compliant AI Chatbot Guide 2026 — data residency, DPAs, and the privacy architecture of a properly built chatbot
- Heeya vs Intercom Fin 2026 — pricing model, EU compliance, and feature comparison
- Heeya vs Crisp 2026 — both EU-hosted platforms compared on AI capabilities and compliance posture
- Best Intercom Alternatives for SMBs in 2026 — six platforms compared on pricing, GDPR, and AI features
- Best AI Chatbot Platforms 2026 — comprehensive comparison including AI Act compliance scores
- Agentic AI and Autonomous Agents in the Enterprise 2026 — how autonomous AI agents intersect with high-risk AI Act obligations
FAQ
Does the EU AI Act apply to my customer support chatbot?
Yes, if the chatbot uses NLP, an LLM, or any AI component to process free-form language. Most customer support chatbots are limited risk under Article 50 — the core obligation is a clear AI disclosure at the start of each conversation. Full enforcement is from 2 August 2026. Purely rule-based bots (button flows, decision trees) without a language model are not covered.
What does Article 50 of the EU AI Act require for chatbots?
Article 50 requires that chatbots clearly disclose their AI nature before or at the start of the interaction — unless context makes it obvious. A visible AI badge on the widget and an opening message stating the system is AI-powered both satisfy this. A reference in your terms of service or privacy policy does not. Users must also have access to a human contact pathway from within the chat interface.
What makes a chatbot 'high risk' under Annex III?
Annex III lists the domains that trigger high-risk classification: recruitment and CV screening, creditworthiness and financial access, educational assessment, public service eligibility, and medical or safety-critical applications. Any chatbot performing functions in these areas — regardless of vendor marketing — faces the full high-risk obligation set: conformity assessment, human oversight, technical documentation, and EU AI database registration before deployment.
What are the penalties for non-compliance?
Three tiers: €35M or 7% of global turnover for prohibited practices; €15M or 3% for high-risk system violations; €7.5M or 1% for transparency failures (the most common exposure for standard chatbot deployments). For SMEs, penalties are proportional. Early enforcement will likely target large-scale violations, but the legal exposure exists for all in-scope deployments from August 2026.
Does the AI Act stack on top of GDPR?
Yes — both apply simultaneously. GDPR governs personal data processing; the AI Act governs AI system deployment. Any chatbot that processes personal data (conversation content, names, emails) must comply with both frameworks. GDPR compliance alone is not sufficient from August 2026. For a full treatment of the overlap, see our GDPR-compliant AI chatbot guide. — Written by Anas Rabhi.
