AI Act in business: obligations for chatbots and AI agents
A chatbot on your website, an AI agent answering emails, an assistant in customer service. Since 2 August 2026 tools like these have been subject to the transparency obligations in Article 50 of the AI Act, and since 28 October 2026 Poland has had rules in force on inspections, complaints and fines. In this article we explain which AI Act obligations apply to a company using chatbots and AI agents, who is responsible for them, what has been postponed and what is worth doing now. Legal position as of November 2026.
Published
Share
The AI Act for companies in one paragraph
If a person talks directly to your AI system, they must be told so at the latest during the first interaction, unless it is obvious. This duty is set out in Article 50(1) of the AI Act, Regulation (EU) 2024/1689. It rests with the provider of the system, and a company that commissions a chatbot and uses it under its own name can also be a provider. The heaviest requirements for high risk systems have been postponed, but the transparency obligations already apply.
Read next
More articles you may find useful.
Next step
Got your own stack to review?
The free audit maps out your situation in one conversation. You leave with a list of processes worth automating, a quote and an estimate of savings.
AI Act deadlines: what applies and what has been postponed
Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, entered into force on 27 July 2026 and changed part of the timetable. It does not postpone the whole AI Act, however. For a typical company the key dates are:
2 February 2025: prohibited AI practices (Article 5) and the duty to support AI literacy (Article 4).
2 August 2026: the transparency obligations in Article 50, including telling people they are talking to a chatbot.
28 October 2026: Polish rules on inspections, proceedings, individual opinions and fines start to apply.
2 December 2026: end of the transition period for technical marking of content under Article 50(2), only for generators placed on the market before 2 August 2026.
2 December 2027: requirements for high risk systems in Annex III, for example in recruitment.
2 August 2028: requirements for high risk systems that are part of products covered by the EU legislation listed in Annex I.
Provider or deployer: which one is your company
Most obligations depend on this answer. A provider is an entity that develops an AI system or has one developed and places it on the market or puts it into service under its own name or trademark. A deployer is an entity using an AI system under its authority in a professional capacity. One company can play both roles, depending on the tool.
A chatbot built for you and running under your brand
If your team or an external contractor built an assistant on a model available through an API and it runs under your name, your company is in principle the provider of that system. The European Commission guidelines on Article 50 explicitly give the example of a company that developed a chatbot internally and puts it into service for its own use under its own name. Article 50 applies to systems rather than to models themselves, so using someone else's model does not shift this duty to the model's maker.
An existing system that you modify
If you take another provider's existing generative AI system, change it, for example with new training data, and make it available under your own name, you become the provider of a new system. The original provider remains responsible for its own system.
A ready made tool under the manufacturer's brand
If you buy a ready made chatbot carrying the manufacturer's logo and use it unchanged, the manufacturer is the provider and you are the deployer. It is still worth checking that the disclosure feature is switched on and that your configuration does not hide it. For solutions sold under your own brand the line can be blurred, so it is sensible to assume the duty is yours and to record the split of roles in the contract.
A chatbot on your website: how to meet the disclosure duty
The Commission guidelines list chatbots in customer service, complaint handling and online retail among the systems covered by Article 50(1). They also state that chatbots embedded in online platforms and help centres, whose replies users may take for human ones, do not benefit from the exception for obvious cases.
The information must be clear, distinguishable and given at the latest during the first interaction. It should also meet accessibility requirements. In practice:
The chatbot opens the conversation with a simple sentence, for example: “I am an AI assistant. You can ask to speak to a person at any time.”
The label sits close to the chat field, not in the page footer.
A voice assistant says so at the start of the call.
An email generated and sent by an AI agent carries a label at the top of the message.
The Commission also points out what is not enough. Information given only in the terms and conditions, behind a link or in documentation does not meet the duty, and neither do machine readable marks alone. A human name or photo next to a chatbot makes it harder to recognise that the other party is AI, so a clear notice matters even more.
An AI agent acting on behalf of the company
An AI agent is a system that does not just reply but also carries out actions, such as booking appointments, handling correspondence or placing orders. The guidelines state that an agent should disclose both its artificial nature and the person on whose behalf it acts. This also applies when the other party is someone representing another company, so a B2B relationship does not remove the duty.
If it cannot be determined in advance whether the agent will encounter a person, it should be designed to disclose itself whenever such a conversation is reasonably likely. For companies this means a simple design rule: the footer or first sentence of every message from the agent says that AI is writing and whom it represents.
When you do not have to inform people
The exception covers situations where the use of AI is obvious to a person who is reasonably well informed, observant and circumspect. The Commission reads it narrowly. The fact that people generally know chatbots exist is not enough. Outside the duty or within the exception are, among others:
Tools supporting an employee, where a person talks to the customer and AI only suggests the content. The mere possibility of a person reviewing a reply must not be used to get around the rule, however.
An internal assistant for suitably trained staff who know they are using AI.
Programming assistants available only to professional developers.
Systems running in the background with no direct interaction with people, such as document classification.
Images, videos and texts generated by AI
This is where most misunderstandings arise. The 2 December 2026 deadline concerns only Article 50(2), the duty of generator providers to ensure that outputs are marked in a machine readable way. It does not postpone either the chatbot disclosure duty or the obligations of deployers.
A company using a generator is mainly concerned with Article 50(4). It must disclose that an image, audio or video has been artificially generated if it is a deep fake, meaning it resembles existing people, objects, places or events and could falsely appear authentic. A similar duty covers texts published to inform the public on matters of public interest, unless they have undergone human review or editorial control and someone holds responsibility for the publication. An ordinary product description or sales email generally falls outside this category. Content generated before 2 August 2026 does not have to be labelled retroactively.
AI literacy: what Article 4 really requires
Following the Digital Omnibus changes, companies must take measures to support the AI literacy of their staff and other people operating AI on their behalf, taking into account knowledge, experience and context of use. The provision states explicitly that no specific level of literacy has to be guaranteed for any individual.
This provision of the AI Act also does not require appointing an AI officer, keeping a register of tools or adopting an AI policy. It is still worth having a list of the systems in use and short rules for using them, because without these it is hard to answer basic questions about roles and risk.
Where AI in a company means high risk or a ban
Most chatbots and automations are not high risk systems. Attention is needed in areas related to work and access to services:
Managing employees: decisions on promotion or dismissal, allocating tasks based on behaviour or personal traits, monitoring and evaluating performance.
Assessing the creditworthiness of natural persons, except for detecting financial fraud.
The full requirements for these systems will apply from 2 December 2027. An employer using such a system will have to inform workers and their representatives in advance, and people affected by decisions will have to know the system is being used. If you are planning an HR tool with AI, it is worth building these requirements into the project now.
Detecting employees' emotions is a different matter. Article 5 prohibits AI systems that infer emotions in the workplace and in education, except for medical or safety reasons. The ban has applied since 2 February 2025. If a call centre tool vendor promises analysis of agents' moods, it needs careful checking.
Fines and supervision in Poland
The Polish Act of 3 July 2026 on artificial intelligence systems (Journal of Laws 2026, item 1003) established the Commission for the Development and Security of Artificial Intelligence, known as KRiBSI. It can carry out inspections and proceedings and impose fines, and complaints may be lodged with it by an individual, a company or another organisation.
Breach of Article 50: up to EUR 15 million or up to 3% of total worldwide annual turnover.
Prohibited practices under Article 5: up to EUR 35 million or up to 7% of turnover.
Large companies face the higher of these values, SMEs the lower.
These are upper limits. The authority considers, among other things, the seriousness of the breach, its duration and the company's economic situation.
For example, for an SME with turnover of PLN 20 million the upper limit for a breach of Article 50 is 3% of turnover, or PLN 600,000. The Polish act also provides for a warning that sets out remedial action, and the company then has 21 days to report on what has been done.
The individual opinion is a useful tool. An application costs PLN 150 and KRiBSI has 30 days to respond, or 60 days in particularly complex cases. No response within the deadline means the position presented by the company is accepted, and following an opinion before it is changed or revoked cannot harm the company.
What to do in your company: 6 steps
List all AI systems: chatbots, agents, content generators, AI features in CRM and HR tools.
For each one determine the company's role, provider or deployer, and record the split of obligations in contracts with contractors.
Add an AI notice at the start of conversations, in agent emails and in voice calls.
Check that no tool infers employees' emotions, and flag recruitment and HR uses as requiring separate analysis.
Train the people using AI and keep confirmation of the training and short rules for using the tools.
Review data processing agreements and GDPR compliance, because the AI Act does not replace those obligations.
Frequently asked questions
Does the AI Act apply to a small company?
Yes. There is no general exemption for SMEs. Small companies do, however, have a lower upper limit on fines and should be treated proportionately.
Do I have to say that a person checks the chatbot's replies?
If the customer talks directly to the system, you must disclose AI even if a person can review the reply. If an employee conducts the conversation and AI only suggests content, Article 50(1) generally does not apply.
Is a clause in the terms and conditions enough?
No. The terms can supplement it, but the information must appear in the interaction itself, at the latest when it begins.
Does the 2 December 2026 deadline apply to my chatbot?
No. It covers only technical marking of content by providers of generators operating before 2 August 2026. The chatbot disclosure duty has applied since 2 August 2026.
Do I have to appoint an AI officer?
The AI Act imposes no such duty on a company using typical chatbots. Someone should still be responsible for the list of systems and the rules for using them, even as an additional task.
This article is for information only and does not replace legal advice. It is based on Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, European Commission guidelines C(2026) 7702 and the Polish Act of 3 July 2026 on artificial intelligence systems.
