Guide · 8 min read · June 2026

The EU AI Act and Your Website: What You Need to Do Before August 2026

The EU AI Act's transparency obligations apply from 2 August 2026. If your website has an AI chatbot, publishes AI-generated content, or sends customer data to AI tools, this affects you — even if you've never thought of your business as an "AI company."

Most of the coverage of the AI Act focuses on high-risk systems: biometrics, credit scoring, recruitment algorithms. That's the dramatic end of the law, and it's why so many ordinary businesses have tuned the whole thing out. But the Act has a second, much broader layer — the transparency rules in Article 50 — and that layer applies to everyday websites.

This guide covers what actually applies to a normal business website, what you need to publish, and how to check where you stand.

Does the EU AI Act apply to my website?

Ask yourself three questions:

1. Does your site have an AI chatbot? Intercom's AI agent, Tidio, Drift, a custom ChatGPT integration — anything where a visitor talks to software rather than a person.
2. Do you publish AI-generated content? Blog posts, product descriptions, images or audio created or substantially drafted by AI tools.
3. Do you have users in the EU? The Act applies based on where your users are, not where your business is registered. A UK or US business serving EU visitors is in scope.

If you answered yes to question 3 and yes to either of the first two, the transparency obligations apply to you from 2 August 2026.

What Article 50 actually requires

Article 50 is the AI Act's transparency provision. Stripped of the legal language, it requires three things from ordinary websites:

1. Tell people when they're talking to an AI

If a visitor interacts with an AI system — a chatbot is the obvious case — they must be informed they're interacting with AI, unless it's already obvious from context. In practice: a clear notice at the start of the chat session. "You're chatting with our AI assistant" does the job. A line buried in your privacy policy does not.

2. Label AI-generated content that could be mistaken for human-made

Text published "with the purpose of informing the public on matters of public interest," synthetic images, audio and video need disclosure that they were artificially generated. For most businesses, the practical reading is: if a reasonable visitor would assume a human made it and being wrong would matter, label it.

3. Disclose deepfakes and synthetic media clearly

Less relevant to most business sites, but if you use AI-generated imagery of real-looking people or places, it needs marking as artificially generated.

What happens if you ignore it

Non-compliance with the transparency obligations can attract fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher. Realistically, regulators will not be raiding small business websites on 3 August. But two things are worth taking seriously:

First, enforcement tends to start with complaints — a competitor, a disgruntled customer, a privacy activist. The businesses that get caught early are rarely the worst offenders; they're the ones someone reported.

Second, the AI Act doesn't exist in isolation. If your chatbot processes personal data (names, emails, support queries — it almost certainly does), GDPR transparency obligations under Articles 13 and 14 already apply today. An undisclosed AI tool processing customer data is a GDPR gap in 2026 regardless of the AI Act timeline.

What about UK businesses?

The UK is not covered by the EU AI Act — it's developing its own approach to AI regulation separately. But this is not an exemption for most UK businesses, for two reasons:

• Extraterritorial scope. If your website serves EU visitors, the Act's transparency rules apply to those interactions regardless of where you're based.
• UK GDPR already expects similar transparency. The ICO's guidance on AI and data protection makes clear that processing personal data through AI tools must be disclosed, with a lawful basis, in your privacy information. The destination is the same even if the road is different.

The practical upshot: build to the EU AI Act standard and you cover both regimes.

Your pre-August checklist

Work through these before 2 August 2026:

1. Audit your AI use. List every AI touchpoint: chatbot, AI-drafted content, AI tools that receive customer data (including staff pasting support emails into ChatGPT).
2. Add a chatbot notice. A one-line disclosure at the start of every AI chat session.
3. Publish an AI disclosure. A short page or section stating what AI tools you use, what they do, what data they process, and that users can request human review.
4. Update your privacy policy. Name the AI processors, state the lawful basis, and cover the international transfer (most AI providers are US-based, which engages the SCCs/UK IDTA requirements).
5. Decide your content labelling approach. If you publish AI-generated or AI-assisted content, settle on a consistent disclosure format now.

Frequently asked questions

We only use ChatGPT internally for drafting — does this apply?

The Article 50 chatbot rule doesn't, but GDPR does: if customer personal data goes into the tool, that's a processing activity that belongs in your privacy policy with a lawful basis.

Our chatbot is clearly labelled "Bot" — is that enough?

Probably, if it's genuinely obvious to a reasonable user. A clear statement at session start removes the doubt and costs you nothing.

Does an AI disclosure need to be a separate page?

No. It can be a section of your privacy policy or a standalone notice. Standalone is clearer and easier to link from a chatbot widget.

We're a UK business with almost no EU traffic — can we skip this?

"Almost no" EU traffic is still EU traffic, and the UK GDPR transparency expectations get you to substantially the same place anyway. The cost of compliance here is an afternoon; the cost of being the example is not.

Find out where you stand in 30 seconds

Flagged scans your website, detects AI tools your visitors interact with, reads your existing policies, and tells you exactly which transparency obligations you're missing — mapped to the specific article. Scanning is free with no account needed; the tailored AI Disclosure document is included in the £29 Compliance Fix and the Starter & Pro plans.

Scan your website free →

This guide is general information, not legal advice. For complex situations, seek advice from a qualified professional. Last updated: June 2026.