Guide · 6 min read · 5 June 2026
Does my website need an AI disclosure? (UK & EU guide 2026)
What is an AI disclosure?
An AI disclosure is a statement on your website that tells users when and how you use artificial intelligence tools — particularly when those tools process personal data or interact directly with users.
Unlike a privacy policy, which covers all data processing, an AI disclosure focuses specifically on automated systems: chatbots, AI-generated content, personalisation engines, automated decision-making, and similar tools.
Who needs one?
You likely need an AI disclosure if your website does any of the following:
- Uses an AI chatbot for customer support (Intercom AI, Drift, Tidio, Zendesk, or custom ChatGPT integrations)
- Generates content using AI tools (blog posts, product descriptions, email responses)
- Sends customer data to AI platforms (pasting customer emails into ChatGPT, using AI for support ticket responses)
- Uses AI-powered personalisation or product recommendations
- Makes or assists automated decisions about customers
If any of these apply and you have users in the UK or EU, you need to disclose it.
What does the EU AI Act say?
The EU AI Act came into force in August 2024 with obligations applying in phases through 2025 and 2026. For most website owners the most relevant obligation is Article 50 — transparency requirements.
Article 50 requires that:
- Users must be informed when they are interacting with an AI system (e.g. a chatbot) rather than a human
- AI-generated content that could be mistaken for human-created content should be disclosed
- Providers of AI systems must ensure users can make informed decisions about their interactions
For small businesses and website owners, this primarily means: if you have an AI chatbot, users must be told it is an AI before or at the start of the interaction.
What does UK GDPR say?
UK GDPR (which applies to UK businesses post-Brexit, separate from EU GDPR) requires transparency about automated processing under Articles 13 and 14. If you use AI tools that process personal data — including names, email addresses, support queries, or browsing behaviour — you must:
- Disclose this processing in your privacy policy
- State the lawful basis for the processing
- Explain what data is sent to AI tools and why
- Disclose any international transfers (most AI providers are US-based)
The ICO has published specific guidance on AI and data protection. Businesses that cannot demonstrate transparency about AI use are increasingly likely to face scrutiny.
What should an AI disclosure say?
A good AI disclosure covers:
- What AI tools you use (name them — ChatGPT, Claude, Intercom AI etc.)
- What those tools are used for (customer support, content drafting, personalisation)
- What data those tools process (names, emails, message content)
- Whether AI outputs are reviewed by humans before acting on them
- Whether AI is used to make decisions that affect users
- How users can request human review of AI-assisted interactions
UK vs EU — what's the difference?
Both regimes require transparency but through slightly different mechanisms:
UK: primarily through GDPR transparency obligations (privacy policy + just-in-time notices). The ICO is the enforcement body. The UK is developing its own AI regulation framework separately from the EU AI Act.
EU: the EU AI Act adds specific obligations on top of GDPR, particularly around chatbot disclosure and AI-generated content labelling. The relevant supervisory authority depends on where your business or users are based.
If you have users in both regions (most UK websites do), you should comply with both — in practice the EU AI Act is the higher bar so meeting it covers both.
Get your free AI disclosure
Flagged generates a free AI disclosure document for your website — no account needed. Scan your site, answer a few questions about how you use AI, and get a ready-to-publish disclosure in under a minute.