The AI Act from 2 August 2026 — what your chatbot must comply with

On 2 August 2026 the transparency rules of the European AI Act (Article 50) take effect across the EU. Translated from legalese: every chatbot and voice bot that talks to your customers must disclose it is AI — and you, as its operator, carry the responsibility. There is no small-business exemption. Here is a checklist you can get through in an evening.

Honest disclaimer: we are not a law firm and this is not legal advice — it is a practical summary for owners of salons, garages and small firms, compiled from public sources as of July 2026.

Who this concerns

Do you run a bot on your website, Instagram or phone line that answers customers using AI? Then this concerns you — whether you have three employees or three hundred. It does not concern plain auto-replies without AI ("Thanks for your message, we'll get back to you") or internal tools that never talk to customers.

The checklist: 6 points to verify

1. The bot introduces itself as AI. At first contact it must be clear the customer is talking to a machine — not after three messages, not in a hidden footer. A line like "I'm the salon's AI assistant…" in the welcome message is enough.
2. AI content is labelled. Synthetic content generated by AI must be machine-readably marked. For a bot's text replies point 1 handles this in practice; for generated images and voice, ask your vendor how they handle labelling.
3. You know who answers for the replies. The bot speaks in your name — if it promises a slot or a price, that is your commitment. Your vendor contract should state clearly who bears responsibility and how human oversight works. (With us: the owner approves every message — nothing goes out on its own.)
4. GDPR is covered by contract. The bot processes customers' personal data → you need a data processing agreement (DPA) with the vendor and certainty about where the data lives. Data fines are arriving already — the Italian regulator fined a chatbot operator €5 million.
5. You have documentation from the vendor. A simple document is enough: what the bot does, on what data, how it introduces itself, how errors are handled. A serious vendor provides it on request — if they don't have one, that is a warning sign.
6. You are not in the "high-risk" bucket. A booking and customer-service bot is "limited risk" — mild obligations. High-risk systems (hiring, credit scoring, biometrics) have an entirely different, expensive regime. If your bot only does customer communication, this point costs you nothing.

Good news (three pieces)

• For ordinary bots compliance is cheap. Industry estimates for operators of limited-risk systems often come in under CZK 50,000 a year — and with done-for-you solutions compliance is simply included in the price of the service.
• The recent "digital omnibus" postponed the expensive obligations for high-risk systems to December 2027 — but note: Article 50 (transparency) is NOT postponed and applies from 2 August 2026.
• Compliance can be turned into a sales advantage. Customers and authorities will start distinguishing between "some bot from a builder" and "a system that has followed the rules from day one". If your house is in order, you get to say so.

How we handle it for our clients

Opora agents have introduced themselves as AI from day one, the owner approves every outgoing message in Telegram, data is processed under GDPR in the EU on the basis of a contract (DPA), and documentation comes with the agreement. In other words: AI Act compliance is included in the price, not an add-on.

Running a bot from a builder and not sure where it stands? Write to us — we will run it through the checklist above and tell you straight what is missing and what to do about it. Usually it is a matter of fixing the welcome message, contracts and documentation, not a rebuild.