the eu ai act and your website: what article 50 actually requires

business · 2026-10-27 · 7 min

the eu ai act is not a law about robots. it is a law about products and services that use machine learning, and a normal business website can fall inside it without anyone calling it an "ai product". i build websites in parma, italia, and the question i keep hearing is the practical one: does this change anything for my site?

the short answer: sometimes, less than the headlines suggest, and more than most small businesses have prepared for.

what the act actually covers, in the order it applies

the ai act is a regulation, not a directive, so it applies directly in every member state. it arrives in stages:

• prohibited practices have applied since february 2025. social scoring, manipulative techniques, untargeted facial scraping, emotion recognition in workplaces and schools. if your site does one of these, the problem is not a notice.
• general-purpose ai models have had duties since august 2025. that is the model vendor's layer, not yours, unless you fine-tune and ship one under your own name.
• transparency duties, article 50, apply from 2 august 2026. this is the layer a normal website meets.
• high-risk systems apply from august 2026 for most annex iii uses, and august 2027 for products already regulated. a restaurant site is not high-risk. a system that decides who gets credit or a job is.

so the useful question for a business site is almost never "am i high-risk". it is "does my site interact with people through an ai system, or publish synthetic content, in a way article 50 cares about".

what on a normal site actually counts

a chatbot that talks to visitors. yes. article 50 requires that a person is informed they are interacting with an ai system, unless it is obvious from the circumstances. a line above the input, in the language of the site, is enough. a chatbot that pretends to be "giulia from the team" is exactly the case the rule exists for.

ai-generated recommendations. a "you may also like" widget is usually not the direct interaction article 50 is about, but if it profiles people it is a gdpr question first. the act does not replace the privacy rules; it sits on top of them.

synthetic images and text published on the site. article 50 asks for disclosure when synthetic content is published to inform the public on matters of public interest, and for deepfakes in general. a generated header illustration is not a deepfake. a generated photo of a real shop presented as the real shop is a trust problem before it is a legal one, and the fix is the same: say what it is.

a contact form, a cookie banner, an analytics counter. no. these are not ai systems under the act, and treating every script as one produces a notice nobody reads.

an ai writing assistant used internally. not deployed to visitors, so article 50 is not the issue. the output is yours, with your name on it, and that is the standard that matters.

the provider question nobody asks

if you embed a third-party chatbot under your own name and brand, article 25 can make you a provider of that system rather than a deployer. that moves duties from "tell people" to the full provider set: documentation, risk management, technical file. in practice, most small sites stay deployers because the vendor's name stays on the product and the contract says so. read that clause before you sign, not after.

gdpr is still the load-bearing wall

the act adds transparency, not a legal basis. a chatbot still needs a privacy notice, a lawful basis, a retention period, and a data processing agreement with the vendor. if the vendor sends conversations outside the eu, you need a transfer mechanism. if the conversation can contain health data, you are in special-category territory and a generic chatbot is the wrong tool.

the part i see skipped most often is deletion. a chat transcript is personal data. if nobody can delete it on request, the notice is fiction.

what i would do before shipping

1. inventory. list every ai feature on the site, the vendor, what data it receives, and where that data goes. one page, not a policy.
2. decide. keep the features that do a job, remove the ones that exist because a deck said "ai". every feature is a claim with obligations attached.
3. notice at the point of use. one sentence where the interaction happens, plus a section in the privacy policy. short beats complete-but-unread.
4. contract. dpa, subprocessors, retention, training-on-your-data clause. if the vendor cannot answer, that is the answer.
5. label synthetic content where a reasonable person could mistake it for a record of something real.
6. human review for anything that looks like advice: legal, medical, financial, safety.
7. keep a record. date, vendor, model, purpose, who approved it. it takes ten minutes and it is the difference between a decision and a drift.

what i would not do

i would not put "ai-powered" on a homepage unless the feature is worth the obligations. i would not paste a twelve-page policy and call it transparency. i would not treat the vendor's compliance page as my notice. and i would not let a chatbot answer questions that a professional should answer, because the model is confident in exactly the places where confidence is expensive.

the act is not the reason to be careful. it is the reason the careful version is now written down.

for the technical side of what a site actually sends, see what this site actually sends. for the service side in parma, see realizzazione siti web a parma and ux designer a parma.

faq

does a chatbot on my website need a notice?

yes. from 2 august 2026, article 50 requires that people are told they are interacting with an ai system, unless it is obvious. one line above the input, in the site's language, is enough. the notice has to be there before the conversation starts, not in a footer.

does the ai act apply to a small business with a normal website?

only when the site uses an ai system in a covered role. a brochure site with a contact form is outside it. a site with a customer-facing chatbot, automated recommendations that profile people, or synthetic content presented as real may not be. the size of the business changes the paperwork, not the principle.

what happens if i ignore it?

there are fines, and they are large on paper. the practical risk arrives first: a claim you cannot support, a vendor with no data processing agreement, a conversation you cannot delete, a generated image a customer recognises as fake. those cost trust before they cost money.

is a cookie banner enough?

no. consent for cookies and transparency about an ai interaction are different obligations. a banner answers "may i track you". it does not answer "am i talking to a machine, and what happens to this conversation".