EU AI Act: what SMEs using chatbots and AI-generated content need to do

Since 2 August 2026 the EU AI Act's transparency rules apply. What changes in practice if you use a website chatbot, a WhatsApp assistant or AI-generated content.

Many businesses already use artificial intelligence without calling it that: the chatbot on the website, the assistant that answers on WhatsApp, images generated for social media, copy written with a language model. Since 2 August 2026, some of these activities have clear rules in the EU: the transparency obligations in Article 50 of the European AI Act.

This is a practical guide to working out where your business stands. It is not legal advice: for specific cases, you need a qualified professional.

The picture in two lines

The AI Act sorts AI systems by risk. Most of the ways a small or medium-sized business uses AI for marketing and customer service are not high-risk. They do fall under the transparency obligations: people must know when they are talking to a machine, and when content has been artificially generated or manipulated.

In July 2026 the EU adopted the so-called Digital Omnibus on AI (Regulation (EU) 2026/1744). It pushed the deadlines for high-risk systems back to 2 December 2027 and 2 August 2028. The transparency obligations stayed at 2 August 2026. The only extra time goes to providers of generative AI systems already on the market before that date: they have until 2 December 2026 to add technical marking to the content their systems produce.

What actually applies to an SME

1. Chatbots and assistants that talk to customers

AI systems that interact directly with people must be designed so that people know they are dealing with an AI, unless that is already obvious to a reasonably well-informed person. In practice: the chatbot on your website or the assistant on WhatsApp must introduce itself as one. A single line at the start of the conversation, clear and plain, settles it. It also builds trust.

2. Generated or manipulated images, video and audio

If you publish deepfakes, meaning content that shows real people, places or events in an artificial but believable way, you must say so. For work that is evidently artistic, creative, satirical or fictional the duty is lighter, but it does not disappear. For an SME the typical case is a "realistic" photo of a place or a person that does not exist: better to label it.

3. Generated text that informs the public

If you publish AI-generated text to inform the public on matters of public interest, you must disclose it, unless the text has been through human review or editorial control and someone takes editorial responsibility for it. An article written with help from AI but reviewed and signed by someone in your company is in a different position from text published automatically without anyone reading it.

4. Basic training for your people

Article 4, as amended by the Digital Omnibus, asks anyone using AI systems to take measures to support AI literacy among their staff. The obligation stays, but it has become more practical: you need real training measures, and the rule makes clear that you do not have to guarantee a specific level of competence.

A five-point checklist

Take stock. List where the business uses AI: website, WhatsApp, email, social media, internal documents.
Add a notice to every automated conversation. Chatbots and assistants introduce themselves as AI and always offer a way to reach a person.
Label realistic synthetic content. Above all, images and videos of people or places that look real.
Keep a person responsible for content. Whoever publishes generated text reviews it and puts their name to it.
Train the people who use the tools. One good hour on what AI can and cannot do, and on what must never go into it (sensitive data, customer data), is worth more than a document nobody reads.

Why it pays, beyond the legal duty

Transparency is not just about avoiding fines. A customer who finds out afterwards that they were talking to a machine feels fooled. A customer who knows from the start, still gets a useful answer within seconds and can switch to a person, trusts you more. It is the same principle we build AI systems on: a person stays in the loop, and every action is logged.

In short

Since 2 August 2026 the AI Act's transparency obligations apply. The Digital Omnibus did not postpone them.
Chatbots and assistants must disclose that they are AI.
Realistic synthetic content must be labelled.
Generated text needs a person who reviews it and takes responsibility for it.
Staff who use AI need practical training measures.

If you already use a chatbot, or want to build an AI system that follows these rules from day one, write to us.

This article is for information only and is up to date as of October 2026. It does not replace legal advice: to assess your company's specific case, speak to a qualified professional.