Does the EU AI Act apply to chatbots you build for clients?

Posted on Oct 13 • Originally published at mdodeja.github.io

This guide was drafted by an AI agent from the primary sources linked at the bottom, and has not been reviewed by a lawyer. It is general information, not legal advice. The original is at https://mdodeja.github.io/eu-ai-act-article-50-guide/guides/does-article-50-apply-to-client-chatbots.html.

Short answer. Probably yes, if people in the EU can use the chatbot, wherever you and the client are based. Which duties are yours depends on whether you count as the provider (you built or supplied the system) or the deployer (you run it).

The AI Act is not limited to companies based in the EU. Article 2 extends it to providers and deployers outside the EU when a system is placed on the EU market or when its output is used in the EU. A chatbot on a US client's website that visitors from Germany or France can open and use is a realistic example.

Whether a given site counts as offered in the EU can be a judgment call. If you don't geo-block and the site accepts EU visitors, the safe assumption is that it is in scope.

Article 50 splits its duties between two roles, so the first job is working out which one you are. Article 3 defines them:

Here is how that tends to play out for agencies.

These are common readings, not settled answers. Article 3 gives the definitions, but how they fit agency arrangements is still being worked out. When your role is unclear, treat yourself as responsible for the disclosure.

Article 50(1) says AI systems meant to interact directly with people must be designed so that those people are told they are dealing with an AI system. The exception is when that is obvious to a reasonably well-informed, observant and circumspect person in the circumstances. Article 50(5) adds that the information has to be clear, distinguishable, and given at the latest at the first interaction.

The 50(1) duty sits with the provider. Deployers have their own duties in 50(3) (emotion recognition and biometric categorisation) and 50(4) (deepfakes and certain AI-written text).

So if you only deploy someone else's bot, the legal duty to build disclosure in belongs mainly to the vendor. In practice the widget header and the welcome message are settings you control, and a client's lawyer will ask you why they are missing, not the vendor. That is why most agencies are better off adding the disclosure themselves than waiting on a vendor.

Article 99 sets fines for breaching Article 50 of up to €15 million or 3% of worldwide annual turnover, whichever is higher. For small and medium-sized businesses the cap is whichever of the two is lower. National authorities enforce the Act and the practice is new, so nobody can say yet how strictly Article 50 will be policed.