Do AI Chatbots Fall Under the EU AI Act? (Usually — as Limited Risk)

From 2 August 2026, a system intended to interact directly with people must be designed so users know they are talking to an AI, unless that is obvious from context. If your chatbot also generates synthetic audio, image or video content, that content must be marked machine-readably as AI-generated; deepfakes must be visibly labelled.

That is the core of it: a clear disclosure at the start of the conversation, a marking pipeline for generated media, and records showing you did both. No CE marking, no Annex IV documentation, and no notified-body route unless a separate high-risk conformity route requires it.

The tier follows the use case, not the interface. A chatbot that screens job candidates, assesses creditworthiness, decides eligibility for benefits or triages access to essential services is operating in an Annex III area — the conversational UI does not change that. The same model deployed as an internal FAQ bot and as a candidate-screening bot lands in two different tiers.

The practical test: does the chatbot’s output influence a decision listed in Annex III about a specific person? If yes, treat it as high-risk and plan for the full obligation stack.

Article 5 has applied since February 2025 and catches a few chatbot patterns: purposefully manipulative or deceptive techniques that materially distort behaviour and cause significant harm, exploitation of vulnerabilities of specific groups, and emotion recognition in workplaces or education settings (outside medical and safety uses).

A companion or engagement-optimised bot should be reviewed against Article 5(1)(a)–(b) specifically — dark-pattern conversation design aimed at vulnerable users is exactly what those clauses target.

Good implementations are boring: a persistent label (“AI assistant”) in the chat header, a first-message disclosure, and an escalation path to a human where the context calls for it. Disclosure buried in terms of service does not meet the “clear and distinguishable at the latest at first interaction” standard.

For voice bots, disclose at the start of the call. For embedded assistants inside a product, context can make AI-ness obvious — but when in doubt, label. The cost of over-disclosure is zero; the fine tier for Article 50 violations reaches €15M or 3% of global turnover.

GPAI obligations (Article 53) bind the companies that train and offer the models. Building a chatbot on an API makes you a downstream provider of an AI system — your duties are the Article 50 transparency ones plus whatever your use case triggers, not training-data summaries or model evaluations.