Chatbots and AI Act: How to choose a compliant chatbot before August 2, 2026

The chatbot on your site has stopped being a gadget: from August 2, 2026 It is an artificial intelligence system with specific legal obligations. From that date, the following apply: Transparency obligations under Section 50 of the AI Act, and those who do not respect them risk fines of up to 15 million euros or 3% of the annual global turnover.

The good news is that, for a chatbot, compliance isn't a mountain: it's a series of well-made technical choices. The bad news is that many of those choices are made by the supplier, not you—and if the supplier made them poorly, you're still the one with the problem.

Let's see what really changes, how to recognize a AI Act and GDPR compliant chatbot and why we developed Bot Marley, our chatbot for WordPress, starting exactly from these premises.

What changes from August 2, 2026

L'AI Act (EU Regulation 2024/1689) classifies artificial intelligence systems by risk level. A chatbot that responds to your site visitors almost always falls into the risk category. limited risk: it is not prohibited, it is not high risk, but it is subject to transparency obligations.

In concrete terms, the’Article 50 It requires three things:

1. Declare that it is an AI. The user must know, clearly and understandably, that he or she is speaking to an artificial system and not a person. This information must be provided. at the latest at the first interaction.
2. Labeling AI-generated or AI-manipulated content, when the system produces them.
3. Don't hide AI behind a deceptive interface: no names or avatars designed to make people believe there's a human operator on the other end.

The sanctions provided for by art. 99, par. 4 become operational from the same date: up to 15 million euros or 3% of annual global turnover, whichever is higher. National market surveillance authorities and the European AI Office will supervise. In Italy, the Law 132/2025, which aligns national legislation with European regulations.

A chatbot that doesn't say it's a chatbot is an illegal chatbot, starting August 2, 2026.

If you want the complete picture of the deadlines, we have reconstructed it in the guide on AI Act obligations for companies.

Beyond the AI Act: The GDPR and Hallucinations Issues

The AI Act is the latest addition, but it doesn't erase anything that came before. A chatbot on the website processes personal data — questions, emails, order numbers, sometimes information that the user writes on his own initiative — and therefore falls squarely within the GDPR.

• Where do conversations end? If the provider stores them on its servers, that provider is a data controller and you need a DPA solid. If the servers are outside the EU, a legal basis for the transfer is also required.
• Who reads that data? Some platforms use customer conversations to train your models. It's a clause in the terms of service, not in the brochure.
• What do you declare in the information? The user needs to know what data you collect with the bot, how long you keep it, and who you share it with.

Then there is a risk that no regulation can solve for you: the hallucinations. A generic chatbot built on a linguistic model can invent a return policy, a price, a contractual term. It's not a technical detail: what your chatbot says, you say. Incorrect information given to a customer is your responsibility, not the model's.

The chatbot isn't an external vendor speaking for you: it's your company speaking.

5 Questions to Ask Someone Selling You a Chatbot

Before signing, ask the supplier for written answers to these five questions. They're the same ones we asked ourselves before writing a single line of code.

1. Where are conversations and the knowledge base saved? On your servers or mine?
2. Are my conversations used to train models? If so, can I disable it?
3. Where do the answers come from? Just from my content or also from general knowledge of the model?
4. Does the bot claim to be AI on first interaction? Is it configurable or is it hidden?
5. Which AI model do you use and can I choose another one? With which contract and which DPA?

If the supplier hesitates on just one of these, the regulatory risk it moves silently on your shoulders.

Why SaaS Chatbots Are Giving You a Hard Time

The most popular chatbots are black boxes on subscriptionThey rent you conversations and store your data. They work, often well, but the architecture itself creates three compliance issues.

The first is the data chainYour content and your customers' chats end up on the provider's servers, which in turn passes them on to its AI provider. Two steps, two contracts, two points of risk you don't control.

The second is the lack of choice on the modelYou're locked into the engine chosen by the vendor, along with its DPA and data policies. If the terms change tomorrow, your only option is to switch vendors.

The third is the drift of responsesMany generalist bots also draw on model knowledge, not just your content. This is the quickest way to get a bot to promise you a discount that doesn't exist. Added to this is the variable costPaying per conversation means that the bot's success becomes a budget issue.

Bot Marley: the chatbot we built like this

Bot Marley it's the plugin chatbot for WordPress We developed it at BigFive starting from the problem, not the technology: how to build a useful assistant without giving away anyone's data and without inventing answers. The technical choices are all a consequence of those questions.

• Answers only from your content. Indexes pages, articles, custom post types, products and PDFs, builds a local knowledge base and responds citing sources. If information isn't on the site, the bot tells you so instead of making it up.
• Data at your home. Knowledge base and conversation history remain in your WordPress database. The only external call is to the AI provider you choose.
• You choose the model. ChatGPT, Claude or Gemini via le WordPress AI Services API: You use your account, your contract, and your DPA. The plugin does not store any API keys.
• Configurable transparency. Welcome message, tone of voice, rules of conduct and privacy consent Integrated into the contact form: everything you need to declare your AI at the first interaction, as required by Article 50.
• Fixed cost. Annual license and unlimited conversations: You only pay your AI provider.
• Multilingual and WooCommerce. It responds in the visitor's language (15 languages, WPML compatible) and, in stores, it recognizes the cart, tracks orders and offers the products you choose.

Bot Marley and other chatbots, in short

	Other chatbots	Bot Marley
Data and conversations	On the provider's servers	In your WordPress database
AI Provider	Bound to their model	ChatGPT, Gemini or Claude, your choice
DPA	Theirs, on your data	Yours, with the provider you choose
Answers	They can hallucinate and wander	Only from your content, with citation of sources
Price	By conversation or by credit	Annual license, unlimited conversations
Integration	Generic external script	Native WordPress plugin, WooCommerce-aware

Features, pricing and documentation are in the Bot Marley's page. If you want to understand first how to insert AI into your processes, let's talk about it in our artificial intelligence consulting for companies.

The 8-Point Compliance Checklist

Before you release your chatbot online after August 2, 2026, make sure you can answer yes to all of these items:

1. The bot claims to be an AI from the first message.
2. Name and avatar they do not simulate a human operator.
3. The privacy policy explicitly mentions the chatbot and the data it collects.
4. The consent The processing is collected before sending the contact data.
5. You know where they are kept knowledge base and conversations.
6. You have a DPA with whoever processes that data, including AI providers.
7. The answers are anchored to your content and verifiable.
8. There is a exit path to a human when the bot doesn't know how to respond.

If even one box remains empty, you still have a few weeks to fix it.

Conclusion

The AI Act isn't asking companies to give up chatbots: it's asking them to use them. in a fair manner. Saying it's an AI, knowing where the data ends up, and responding with real information. These are exactly the three things that make a chatbot even more effective, not only more compliant: an assistant that cites your pages converts more than one that improvises.

We wrote Bot Marley from there, and conformity became a consequence of the architecture, not a patch tacked on at the end.

Compliance isn't added to a chatbot: it's designed with it.

The information contained in this article is for informational and educational purposes only. It does not constitute legal advice and does not replace the advice of a professional. The law is constantly evolving, and its application may vary depending on the specific case. Before making any decisions, always check the latest official sources and, for your specific situation, consult a lawyer or qualified advisor. BigFive assumes no responsibility for decisions based on this information.