Do you have a chatbot on your website, create text or images with AI, or use AI when screening job applicants? Then the EU AI Act applies to you. Its transparency rules have applied since 2 August 2026, and they affect almost every business that uses AI in front of customers.
At the same time, part of the law was postponed in July 2026, so plenty of half-truths are going around. Below I set out what applies now, what comes later and what you actually need to arrange. This is a practical explanation, not legal advice. If you are unsure about your own situation, check with a lawyer.
What is the EU AI Act and what applies when?
The AI Act is an EU law that classifies AI systems by risk. The higher the risk to people, the stricter the rules. It comes into force in stages. In July 2026, the Digital Omnibus package (Regulation (EU) 2026/1744) moved some of those stages.
For a typical small or medium-sized business, these are the dates that matter:
- 2 February 2025: prohibited AI practices and the duty to work on AI literacy.
- 2 August 2026: the transparency rules in Article 50, covering chatbots, deepfakes and AI-generated text, among others.
- 2 December 2026: deadline for makers of generative AI tools already on the market before 2 August 2026 to mark AI content in a machine-readable way.
- 2 December 2027: rules for high-risk AI, such as AI in recruitment and selection. This was originally 2 August 2026.
- 2 August 2028: high-risk AI in products already covered by EU product rules.
AI Act and your chatbot: required since 2 August 2026
Article 50 of the AI Act says: people who talk to an AI system must know it is AI. That has to be clear at the latest at the first interaction, in a clear and visible way. The only exception is when it is obvious to a reasonably observant person that they are dealing with AI. I would not bet on that for a customer service chat.
Formally, this duty lies with the provider: the party that develops the chatbot and places it on the market under its own name. If you use an off-the-shelf chatbot service, the vendor is responsible and you are the user (the AI Act calls this a deployer). If you have a custom chatbot built and run it on your site under your own name, you may count as the provider yourself. Either way, your name is on it, so check it yourself.
In practice it is simple. Start with an opening message such as: "Hi, I am the digital assistant of [company name], an AI. Prefer to talk to a person? That is possible too." Do not give the bot a human name and photo that suggest a real colleague is typing. The same goes for an AI voice on the phone.
Under the Dutch bill, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) will supervise these transparency rules, among others. That implementing act was still going through the legislative process in 2026, but the EU rules apply directly. The regulation sets fines for breaching these rules of up to €15 million or 3 percent of worldwide annual turnover. For SMEs, the lower of the two applies.
AI transparency obligations: when do you label AI text and images?
This is where many explanations go wrong, so to be precise: not every AI text needs a label. Article 50 names two situations in which you as a user must disclose that content was made with AI. The European Commission worked these out in July 2026 in its guidelines on the transparency obligations.
The first is a deepfake: AI-generated image, video or audio that clearly resembles existing people, places, objects or events and could falsely appear real. You always label those. For clearly artistic, satirical or fictional work, you may do so in a way that does not spoil the work.
The second is AI text you publish to inform the public on matters of public interest, such as politics, public health or safety. You label that, unless a human has reviewed the content and someone holds editorial responsibility for it. Your product descriptions, newsletter or blog about your own trade generally do not fall under this. If you use content automation, build in a fixed human check before anything goes live.
And the invisible watermarks in AI content? Those are the job of the makers of AI tools. Tools already on the market before 2 August 2026 have a transition period until 2 December 2026. As a user, you do not have to add machine-readable marks yourself. My advice: do not remove them either.
AI in recruitment: what is postponed and what applies already?
AI that targets job ads, filters applications or evaluates candidates counts as high-risk. Those systems will come with heavy requirements, also for you as a user: human oversight, keeping logs, and informing staff and candidates. Because of the Digital Omnibus package, those requirements only apply from 2 December 2027.
Two things already apply. Since 2 February 2025, emotion recognition in the workplace is prohibited, and according to the European Commission's guidelines that includes the recruitment process. So a tool that reads emotions or enthusiasm from a candidate's face or voice during a video interview is off the table. And the GDPR applies as usual: rejecting an applicant based solely on an automated decision is not simply allowed.
Worth remembering: the postponement only applies to high-risk AI. The transparency rules for your chatbot and your AI content have not been postponed.
AI literacy: in force since February 2025
Since 2 February 2025, every business using AI has had to work on AI literacy: making sure the people who work with AI understand what it can do, what it cannot do and where the risks are. That applies to SMEs too, even if you only use ChatGPT or Copilot.
The Digital Omnibus package softened this in July 2026. You now have to take measures that support AI literacy, and you do not have to guarantee a specific level for each individual. An obligation of effort, not of result.
In practice that means: a short briefing for your team, a few clear agreements (which tools, which data never goes into an AI tool, who checks the output) and writing those down. An afternoon of work, not an expensive course.
AI Act checklist for small businesses
Go through these five points. Most of them take an afternoon.
- List all the AI you use: chatbot, writing tools, image generators, AI in your CRM or in recruitment software.
- Make your chatbot and any AI voice identify themselves as AI at the first interaction, and offer a route to a human.
- Label deepfakes, and either have AI texts on matters of public interest reviewed and edited by a human, or label them.
- For AI in recruitment, check whether it includes emotion recognition (prohibited) and what your vendor is doing ahead of 2 December 2027.
- Write down your agreements on AI use and give your team a short briefing. That is your AI literacy.
How I approach it
If I build a chatbot or other AI workflow automation for you, we include the AI disclosure and a handover to a human in the design. If you want to use AI to automate business processes, we agree upfront which step AI does and where a human checks.
Want to find out first where AI makes sense in your business? Have a look at my AI automation services. Book a free intro call or ask your question via contact, and I will reply within 1 working day. For legal questions about your specific situation, I will refer you to a lawyer.
