EU AI Act: from August, chatbots must disclose that they are not human

The chatbot on your website answers customers under a human name, writes in good Czech and tries to come across as naturally as possible. Since 2 August 2026, that is no longer enough. Regulation (EU) 2024/1689 of the European Parliament and of the Council, known as the EU AI Act, entered the phase on that day in which its transparency rules are enforceable. Companies that deploy interactive AI systems or use generative tools to create content for the public must show their colours — and do so in a way that lets the user realise at first glance what they are dealing with.

The rules rest on Article 50 of the AI Act. Interactive AI systems must inform users that they are communicating with artificial intelligence, unless this is obvious from the circumstances. The obligations also cover deepfakes, emotion recognition systems, biometric categorisation and certain types of generated or manipulated content. In addition, providers of generative systems must, where applicable, ensure that synthetic content is machine-detectable — i.e. marked in a way that other software, not just humans, can read.

In practice, this means reviewing customer chatbots, voice operators and automated communication, but also marketing campaigns in which visuals or text are created using AI. The transitional period until 2 December 2026 applies only to certain labelling and detection obligations for systems placed on the market before 2 August 2026. Most companies that deploy or integrate AI today are therefore already operating under the live regime.

David Strejc, AI architect and founder of the technology company Apertia, points to a paradox the new rules bring: "Until now, companies focused mainly on making chatbots seem as human as possible. The regulation brings a somewhat opposite requirement: the user should know there is no human on the other side. Technologically, it is usually a simple adjustment. What is harder is finding out in how many places the company already uses AI."

That is the core of a problem that, especially in medium-sized companies, nobody wants to hear about. Over the past two years, generative AI has made its way into marketing, customer support, HR, sales and internal analytical tools. In many cases, individual teams or employees adopted it on their own, without approval from IT or the legal department. The company thus has no central register, and when it has to meet the transparency obligation, it has no idea where it actually needs to meet it.

Where mandatory labelling ends and needless paranoia begins

Fortunately, the AI Act is not built in such a way that every e-mail checked by ChatGPT must carry a visible disclaimer. The rules distinguish between different situations. Providers of generative systems deal with machine-readable marking of synthetic content. Deployers — i.e. companies that use AI — have obligations mainly for deepfakes and for certain texts on matters of public interest. Even there, exceptions apply: if the content has undergone human review or editorial control and a specific person or entity bears editorial responsibility for its publication, visible labelling is not required.

"In my view, the AI Act should not lead to us flooding the internet with the sentence 'this text was created by AI' every time someone used ChatGPT for proofreading," explains Strejc. "The point is transparency where a person could be misled — for example when they cannot tell they are communicating with a machine, or when AI creates content that poses as an authentic photograph, voice or video."

The distinguishing test is therefore simple: if an average user could get the impression that they are talking to a human or seeing an authentic record of reality, they must receive a clear signal that this is not the case. A marketing photo obviously styled in an advertising aesthetic does not fall into this category. A fake video of a competitor's managing director, a generated "customer" voice testimonial, or a chatbot that introduces itself with a woman's name and nowhere admits, even in small print, that it is AI, does.

A postponement that is not a postponement

The situation was complicated by the Digital Omnibus on AI, published on 24 July 2026 — just a few days before the transparency rules took effect. It moved the key obligations for stand-alone high-risk AI systems listed in Annex III to 2 December 2027. For high-risk systems embedded in regulated products under Annex I, the deadline is 2 August 2028. This typically concerns AI used in employment, education, critical infrastructure and other sensitive areas.

It is precisely this shift that has produced two opposite misconceptions in practice. Some companies feel that the AI Act as a whole has been postponed and have stopped dealing with the topic. Others, on the contrary, assume that from August they must label practically everything created with the help of AI. Neither is true.

"The biggest misconception we see in companies now is the sentence: the AI Act has been postponed. It hasn't," says Strejc. "Part of the obligations concerning high-risk systems has been postponed. Many other rules already apply, and companies should above all know what AI they actually use, where they use it and whether a specific obligation applies to them."

The postponement of obligations for high-risk systems is also a trap for large organisations. December 2027 sounds like the distant future, but in reality it is just two budget periods and one or two larger IT projects. If a company finds out only in autumn 2027 that it operates an AI system falling under Annex III, it is starting late. The extra time Brussels has given should be used for an inventory, documentation and setting responsibilities — not for putting the topic off.

An AI inventory is the first step, not a compliance project costing millions

Companies that are groping in the dark today usually do not need to launch a formal compliance programme immediately. According to Apertia, the logical first step is an overview — knowing what is actually running in the company. Specifically, map:

• which AI systems and models the company uses,
• which of them communicate directly with customers or employees,
• where publicly published content is created using AI,
• which solutions decide or make recommendations in sensitive areas,
• who is responsible for individual systems,
• what data goes into them and where it is transferred,
• whether the company uses its own solution or an external supplier's service.

Without this overview, it is impossible to assess sensibly which obligations actually fall on your company and which risks need to be addressed first. At the same time, it is a document that in a year or two every supplier, insurer and auditor will need — and, in the event of a dispute, a court too.

For our firm's clients, this means a very concrete task for the coming weeks. Go through your website and all channels where you communicate with customers via a chatbot or voice assistant, and add a clear notice that it is AI. Review AI-generated marketing materials — especially anything that uses the face, voice or video of a real person, even if it is your own managing director. Introduce at least a simple register of AI tools used across departments and designate who is responsible for them. If you operate AI that you are not sure falls outside Annex III, check now, not in 2027. Penalties under the AI Act are based on turnover, and amounts in the millions are not hypothetical.

Source: Advokátní deník, 7 September 2026, Ivana Cihlářová — "AI Act after 2 August: obligations concerning chatbots and AI content already apply" (in Czech); Regulation (EU) 2024/1689 of the European Parliament and of the Council; statement by David Strejc (Apertia).