Blog

The EU AI Act and your website: what you need to know

The EU AI Act and the use of AI on websites

Last checked: 5 November 2026

What changed on 2 August 2026?

The European Union’s Artificial Intelligence Act, commonly known as the AI Act, entered into force in 2024, but its requirements apply in stages. Article 50 became applicable on 2 August 2026, introducing transparency obligations for certain AI systems and AI-generated content.

Website visitors should understand when they are interacting with AI or encountering synthetic content that could be mistaken for something authentic. This does not mean that every AI-assisted text, generated image or corrected line of code automatically needs an AI label.

AI providers and deployers have different roles

A provider develops an AI system, or has one developed, and offers it under its own name or trademark. A deployer uses an AI system in a professional or business context.

If you use a ready-made AI chatbot on your website or generate images with an AI tool, you are usually a deployer. Developing a solution or offering it under your own name may bring provider obligations. Your role depends on the particular solution and how it is offered.

When do transparency obligations affect your website?

1. An AI chatbot responds to visitors

If someone interacts directly with AI on your website, this must be clear from the start of the first interaction. Article 50(1) requires the AI system’s provider to design the system so that people can be informed. As a website owner, you should check that the notice actually appears in the chat window.

A simple introduction can work: “Hi! I’m an AI assistant.” The information must be understandable and accessible. A sentence hidden in the terms of use is not enough. An exception may apply when the interaction with AI is already obvious, but the Commission’s guidelines say this exception should be interpreted narrowly.

2. You publish realistic AI-generated images, video or audio

The obligation to disclose content’s AI origin applies, among other things, to deepfakes. These are AI-generated or manipulated images, videos or audio that resemble existing people, objects, places or events and could falsely appear authentic or truthful.

The assessment should consider the resemblance to the person, object, place or event depicted, as well as the context in which the content is presented. A fictional scene is not automatically exempt from labelling. The Commission’s guidelines also consider whether what is depicted could plausibly exist in real life.

If the content is a deepfake, its AI origin must be clearly disclosed no later than the person’s first exposure to it. A machine-readable mark embedded in the file is not enough on its own.

For creative, artistic, satirical or fictional works, disclosure may take a form that does not interfere with viewing or enjoying the work. A creative purpose does not automatically remove the obligation.

A clearly abstract or stylised illustration may fall outside the definition of a deepfake. With realistic marketing images, however, consider whether visitors could mistake the image for your actual product, accommodation or completed work. Misleading presentation may also be subject to rules beyond the AI Act.

3. AI helps write text about a matter of public interest

An obligation to disclose that text was generated or manipulated by AI may arise when it is published to inform the public on a matter of public interest. Examples include topics relating to politics, health, the environment or consumer safety.

An important exception applies where the text has undergone substantive human review or editorial control and a person or company holds editorial responsibility for its publication. Spell-checking alone is not enough. Claims, facts, sources and conclusions need to be checked.

Ordinary service descriptions and product descriptions generally fall outside this obligation. The information you publish must still be accurate and not misleading.

4. You use emotion recognition or biometric categorisation

People exposed to these systems must be informed that the systems are being used, and personal data protection requirements must be followed.

Disclosure does not make a prohibited use lawful. For example, AI-based emotion recognition in workplaces and educational institutions is generally prohibited, except for medical or safety reasons. Certain uses of biometric data to infer sensitive characteristics are also prohibited.

What usually does not need a separate AI label?

The transparency obligations in Article 50 generally do not mean that you need to add a visitor-facing AI label for the following activities:

  • Creating or improving website code with AI.
  • Routine language editing, such as correcting spelling or improving wording.
  • Developing ideas, outlines and drafts, provided the published result is assessed according to its actual content and context of use.
  • Clearly abstract or stylised illustrations that could not reasonably be mistaken for authentic images.

You cannot determine whether an exception applies solely from the name of the tool or technique used. What matters is what you ultimately publish and the impression it gives visitors.

Machine-readable marking and human-readable disclosure are different

AI system providers must ensure that synthetic content is marked in a machine-readable format and detectable as AI-generated or manipulated, subject to the conditions in Article 50. Technical feasibility and the characteristics of the content are among the factors taken into account.

Providers of content-generating AI systems placed on the market before 2 August 2026 have a transition period until 2 December 2026 to comply with Article 50(2). This extension does not apply to chatbot interaction notices or required human-readable disclosures about AI-generated content.

An ordinary website owner generally does not need to develop a technical marking system. Where possible, retain any provenance information added by the tool. If a human-readable disclosure of the content’s AI origin is required, it must be provided separately from the technical marking.

According to the Commission’s explanation, content created before 2 August 2026 does not need to be labelled retroactively under Article 50. The Commission nevertheless encourages doing so where possible if it helps clarify the content’s origin.

Don’t forget AI literacy

Article 4 of the AI Act also addresses developing the knowledge and skills of people who use AI. Businesses must support the AI literacy of staff and others who operate systems on their behalf, taking account of their work and the context in which the systems are used.

In practice, agree on how AI responses will be checked, what data may be entered into tools and who decides whether content is published. The measures should reflect actual tasks and risks.

A practical checklist for website owners

  • Identify where AI is used. Which chatbots, content creation tools and other AI solutions are connected with your website?
  • Check the start of the chat. Is it immediately clear to visitors that they are interacting with AI?
  • Assess how realistic content is presented. Could an image, video or audio recording be mistaken for something authentic?
  • Review AI-assisted text for substance. Check facts, sources and conclusions.
  • Agree on responsibilities. Who checks the content, approves publication and handles corrections?
  • Keep relevant records. For example, the tool used, the checks carried out and the reasoning behind the labelling decision.
  • Consider other requirements. The AI Act does not replace privacy, copyright, advertising or consumer protection rules.

Does an AI-generated blog image need a label?

That depends on the image and how it is presented. A fictional desk scene is not automatically exempt from labelling if it is photorealistic and could be perceived as a genuine photograph or situation.

If the image is clearly illustrative and does not create a misleading impression, the deepfake disclosure obligation may not apply. You can still explain its AI origin voluntarily, for example with the caption “AI-generated illustration”.

If disclosure of its AI origin is required, present the information clearly beside the image or in another suitable way. Alt text or file metadata alone is not a substitute for a visitor-facing notice.

Summary

For most small business websites and online stores, complying with the AI Act primarily means using AI thoughtfully, being transparent and reviewing content carefully.

Let visitors know when they are interacting with AI. Assess whether realistic synthetic content needs a label based on its context, and check the facts in the text you publish. Not every use of AI needs a label, but using a tool does not remove your business’s responsibility for the content it publishes.

Need a new website, or want to review your existing website’s content and AI features? Get in touch and we’ll look at your needs together.

Sources and further reading

This article provides a general overview and is not legal advice. For a specific or higher-risk AI solution, seek advice from a legal professional where needed.

Got an idea? Let’s talk!