Guide
AI Act 2026: what does it require of a small business's website AI assistant?
Short answer
The transparency rules of the EU AI Act have applied to the AI assistant running on your website since 2 August 2026. A small business has to meet three obligations: disclose that AI is answering, ensure basic AI literacy among its staff, and prevent the assistant from manipulating.
Source: EU AI Act, Regulation (EU) 2024/1689 (transparency: Article 50, AI literacy: Article 4, prohibited practices: Article 5, penalties: Article 99)
Why now: the deadline has already passed
The EU AI Act (2024/1689) entered into force in August 2024, but its obligations became applicable in stages. The customer service AI assistant running on your website is mainly affected by the transparency rule, which has applied since 2 August 2026. This is not a future task: if you run an AI assistant today, the disclosure obligation already applies to you.
The amendment known as the Digital Omnibus moved the deadline for high-risk systems to December 2027. It did not affect the transparency obligation, so disclosure is mandatory today for a customer service assistant.
In Hungary, implementation is based on Act LXXV of 2025 and Government Decree 344/2025 (X. 31.). Market surveillance is carried out by the Hungarian Artificial Intelligence Office (Mesterséges Intelligencia Hivatal), whose guidance states that the transparency rule also applies to small businesses, regardless of company size.
Which risk category your assistant belongs to
The regulation assigns risk categories based on the intended purpose. The good news: a customer service assistant that answers questions about orders, delivery and products belongs to the limited-risk category. Here there is no conformity assessment and no CE marking, only transparency.
Three questions help you decide whether you need more than that.
| Question | If yes |
|---|---|
| Does it make decisions about people (jobs, credit, health)? | High risk: the full compliance package is required. |
| Does it recognise emotions or biometric data? | Emotion recognition is prohibited or high risk. |
| Does it only inform, answer and forward? | Limited risk: the list below is enough. |
The website assistants of small businesses typically fall into the last category. This guide was written for that case.
Obligation 1: disclose that AI is answering
Under Article 50(1), an AI system that interacts directly with people must be designed so that the visitor knows they are talking to artificial intelligence. In practice, this means that the chat window shows, before or next to the first message, that an AI assistant is answering. A tiny icon in the footer is not enough. If the assistant hands the conversation over to a human, the switch must also be indicated.
Our assistant has the disclosure built in: the header and the first message state that artificial intelligence is answering, in line with Article 50 of the EU AI Act. The disclosure cannot be switched off.
Obligation 2: AI literacy in the company
Article 4 requires both providers and deployers to ensure basic AI literacy among the staff who operate the system. This has applied since 2 February 2025; the Digital Omnibus softened the wording, but the obligation remained.
In a company of fifty people, this means a documented internal briefing of one to two hours, rather than university training, on what the assistant can and cannot do, when a human must take over the conversation, how personal data is handled, and who is responsible for the answers. Prepare a one-page, dated note of this with the participants: in an inspection by the authority, this is what they ask for first.
Obligation 3: the assistant must not manipulate
Article 5 prohibits subliminal or deceptive techniques and the exploitation of vulnerable situations. For a customer service assistant, in practice this means: no false urgency, no invented social proof, and no setting that pushes an undecided customer towards the more expensive package in place of answering their question. These are not only ethical questions: a breach of Article 5 falls into the highest penalty band.
Who is responsible for what: provider and deployer
The regulation distinguishes two roles. The provider is the one who develops the system and places it on the market, that is, the assistant platform. The deployer is the one who uses it under its own name: your company.
| Obligation | Provider | Deployer |
|---|---|---|
| Building in AI disclosure | yes | checks that it is visible |
| Marking generated content | yes | – |
| Use in line with the intended purpose | – | yes |
| AI literacy among staff | own team | own team |
| Avoiding manipulation | yes | yes |
The key point: by choosing a platform you outsource part of the obligations, but AI literacy and use in line with the intended purpose always remain with you.
Five-point checklist
- AI disclosure in the chat window: at the first interaction it is clear that AI is answering; the handoff is also marked.
- Risk classification documented: one sentence stating that the assistant only informs and does not make decisions about people.
- AI literacy note: dated internal training for the staff who operate it.
- No manipulative settings: the texts and the logic reviewed from the perspective of Article 5.
- The provider’s documents are in place: data processing agreement, storage in the EU, transparency statement.
Five out of five: you are in order. Three or four: this can be completed in an afternoon. Fewer: do not go live until you have completed it.
Next step
The platform covers most of the disclosure and data handling; literacy and the settings are yours. Request a demo on your own website, or see the prices. If you have a question, write to .
Methodology
This guide is based on the text of the EU AI Act 2024/1689, our onboarding experience and our 90-day platform data. The framework of the Hungarian legal implementation is set by Act LXXV of 2025 and Government Decree 344/2025 (X. 31.).
Changelog
- 2026-10-15: rewritten from the smartaichat.hu article “AI Act 2026: chatbot obligations for small and medium-sized businesses”
Sources
- EU AI Act, Regulation (EU) 2024/1689 (transparency: Article 50, AI literacy: Article 4, prohibited practices: Article 5, penalties: Article 99) · eur-lex.europa.eu
- Own platform data, 90 days of use, 2026-07-08 – 2026-10-06 · own data · smartaiassist.eu/data/after-hours-questions/
Found a mistake, or do you have more recent data? Write to
and we will review it.
Frequently asked questions
AI Act 2026
Is it mandatory to disclose that AI is answering?
Yes. Under Article 50 of the EU AI Act, since 2 August 2026 the user must be informed that they are talking to artificial intelligence, unless this is obvious. For a website customer service, it is not obvious.
Is my customer service assistant high risk?
Usually not. It only becomes high risk if it makes decisions about people. A system that answers product and order questions is limited risk, and only transparency applies to it.
What fines should I expect?
Under Article 99 of the regulation, failures related to transparency and AI literacy carry fines of up to 15 million euros or 3 percent of turnover. For a small business, the lower of the two amounts applies.
Is it enough if the provider handles it?
No. The provider supplies the AI disclosure and technical compliance, but AI literacy among your own staff, use in line with the intended purpose and a manipulation-free configuration are your responsibility.
What does the assistant work from?
It answers from the company’s own knowledge base. If there is no content for something, it does not make it up: it asks for contact details and hands over to a colleague.
Related pages
See it with your own content.
The automatic preview is ready after you submit, and is deleted after 24 hours.
In the example conversations, the assistant's answers are given by artificial intelligence. Disclosure under Article 50 of the EU AI Act: "Artificial intelligence, not a human".