I have a chatbot on my site. Must I do something before 2 August 2026?

Yes. From 2 August 2026 users must be informed that they are interacting with an AI system. In most cases this is solved with a disclosure at the start of the conversation, a label on AI-generated messages, and a review of the bot's system instructions so that it does not present itself as a person.

Does it apply to a small business?

Yes. Article 50 sets no size threshold: it applies to whoever makes available an AI system that interacts with natural persons. Size matters for the penalty, not for the obligation.

My chatbot comes from an external vendor. Is it their responsibility?

Partly. The provider must design the system so that transparency is possible; whoever puts it in front of customers (the deployer) must use it transparently and must not switch the information off. These are two distinct, concurrent responsibilities: neither cancels the other.

Can the work be funded?

The audit and the remediation are consultancy costs; staff training is a training cost. Both are eligible under the Italian Chambers of Commerce "Voucher Doppia Transizione 2026" schemes, where the local Chamber has joined. Rates and ceilings vary by province: the local call for applications governs.

AI Act: what changes on 2 August 2026 for your business

From 2 August 2026 the AI Act's transparency obligations become applicable. In practice: if you put an AI system that talks to people in front of the public, people must know it. That covers every chatbot on every website. It is not just about big tech, and almost nobody has noticed.

Content reviewed on 13 July 2026

The date that matters

Regulation (EU) 2024/1689 — the AI Act — entered into force on 1 August 2024, but its obligations switch on in stages. On 2 August 2026 it is Article 50's turn, the one on transparency, and with it the penalty regime of Article 99 becomes operative.

This is the stage that touches the vast majority of European SMEs. Not because they use AI to decide who gets hired or who gets a loan — those are high-risk systems, a different chapter — but because they have a virtual assistant on their website, a bot on WhatsApp, a product-description generator. Ordinary things, which Article 50 nonetheless names explicitly.

Who it actually applies to

The AI Act distinguishes between whoever develops an AI system (the provider) and whoever uses it in their own business (the deployer). Article 50's transparency obligations fall on both, each for their part: the provider must design the system so that the user is informed; the deployer must use it that way and must not switch that information off.

Translated: if you bought a chatbot from an agency and put it on your site, you cannot say "that's their problem". Responsibility for what you put in front of your customers stays with you.

An e-commerce site with a virtual assistant answering customer questions → in scope.
A professional firm with a WhatsApp bot booking appointments → in scope.
A company publishing AI-generated text or images → in scope for the marking obligation.
A company whose staff use AI tools in their work → in scope for the AI literacy obligation, already in force.

The three obligations that touch an SME

Obligation	Provision	From when
Users must know they are interacting with an AI system	Art. 50(1)	2 August 2026
AI-generated or manipulated content must be marked as such, in a machine-readable format	Art. 50(2)	2 August 2026 (systems already on the market: by 2 December 2026)
Staff using AI must have a sufficient level of AI literacy	Art. 4	already in force since 2 February 2025

The AI literacy obligation does not arrive in August: it has been in force for over a year. It is the one of the three that almost no company can currently demonstrate.

The full timeline

1 August 2024 — the AI Act enters into force.
2 February 2025 — prohibited AI practices (Art. 5) and the AI literacy obligation (Art. 4).
2 August 2025 — obligations for general-purpose AI models (GPAI).
2 August 2026 — transparency obligations (Art. 50) and penalties (Art. 99). This is the date that concerns almost every business.
2 December 2026 — deadline for systems already on the market to comply with synthetic-content marking.
2 August 2027 — obligations for high-risk systems embedded in regulated products.

What to do, concretely

In most cases compliance is not a project: it is a matter of configuration, interface and documentation. The work is in doing it well, not in doing it big.

Inventory the AI systems your business uses or offers. Everyone skips this step, and it is the one that makes everything else demonstrable.
Add the disclosure at the start of the interaction — and check that the chatbot does not contradict it when asked "are you a person?".
Make AI-generated replies visibly distinguishable from a human operator's replies.
Train the staff who use AI and keep a register of sessions: without a register, Article 4 cannot be demonstrated.
Write down what you did. Compliance that is not documented does not exist in front of a regulator.

What this page will not do

It will not tell you that you risk €15 million. That figure is the theoretical ceiling in Article 99, designed for the gravest breaches by global-scale companies, and penalties are explicitly proportionate to gravity and to the size of the undertaking. Presenting it as an online shop's exposure would be dishonest.

The real point is less dramatic and more awkward: the obligation exists, anyone who opens your website can check it, and it is trivial to meet. That is exactly the kind of failure that has no excuse.

Your chatbot and Article 50

What the provision actually says, why "you are talking to an AI" is the wrong wording, and how to write a disclosure that works.

AI literacy: the Article 4 obligation

Training the people who use AI has been mandatory since February 2025. What "sufficient level" means and how you prove it.

AI Act penalties

The three tiers of Article 99, the lower cap for SMEs, who supervises in Italy, and what a small business really risks.

Italy's AI law is no longer a bill

Law 132/2025 has been in force since 10 October 2025. What it says, what is still missing, what changes for your business.

Compliance checklist

Twelve points to check before 2 August. Free, no email, printable.

Frequently asked questions

I have a chatbot on my site. Must I do something before 2 August 2026?: Yes. From 2 August 2026 users must be informed that they are interacting with an AI system. In most cases this is solved with a disclosure at the start of the conversation, a label on AI-generated messages, and a review of the bot's system instructions so that it does not present itself as a person.
Does it apply to a small business?: Yes. Article 50 sets no size threshold: it applies to whoever makes available an AI system that interacts with natural persons. Size matters for the penalty, not for the obligation.
My chatbot comes from an external vendor. Is it their responsibility?: Partly. The provider must design the system so that transparency is possible; whoever puts it in front of customers (the deployer) must use it transparently and must not switch the information off. These are two distinct, concurrent responsibilities: neither cancels the other.
Who supervises in Italy?: Law 132/2025 designates the Agency for Digital Italy (AgID) and the National Cybersecurity Agency (ACN) as the national AI authorities, each within its remit. Sector authorities keep their powers — first among them the data protection authority, whenever personal data is involved.
Can the work be funded?: The audit and the remediation are consultancy costs; staff training is a training cost. Both are eligible under the Italian Chambers of Commerce "Voucher Doppia Transizione 2026" schemes, where the local Chamber has joined. Rates and ceilings vary by province: the local call for applications governs.

Is your chatbot compliant?

Five questions, sixty seconds, no email required. The result tells you which obligations you are missing and which articles impose them.

Check your chatbot

Sources

This page is informational and does not constitute legal advice. The authoritative texts are Regulation (EU) 2024/1689 and Italian Law no. 132 of 23 September 2025. We are engineers: we know how transparency is implemented in an AI system — we do not replace your lawyer. For hard cases, consult a qualified professional.