If you have a chatbot on your website, as of August 2, 2026, you’ll have a new obligation: visitors must be informed that they are interacting with an artificial intelligence system, not a human. This rule stems from the European Artificial Intelligence Act (AI Act) and applies to all companies and institutions in the European Union, including those in Romania.
The good news: for most chatbots on websites, compliance isn’t complicated. The not-so-good news: many companies don’t even know the rule exists. A study by the law firm Buju Stanciu & Associates, published in September 2026, shows that 85% of the Romanian companies surveyed were unaware that they must inform their users when they interact with AI.
In this guide, we explain in simple terms what the law requires for chatbots, what has been postponed and what hasn't, what the situation is in Romania, and what specific steps you need to take.
In a nutshell
- Starting August 2, 2026, anyone interacting with a chatbot must be informed, no later than the first interaction, that they are speaking with an AI system (Article 50 of the AI Act).
- This obligation no has been postponed. The „Digital Omnibus” package has postponed only the rules for high-risk systems.
- A standard chatbot for customer information and support no It is, as a rule, a high-risk system.
- In Romania, the national law establishing the supervisory authority and penalties had not yet been adopted as of August 2026, but the European regulation is directly applicable. Fines set at the EU level can reach up to 15 million euros or 3% of turnover.
- The GDPR remains fully applicable to conversations with the chatbot.
What Is the AI Act and Why Does It Matter Now?
The AI Act (Regulation (EU) 2024/1689) is the first European law to regulate artificial intelligence. It entered into force in August 2024 and is being implemented in phases. Prohibitions on practices deemed unacceptable take effect in February 2025; rules for general-purpose models (such as those behind ChatGPT, Claude, or Gemini) take effect in August 2025; and transparency rules—those directly concerning chatbots—take effect in August 2, 2026.
Since it is a regulation, not a directive, the AI Act applies directly in all member states, without the need for a Romanian transposition law. What is still missing in Romania is the enforcement framework: who enforces it, how, and what penalties apply (details below).
What the Law Says About Chatbots
The main rule is in Article 50, paragraph (1): AI systems that interact directly with people must be designed so that those individuals are informed that they are interacting with an AI system. This information must be provided no later than the first interaction, in a clear, easily visible, and accessible manner, including for persons with disabilities (Article 50(5)).
There is only one practical exception: disclosure is not required when it is obvious to a reasonably informed and attentive person that they are speaking with an AI. Don’t rely on this exception. A chatbot that responds fluently in Romanian can easily be mistaken for a human operator, and the burden of proving that the situation was „obvious” would fall on you.
Who is responsible: the provider or the company using the chatbot?
The AI Act distinguishes between supplier (the entity that develops the system and brings it to market) and implementer (the company or institution that uses it). The obligation set forth in paragraph (1) formally falls on the provider, who must design the chatbot in such a way that the information is accessible and visible.
In practice, however, the company that places the chatbot on its website must ensure that the message actually appears. The law firm cited above points out that the fact that major providers of AI models comply with the law does not automatically extend to companies that integrate these models into their own products. And if you’ve built your own chatbot using a general-purpose model, you yourself become the provider of that system.
What about AI-generated text?
Article 50 also contains two rules relevant to businesses:
- Labeling user-generated content (paragraph (2)): Providers of systems that generate text, images, audio, or video must tag them in a machine-readable format. For systems already on the market before August 2, 2026, there is a grace period until December 2, 2026.
- Public interest texts (paragraph (4)): If you publish AI-generated text to inform the public about topics of public interest, you must state that it is AI-generated, unless the text has been reviewed by a human and someone assumes editorial responsibility for it.
The responses provided by a support chatbot during a conversation with a single visitor do not fall under the category of texts published to inform the public. The rule in paragraph (1) is the main consideration.
What Has Been Postponed and What Has Not
In 2026, the European Union adopted the „Digital Omnibus” package for AI (Regulation (EU) 2026/1744), which took effect on July 27, 2026. Many news headlines have referred to the „postponement of the AI Act,” which is only partially true:
| Obligation | Initial deadline | Term from the Digital Omnibus |
|---|---|---|
| Notification that you are speaking with a chatbot (Art. 50, para. 1) | August 2, 2026 | August 2, 2026 — unchanged |
| Automatic tagging of user-generated content for systems already on the market (Art. 50, para. 2) | August 2, 2026 | December 2, 2026 |
| High-risk systems listed in Annex III (e.g., recruitment, education) | August 2, 2026 | December 2, 2027 |
| High-risk systems listed in Annex I (safety components in products) | August 2, 2027 | August 2, 2028 |
Conclusion regarding a website chatbot: The transparency rule is already in effect.
Is my chatbot a „high-risk” system?
In the vast majority of cases, no. A chatbot that answers questions about products, services, schedules, procedures, or public documents is a low-risk system, subject only to transparency requirements.
The situation changes if the chatbot makes or influences important decisions about people—for example, if it screens job applicants, evaluates students, or decides who receives social benefits. These uses are listed in Annex III of the regulation and are subject to much stricter obligations, which, however, do not take effect until December 2027. If you find yourself in this situation, it’s worth conducting a dedicated legal analysis.
The Situation in Romania
The regulation is directly applicable, but the Romanian government was required to designate the supervisory authorities and adopt the system of penalties. In early August 2026:
- The government had proposed, in a memorandum, that ANCOM to serve as the primary market oversight authority and single point of contact;
- The national law granting the authorities the power to monitor and impose sanctions was still being drafted, and ANCOM confirmed that it could conduct inspections and impose sanctions only after the law took effect;
- A Deloitte Legal analysis places Romania among the countries that are implementing the AI Act the slowest.
That no This means the rule can be ignored. The obligation already exists, national legislation can be enacted at any time, and customers and partners (especially public institutions, in the context of procurement) are beginning to demand proof of compliance. At the European level, violations of transparency obligations can result in fines of up to 15 million euros or 3% of global annual turnover. For SMEs, the lower of the two amounts applies.
Do you want a chatbot that's transparent from day one? At Intel Logic, we tailor the welcome message so that visitors know from their very first interaction that they are chatting with an AI assistant. The assistant responds only based on your business’s content, and the data remains on servers in Romania. See how the Intel Logic AI chatbot works.
Don't forget about the GDPR
The AI Act does not replace the GDPR, but rather supplements it. Conversations with a chatbot often contain personal data: names, phone numbers, email addresses, and sometimes details about health or personal circumstances. The GDPR rules apply in full to this data, and the ANSPDCP already has the authority to oversee it:
- The privacy policy must mention the chatbot, what data it collects, and how long it retains that data;
- You need to know where the conversations are stored. If they end up on servers outside the EU, you need additional safeguards for the data transfer;
- The contract with the chatbot provider must include data processing clauses (a data processing agreement, in accordance with Article 28 of the GDPR).
I wrote in more detail about the importance of data control in the article on Digital Sovereignty Index.
Checklist: 7 Steps to a Compliant Chatbot
- Take inventory. Make a note of where you use AI in your customer interactions: a chatbot on your website, WhatsApp, Messenger, and automated email replies.
- It clearly shows that it's AI. The name and welcome message should explicitly state „AI assistant” or „virtual assistant based on artificial intelligence.” A person’s name („Ana is here to help you”), without any further clarification, is not sufficient.
- Give the information at the beginning, not at the end. The message must appear before or at the time of the first interaction, not hidden away in a terms page.
- It offers a path to a person. The law does not explicitly require this for low-risk chatbots, but an option to contact a support representative builds trust and reduces complaints.
- Check the supplier. Ask where the data is stored, whether the model is trained on your conversations, and what data processing agreement you’ve signed.
- Update the privacy policy. Add a section about the chatbot, the data collected, and the retention period.
- Train the team. The people who manage the chatbot must understand what it can and cannot do. As of February 2025, the AI Act also includes a provision on AI literacy (Article 4).
What does this mean for public institutions?
An increasing number of city halls, hospitals, and government agencies are using chatbots to provide information to citizens. For these entities, the same transparency rules will apply starting August 2, 2026, with a few exceptions:
- Citizens must be able to clearly distinguish between a response from an AI assistant and an official communication from the institution;
- The information must come from the institution’s official sources and be up to date. A chatbot that „makes up” procedures or deadlines can cause real harm;
- Citizens' data is often sensitive, so where it is stored matters even more.
Intel Logic chatbots are already in use at public institutions and hospitals in Romania; they respond exclusively based on documents provided by the institution, and the data is hosted within the country.
Frequently Asked Questions
Do I need to make any changes if I already have a chatbot on my website?
Check to see if the welcome message clearly states that the visitor is speaking with an AI assistant. If not, making the change is usually simple: just add some text to the chat window or the initial message. Also check the privacy policy.
Can I get a ticket right now in Romania?
Until the national law is adopted, Romanian authorities have stated that they cannot impose penalties under the AI Act. However, the obligation already exists, and the law could take effect at any time. For personal data contained in conversations, the ANSPDCP can impose penalties at any time under the GDPR.
If the chatbot only answers questions about the schedule and products, do I still have to disclose that it's AI?
Yes. The obligation to be transparent does not depend on how simple the questions are, but on the fact that a person is interacting directly with an AI system.
My chatbot uses ChatGPT. Does the provider handle compliance?
Not entirely. The provider of the chatbot has its own obligations, but how the chatbot appears on your website, the informational message, and the data collected are up to you and the person who built the chatbot for you.
Conclusion
For a website chatbot, the AI Act requires, first and foremost, honesty: the visitor must know that they are talking to an AI. It’s an easy rule to follow, and when properly implemented, it builds customer trust rather than eroding it. Combined with a clear data policy, it ensures your business or institution complies with both the AI Act and the GDPR.
If you'd like us to work with you to see how your chatbot stacks up against these rules, or if you're looking for an AI assistant built from the ground up with transparency and data in Romania, Write to us. You can also get an idea of the costs from our guide How Much Will an AI Chatbot for a Website Cost in 2026?.
This article is for informational purposes only and does not constitute legal advice. The information is current as of the date of publication (October 2026); for specific situations, consult a specialized attorney.
Citește și
- How Much Will an AI Chatbot for a Website Cost in 2026?
- AI Chatbots for Public Institutions: A Guide for City Halls, Hospitals, and Government Agencies
- AI în educație: ce poate face un asistent AI pentru profesori și elevi
Sources
- Regulation (EU) 2024/1689 (AI Act), official text on EUR-Lex
- Article 50 of the AI Act and the Digital Omnibus Amendments — Praxikon
- Digital AI Omnibus: Postponed Deadlines — Cooley
- AI Act in Romania: Authorities Cannot Impose Penalties Yet — Bursa, August 4, 2026
- Romania Has No Designated Authority for the AI Act — Edupedu, August 11, 2026
- Buju Stanciu & Associates Study on Transparency Obligations — Știripesurse, September 2026
