{"id":21315,"date":"2026-10-14T13:39:32","date_gmt":"2026-10-14T10:39:32","guid":{"rendered":"https:\/\/intellogic.ai\/?p=21315"},"modified":"2026-10-22T09:05:46","modified_gmt":"2026-10-22T06:05:46","slug":"there-are-chatbots-heres-what-companies-need-to-do","status":"publish","type":"post","link":"https:\/\/intellogic.ai\/en\/there-are-chatbots-heres-what-companies-need-to-do\/","title":{"rendered":"The AI Act and Chatbots: What Romanian Companies Need to Do"},"content":{"rendered":"<p>If you have a chatbot on your website, as of August 2, 2026, you\u2019ll have a new obligation: visitors must be informed that they are interacting with an artificial intelligence system, not a human. This rule stems from the European Artificial Intelligence Act (AI Act) and applies to all companies and institutions in the European Union, including those in Romania.<\/p>\n<p>The good news: for most chatbots on websites, compliance isn\u2019t complicated. The not-so-good news: many companies don\u2019t even know the rule exists. A study by the law firm Buju Stanciu &amp; Associates, published in September 2026, shows that 85% of the Romanian companies surveyed were unaware that they must inform their users when they interact with AI.<\/p>\n<p>In this guide, we explain in simple terms what the law requires for chatbots, what has been postponed and what hasn't, what the situation is in Romania, and what specific steps you need to take.<\/p>\n<div style=\"background: #f2f4f7; border-left: 4px solid #4f46e5; padding: 18px 22px; margin: 24px 0; color: #1f2937;\">\n<p><strong>In a nutshell<\/strong><\/p>\n<ul>\n<li>Starting August 2, 2026, anyone interacting with a chatbot must be informed, no later than the first interaction, that they are speaking with an AI system (Article 50 of the AI Act).<\/li>\n<li>This obligation <strong>no<\/strong> has been postponed. The \u201eDigital Omnibus\u201d package has postponed only the rules for high-risk systems.<\/li>\n<li>A standard chatbot for customer information and support <strong>no<\/strong> It is, as a rule, a high-risk system.<\/li>\n<li>In Romania, the national law establishing the supervisory authority and penalties had not yet been adopted as of August 2026, but the European regulation is directly applicable. Fines set at the EU level can reach up to 15 million euros or 3% of turnover.<\/li>\n<li>The GDPR remains fully applicable to conversations with the chatbot.<\/li>\n<\/ul>\n<\/div>\n<div style=\"background: #f2f4f7; border-left: 4px solid #4f46e5; padding: 18px 22px; margin: 24px 0; color: #1f2937;\"><strong>Would you like an AI chatbot on your website?<\/strong> The START plan includes a 15-day free trial. <a href=\"https:\/\/intellogic.ai\/en\/chatbot-youve-trained-for-your-business\/#preturi\">View prices and packages<\/a> \u00b7 <a href=\"https:\/\/intellogic.ai\/en\/contact\/\">Request a demo<\/a><\/div>\n<h2>What Is the AI Act and Why Does It Matter Now?<\/h2>\n<p>The AI Act (Regulation (EU) 2024\/1689) is the first European law to regulate artificial intelligence. It entered into force in August 2024 and is being implemented in phases. Prohibitions on practices deemed unacceptable take effect in February 2025; rules for general-purpose models (such as those behind ChatGPT, Claude, or Gemini) take effect in August 2025; and transparency rules\u2014those directly concerning chatbots\u2014take effect in <strong>August 2, 2026<\/strong>.<\/p>\n<p>Since it is a regulation, not a directive, the AI Act applies directly in all member states, without the need for a Romanian transposition law. What is still missing in Romania is the enforcement framework: who enforces it, how, and what penalties apply (details below).<\/p>\n<h2>What the Law Says About Chatbots<\/h2>\n<p>The main rule is in <strong>Article 50, paragraph (1)<\/strong>: AI systems that interact directly with people must be designed so that those individuals are informed that they are interacting with an AI system. This information must be provided <strong>no later than the first interaction<\/strong>, in a clear, easily visible, and accessible manner, including for persons with disabilities (Article 50(5)).<\/p>\n<p>There is only one practical exception: disclosure is not required when it is obvious to a reasonably informed and attentive person that they are speaking with an AI. Don\u2019t rely on this exception. A chatbot that responds fluently in Romanian can easily be mistaken for a human operator, and the burden of proving that the situation was \u201eobvious\u201d would fall on you.<\/p>\n<h3>Who is responsible: the provider or the company using the chatbot?<\/h3>\n<p>The AI Act distinguishes between <strong>supplier<\/strong> (the entity that develops the system and brings it to market) and <strong>implementer<\/strong> (the company or institution that uses it). The obligation set forth in paragraph (1) formally falls on the provider, who must design the chatbot in such a way that the information is accessible and visible.<\/p>\n<p>In practice, however, the company that places the chatbot on its website must ensure that the message actually appears. The law firm cited above points out that the fact that major providers of AI models comply with the law does not automatically extend to companies that integrate these models into their own products. And if you\u2019ve built your own chatbot using a general-purpose model, you yourself become the provider of that system.<\/p>\n<h3>What about AI-generated text?<\/h3>\n<p>Article 50 also contains two rules relevant to businesses:<\/p>\n<ul>\n<li><strong>Labeling user-generated content (paragraph (2)):<\/strong> Providers of systems that generate text, images, audio, or video must tag them in a machine-readable format. For systems already on the market before August 2, 2026, there is a grace period until <strong>December 2, 2026<\/strong>.<\/li>\n<li><strong>Public interest texts (paragraph (4)):<\/strong> If you publish AI-generated text to inform the public about topics of public interest, you must state that it is AI-generated, unless the text has been reviewed by a human and someone assumes editorial responsibility for it.<\/li>\n<\/ul>\n<p>The responses provided by a support chatbot during a conversation with a single visitor do not fall under the category of texts published to inform the public. The rule in paragraph (1) is the main consideration.<\/p>\n<h2>What Has Been Postponed and What Has Not<\/h2>\n<p>In 2026, the European Union adopted the \u201eDigital Omnibus\u201d package for AI (Regulation (EU) 2026\/1744), which took effect on July 27, 2026. Many news headlines have referred to the \u201epostponement of the AI Act,\u201d which is only partially true:<\/p>\n<table>\n<thead>\n<tr>\n<th>Obligation<\/th>\n<th>Initial deadline<\/th>\n<th>Term from the Digital Omnibus<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Notification that you are speaking with a chatbot (Art. 50, para. 1)<\/td>\n<td>August 2, 2026<\/td>\n<td><strong>August 2, 2026 \u2014 unchanged<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Automatic tagging of user-generated content for systems already on the market (Art. 50, para. 2)<\/td>\n<td>August 2, 2026<\/td>\n<td>December 2, 2026<\/td>\n<\/tr>\n<tr>\n<td>High-risk systems listed in Annex III (e.g., recruitment, education)<\/td>\n<td>August 2, 2026<\/td>\n<td>December 2, 2027<\/td>\n<\/tr>\n<tr>\n<td>High-risk systems listed in Annex I (safety components in products)<\/td>\n<td>August 2, 2027<\/td>\n<td>August 2, 2028<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Conclusion regarding a website chatbot: <strong>The transparency rule is already in effect<\/strong>.<\/p>\n<h2>Is my chatbot a \u201ehigh-risk\u201d system?<\/h2>\n<p>In the vast majority of cases, no. A chatbot that answers questions about products, services, schedules, procedures, or public documents is a low-risk system, subject only to transparency requirements.<\/p>\n<p>The situation changes if the chatbot makes or influences important decisions about people\u2014for example, if it screens job applicants, evaluates students, or decides who receives social benefits. These uses are listed in Annex III of the regulation and are subject to much stricter obligations, which, however, do not take effect until December 2027. If you find yourself in this situation, it\u2019s worth conducting a dedicated legal analysis.<\/p>\n<h2>The Situation in Romania<\/h2>\n<p>The regulation is directly applicable, but the Romanian government was required to designate the supervisory authorities and adopt the system of penalties. In early August 2026:<\/p>\n<ul>\n<li>The government had proposed, in a memorandum, that <strong>ANCOM<\/strong> to serve as the primary market oversight authority and single point of contact;<\/li>\n<li>The national law granting the authorities the power to monitor and impose sanctions was still being drafted, and ANCOM confirmed that it could conduct inspections and impose sanctions only after the law took effect;<\/li>\n<li>A Deloitte Legal analysis places Romania among the countries that are implementing the AI Act the slowest.<\/li>\n<\/ul>\n<p>That <strong>no<\/strong> This means the rule can be ignored. The obligation already exists, national legislation can be enacted at any time, and customers and partners (especially public institutions, in the context of procurement) are beginning to demand proof of compliance. At the European level, violations of transparency obligations can result in fines of up to 15 million euros or 3% of global annual turnover. For SMEs, the lower of the two amounts applies.<\/p>\n<div style=\"background: #f2f4f7; border-left: 4px solid #4f46e5; padding: 18px 22px; margin: 24px 0; color: #1f2937;\">\n<p><strong>Do you want a chatbot that's transparent from day one?<\/strong> At Intel Logic, we tailor the welcome message so that visitors know from their very first interaction that they are chatting with an AI assistant. The assistant responds only based on your business\u2019s content, and the data remains on servers in Romania. <a href=\"https:\/\/intellogic.ai\/en\/chatbot-youve-trained-for-your-business\/\">See how the Intel Logic AI chatbot works<\/a>.<\/p>\n<\/div>\n<h2>Don't forget about the GDPR<\/h2>\n<p>The AI Act does not replace the GDPR, but rather supplements it. Conversations with a chatbot often contain personal data: names, phone numbers, email addresses, and sometimes details about health or personal circumstances. The GDPR rules apply in full to this data, and the ANSPDCP already has the authority to oversee it:<\/p>\n<ul>\n<li>The privacy policy must mention the chatbot, what data it collects, and how long it retains that data;<\/li>\n<li>You need to know where the conversations are stored. If they end up on servers outside the EU, you need additional safeguards for the data transfer;<\/li>\n<li>The contract with the chatbot provider must include data processing clauses (a data processing agreement, in accordance with Article 28 of the GDPR).<\/li>\n<\/ul>\n<p>I wrote in more detail about the importance of data control in the article on <a href=\"https:\/\/intellogic.ai\/en\/digital-sovereignty-index-how-countries-compare-in-terms-of-digital-independence\/\">Digital Sovereignty Index<\/a>.<\/p>\n<h2>Checklist: 7 Steps to a Compliant Chatbot<\/h2>\n<ol>\n<li><strong>Take inventory.<\/strong> Make a note of where you use AI in your customer interactions: a chatbot on your website, WhatsApp, Messenger, and automated email replies.<\/li>\n<li><strong>It clearly shows that it's AI.<\/strong> The name and welcome message should explicitly state \u201eAI assistant\u201d or \u201evirtual assistant based on artificial intelligence.\u201d A person\u2019s name (\u201eAna is here to help you\u201d), without any further clarification, is not sufficient.<\/li>\n<li><strong>Give the information at the beginning, not at the end.<\/strong> The message must appear before or at the time of the first interaction, not hidden away in a terms page.<\/li>\n<li><strong>It offers a path to a person.<\/strong> The law does not explicitly require this for low-risk chatbots, but an option to contact a support representative builds trust and reduces complaints.<\/li>\n<li><strong>Check the supplier.<\/strong> Ask where the data is stored, whether the model is trained on your conversations, and what data processing agreement you\u2019ve signed.<\/li>\n<li><strong>Update the privacy policy.<\/strong> Add a section about the chatbot, the data collected, and the retention period.<\/li>\n<li><strong>Train the team.<\/strong> The people who manage the chatbot must understand what it can and cannot do. As of February 2025, the AI Act also includes a provision on AI literacy (Article 4).<\/li>\n<\/ol>\n<h2>What does this mean for public institutions?<\/h2>\n<p>An increasing number of city halls, hospitals, and government agencies are using chatbots to provide information to citizens. For these entities, the same transparency rules will apply starting August 2, 2026, with a few exceptions:<\/p>\n<ul>\n<li>Citizens must be able to clearly distinguish between a response from an AI assistant and an official communication from the institution;<\/li>\n<li>The information must come from the institution\u2019s official sources and be up to date. A chatbot that \u201emakes up\u201d procedures or deadlines can cause real harm;<\/li>\n<li>Citizens' data is often sensitive, so where it is stored matters even more.<\/li>\n<\/ul>\n<p>Intel Logic chatbots are already in use at public institutions and hospitals in Romania; they respond exclusively based on documents provided by the institution, and the data is hosted within the country.<\/p>\n<h2>Frequently Asked Questions<\/h2>\n<h3>Do I need to make any changes if I already have a chatbot on my website?<\/h3>\n<p>Check to see if the welcome message clearly states that the visitor is speaking with an AI assistant. If not, making the change is usually simple: just add some text to the chat window or the initial message. Also check the privacy policy.<\/p>\n<h3>Can I get a ticket right now in Romania?<\/h3>\n<p>Until the national law is adopted, Romanian authorities have stated that they cannot impose penalties under the AI Act. However, the obligation already exists, and the law could take effect at any time. For personal data contained in conversations, the ANSPDCP can impose penalties at any time under the GDPR.<\/p>\n<h3>If the chatbot only answers questions about the schedule and products, do I still have to disclose that it's AI?<\/h3>\n<p>Yes. The obligation to be transparent does not depend on how simple the questions are, but on the fact that a person is interacting directly with an AI system.<\/p>\n<h3>My chatbot uses ChatGPT. Does the provider handle compliance?<\/h3>\n<p>Not entirely. The provider of the chatbot has its own obligations, but how the chatbot appears on your website, the informational message, and the data collected are up to you and the person who built the chatbot for you.<\/p>\n<h2>Conclusion<\/h2>\n<p>For a website chatbot, the AI Act requires, first and foremost, honesty: the visitor must know that they are talking to an AI. It\u2019s an easy rule to follow, and when properly implemented, it builds customer trust rather than eroding it. Combined with a clear data policy, it ensures your business or institution complies with both the AI Act and the GDPR.<\/p>\n<p>If you'd like us to work with you to see how your chatbot stacks up against these rules, or if you're looking for an AI assistant built from the ground up with transparency and data in Romania, <a href=\"https:\/\/intellogic.ai\/en\/contact\/\">Write to us<\/a>. You can also get an idea of the costs from our guide <a href=\"https:\/\/intellogic.ai\/en\/how-much-does-a-chatbot-for-your-website-cost\/\">How Much Will an AI Chatbot for a Website Cost in 2026?<\/a>.<\/p>\n<p><em>This article is for informational purposes only and does not constitute legal advice. The information is current as of the date of publication (October 2026); for specific situations, consult a specialized attorney.<\/em><\/p>\n<h2>Read more<\/h2>\n<ul>\n<li><a href=\"https:\/\/intellogic.ai\/en\/how-much-does-a-chatbot-for-your-website-cost\/\">How Much Will an AI Chatbot for a Website Cost in 2026?<\/a><\/li>\n<li><a href=\"https:\/\/intellogic.ai\/en\/chatbots-used-by-public-institutions\/\">AI Chatbots for Public Institutions: A Guide for City Halls, Hospitals, and Government Agencies<\/a><\/li>\n<li><a href=\"https:\/\/intellogic.ai\/en\/asistent-ai-in-educatie\/\">AI \u00een educa\u021bie: ce poate face un asistent AI pentru profesori \u0219i elevi<\/a><\/li>\n<\/ul>\n<h2>Sources<\/h2>\n<ul>\n<li><a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/1689\/oj\" target=\"_blank\" rel=\"noopener\">Regulation (EU) 2024\/1689 (AI Act), official text on EUR-Lex<\/a><\/li>\n<li><a href=\"https:\/\/www.praxikon.com\/en\/ai-act\/artikel\/50\" target=\"_blank\" rel=\"noopener\">Article 50 of the AI Act and the Digital Omnibus Amendments \u2014 Praxikon<\/a><\/li>\n<li><a href=\"https:\/\/cdp.cooley.com\/digital-ai-omnibus-delays-key-deadlines-introduces-new-rules\/\" target=\"_blank\" rel=\"noopener\">Digital AI Omnibus: Postponed Deadlines \u2014 Cooley<\/a><\/li>\n<li><a href=\"https:\/\/www.bursa.ro\/ai-act-lege-europeana-fara-8222dinti8221-in-romania-autoritatile-nu-pot-aplica-sanctiuni-inca-06767950\" target=\"_blank\" rel=\"noopener\">AI Act in Romania: Authorities Cannot Impose Penalties Yet \u2014 Bursa, August 4, 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.edupedu.ro\/romania-ramane-fara-autoritate-desemnata-pentru-ai-act-in-timp-ce-alte-state-ue-au-deja-sanctiuni-operationale\/\" target=\"_blank\" rel=\"noopener\">Romania Has No Designated Authority for the AI Act \u2014 Edupedu, August 11, 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.stiripesurse.ro\/romanian-companies-mostly-unaware-of-ai-chatbot-transparency-obligations-according-to-law-firm_3918296\" target=\"_blank\" rel=\"noopener\">Buju Stanciu &amp; Associates Study on Transparency Obligations \u2014 \u0218tiripesurse, September 2026<\/a><\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>Starting August 2, 2026, the AI Act requires companies to notify visitors that they are speaking with an AI chatbot. What the law requires, what has been postponed, and 7 steps to compliance.<\/p>","protected":false},"author":1,"featured_media":8898,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":10,"footnotes":""},"categories":[124],"tags":[],"class_list":["post-21315","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-gdpr-si-date"],"_links":{"self":[{"href":"https:\/\/intellogic.ai\/en\/wp-json\/wp\/v2\/posts\/21315","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/intellogic.ai\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/intellogic.ai\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/intellogic.ai\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/intellogic.ai\/en\/wp-json\/wp\/v2\/comments?post=21315"}],"version-history":[{"count":0,"href":"https:\/\/intellogic.ai\/en\/wp-json\/wp\/v2\/posts\/21315\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/intellogic.ai\/en\/wp-json\/wp\/v2\/media\/8898"}],"wp:attachment":[{"href":"https:\/\/intellogic.ai\/en\/wp-json\/wp\/v2\/media?parent=21315"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/intellogic.ai\/en\/wp-json\/wp\/v2\/categories?post=21315"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/intellogic.ai\/en\/wp-json\/wp\/v2\/tags?post=21315"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}