An AI chatbot for your website in 2026: what to know and what the AI Act requires
Since 2 August 2026, under Article 50 of the EU AI Act, people must be told clearly, at the latest at the first interaction, that they are talking to an AI, unless that is obvious.1 The Digital Omnibus, in force since 27 July 2026, moved other AI Act deadlines but not this one.2 The second question is where customer data goes: OpenAI offers EU data residency on approval, Anthropic's own API lists no EU region, and Gemini's paid API does not use your prompts to improve Google's products.345 This guide is a summary, not legal advice. It is written by Tamás Nagy, founder of nstudio.
What a good small business chatbot does.
- Answers routine questions from your own content, such as opening hours, delivery, returns and product details, and shows where each answer came from.
- Says it is an AI in its first message.
- Hands over to a person when a question is unusual, a complaint, or needs a decision.
- Doesn't guess. If the answer isn't in your content, it says so and offers a way to reach you.
- Acts only with the permissions you give it. A chatbot that only answers needs no access to orders or payments at all.
What the AI Act requires, in plain words.
Article 50(1): AI systems that interact with people must make sure people are informed that they are interacting with an AI system, unless that is obvious to a reasonably well-informed person. Article 50(5): the information must be given in a clear and distinguishable manner, at the latest at the time of the first interaction, and it must meet accessibility requirements.1
Article 50(4) adds a separate duty: AI-generated text published to inform the public on matters of public interest must be disclosed, unless a person reviewed it and took editorial responsibility.1 The European Commission published draft guidelines on Article 50 on 8 May 2026.6
What the Digital Omnibus moved, and what it didn't.
- In force since 27 July 2026, after publication in the Official Journal on 24 July 2026.2
- Moved: high-risk systems listed in Annex III, from 2 August 2026 to 2 December 2027; high-risk systems built into products (Annex I), to 2 August 2028.2
- Not moved: the Article 50 duties, including telling users they are interacting with an AI, still apply from 2 August 2026.2
- Machine-readable marking of AI-generated content (Article 50(2)): 2 December 2026 for systems already on the market before 2 August 2026.2
- AI literacy (Article 4), softened: organisations must take measures to support staff literacy, with no required level for each person.2
Where the data goes: OpenAI, Anthropic and Gemini.
| Provider | Training on your data | Retention and terms | EU processing |
|---|---|---|---|
| OpenAI API73 | Not used unless you opt in (since 1 March 2023) | Abuse-monitoring logs kept up to 30 days by default; zero data retention needs OpenAI's prior approval | EU data residency (EEA and Switzerland), set per project via eu.api.openai.com; requires modified abuse monitoring or zero data retention |
| Anthropic API489 | Commercial data not used by default | Inputs and outputs deleted within 30 days, with exceptions such as a zero data retention agreement | First-party API: "global" or "us" only, no EU option listed; EU regions through AWS Bedrock or Google Cloud |
| Gemini API5 | Paid tier: not used to improve Google's products. Unpaid tier: may be used, and human reviewers may read it | Paid tier processed under Google's Data Processing Addendum | Apps offered to users in the EEA, Switzerland or the UK must use the paid services |
Gemini's terms say not to submit sensitive, confidential or personal information to the unpaid services.5 For a chatbot that sees customer data, our written plan names the provider, the region and the retention, so your privacy notice can say the same.
Hungarian firms and AI: the main barrier is expertise.
In 2025, 10.37% of Hungarian enterprises with 10 or more employees used AI, against 19.95% across the EU, according to Eurostat data cited by the Bulgarian Chamber of Commerce and Industry.10 Among Hungarian firms that planned to use AI in 2025 but did not go ahead, 66% cited a lack of expertise, 52% data protection and confidentiality concerns, 51% unclear legal consequences and 43% high expected costs, in KSH figures reported by HVG.11
Two of those four barriers, data protection and legal uncertainty, are what this guide covers.
Letting an AI act in your systems, with limited permissions.
MCP (Model Context Protocol) is an open standard for connecting AI applications to external systems.12 Anthropic donated it to the Linux Foundation's Agentic AI Foundation on 9 December 2025, and ChatGPT, Cursor, Gemini, Microsoft Copilot and VS Code support it.13 WooCommerce has native MCP support in developer preview: an AI client can query and update products, query orders, update order status and add order notes, acting with the permissions of the connected WordPress user.14
That gives a simple safety rule for a chatbot that does more than talk: connect it as a user with only the permissions it needs.
How we set up a chatbot.
- AI disclosure in the first message, so the Article 50 notice is there from the first interaction.
- A hand-off rule: which questions go to a person, and where you see them.
- Answers from your own content, with the source shown.
- Provider, region and retention set in the written plan, with the AI account in your name and usage billed to you directly.
Want an AI to edit your website, not just answer on it? AI website editing
We set up chatbots and AI agents that say they are an AI, answer from your content and hand over to a person.
Automation and AI