How it can be done fairly.

Features / Web, iOS, Android

Website chatbot

The window in the bottom right corner that answers customers. Since August 2026 it has to introduce itself as AI, and people type more personal data into it than you think.

Laws
5 laws
Platforms
Web, iOS, Android
Updated
Status
Draft, awaiting review by the attorney

What to solve

  • People must see in the very first message that they are not writing to a person. This applies from August 2026, also to chatbots built on someone else’s model.

    • Say it in words in the first message, not only with an icon
    • Do not give the bot a human name and photo
    • For a voice bot, say it in the first sentence

    Into UX: An AI label in the header gets missed. A sentence in the first bubble is more reliable.

    Where it comes from

    Artificial Intelligence Act (EU) 2024/1689 as amended by the AI Omnibus (EU) 2026/1744, Art. 50(1), Commission guidelines of 20 July 2026

    People must know at the latest at the first interaction that they are talking to AI, unless it is obvious from the circumstances. It applies from 2 August 2026. The obligation is on the provider, which includes a company that builds the chatbot on someone else’s model and puts it into service under its own name.

    EU regulation · Text · All features under this law

  • People type names, addresses and health problems into a chat even when you do not ask. You need to know where conversations are kept, for how long and who reads them.

    • Decide whether and how long you store conversations
    • Check where the model provider sends the data and whether it trains on it
    • Warn at the input field not to type sensitive data

    Into UX: The warning belongs at the field where people type, not in a privacy policy.

    Where it comes from

    General Data Protection Regulation (EU) 2016/679, Art. 5, 6, 9, 13, 28 and 35

    People type names, addresses, order numbers and health problems into a chat, even when you do not ask for them. In 2026 a court in Cologne treated data typed into a chatbot as a special category under Art. 9. You need a legal basis, information for users, a contract with the model provider and a decision on how long you keep conversations.

    EU regulation · Text · All features under this law · In Czechia: Czech Act No. 110/2019 Coll., on the processing of personal data

  • Chat widgets often store identifiers in the browser as soon as the page loads. For anything the chat does not strictly need, you want consent, as with cookies.

    • Load the script only after a click on the chat icon
    • Check in the network panel what the widget sends
    Where it comes from

    ePrivacy Directive 2002/58/EC, Art. 5(3) ePrivacy Directive (s. 89(3) of the Czech Electronic Communications Act)

    A vendor’s widget often stores identifiers in the browser as soon as the page loads, even if nobody opens it. What is not needed for the chat itself needs consent like any other cookie.

    EU directive · Text · All features under this law · In Czechia: Czech Electronic Communications Act No. 127/2005 Coll. (s. 89(3), cookies) and Act No. 480/2004 Coll. (s. 7, commercial communications)

  • What the chatbot says about prices, deadlines or complaints counts as if you said it. If it makes up a discount, you may have to honour it.

    • Take prices and terms from your own pages and link to them
    • Do not let the bot promise discounts or exceptions
    Where it comes from

    Unfair Commercial Practices Directive 2005/29/EC, misleading practices

    What the chatbot says about prices, availability or customer rights, the company said. A wrong answer is judged like any other information on the website. In the Canadian case Moffatt v. Air Canada the airline had to pay the customer the difference under a policy its chatbot made up.

    EU directive · Text · All features under this law · In Czechia: Czech Consumer Protection Act No. 634/1992 Coll.

  • In an online shop and other consumer services the chat must work with a keyboard and a screen reader.

    • Focus moves into the window and out, Esc closes it
    • Announce new messages to screen readers
    Where it comes from

    European Accessibility Act, Directive (EU) 2019/882, European Accessibility Act

    When the chatbot is part of an online shop, a banking service or another service covered by the European Accessibility Act, it must work with a keyboard and a screen reader.

    EU directive · Text · All features under this law · In Czechia: Czech Act No. 424/2023 Coll., on accessibility requirements for certain products and services

What the problem is

A chatbot looks like a few lines of script. In fact you talk to people through a machine, collect what they write and are liable for the answers as if you had written them yourself.

How to design it

The first message says who is talking: “I’m an AI assistant, not a person.” Under the field a short line says what not to type. The bot does not retell prices and terms in its own words, it links to the page where they apply. And it has a clear way out: a button to e-mail or phone when it cannot help.

In the code

The widget loads only after a click on the icon. What the bot must not do is enforced in code, not in the prompt: an allowlist of links, no tools without permissions, a spending cap. Conversations have a retention period and access rights like any database with personal data.

Before you ship it

  • The first message says it is AI.
  • The field warns about sensitive data.
  • You know where conversations go and how long they stay there.
  • The widget starts nothing until it is opened.
  • The bot takes prices and terms from your own texts.
  • The window works with a keyboard.

More features

Features
Toadvokat@navratilkarel.com