EU AI Act Chatbot Rules for WooCommerce Stores: A Practical Checklist

If your WooCommerce store runs an AI chatbot that EU visitors talk to, it must tell them they are interacting with AI, clearly and at the start of the conversation. This rule is in Article 50 of the EU AI Act and has applied since 2 August 2026. The Digital Omnibus did not postpone it.

Below is what the rule says, which store features it covers, how to word and place the disclosure, how it fits with GDPR, and a checklist you can hand to your developer.

What does Article 50 of the AI Act require for chatbots?

Article 50(1) of the AI Act (Regulation (EU) 2024/1689) says providers must ensure that AI systems intended to interact directly with people are designed so that "the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect."

Article 50(5) adds how: the information must be given "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure" and must "conform to the applicable accessibility requirements."

Under Article 113, the AI Act generally applies from 2 August 2026, and the Commission's Article 50 FAQ confirms that "Article 50 of the AI Act applies as from 2 August 2026."

Did the Digital Omnibus delay the chatbot rule?

No. The Digital Omnibus on AI was published as Regulation (EU) 2026/1744 in the Official Journal on 24 July 2026. It delays several high-risk obligations to December 2027 and August 2028, but it does not change Article 50(1).

The only Article 50 relief is narrow. Providers of AI systems that generate synthetic audio, image, video or text and that were placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking rule in Article 50(2). That is about watermarking generated content, not about telling shoppers they are talking to a bot.

Is my store the "provider" or the "deployer"?

Article 50(1) puts the duty on the provider, the party that builds the system and places it on the market or puts it into service "under its own name or trademark". In practice this splits into two cases.

• You use a chatbot product from a vendor (a SaaS widget or plugin). The vendor is normally the provider and should build the disclosure into the product. You are the deployer. Check that the widget shows a disclosure by default and that your customisation does not remove or hide it.
• You build your own assistant, or have an agency build one, and run it on your store under your brand. The Commission's guidelines on Article 50, published on 20 July 2026, give exactly this example: a company that develops a chatbot in-house and puts it into service for its own use under its own name is a provider. The same applies when you take an existing system, modify it, and put it into service under your name.

Either way, the customer sees your store. If the disclosure is missing, the complaint will reach you first, so treat it as your job to check.

Which WooCommerce features count?

The guidelines list "chatbots/conversational agents" in contexts including customer support and e-commerce as in scope. They also list, as falling outside Article 50(1), recommender systems, translation tools, and "AI-enabled search and retrieval of information without generating or modifying content".

Can you rely on the "obvious" exception? Rarely. The Commission says it should be interpreted restrictively, and the guidelines give "AI chatbots embedded in online platforms or assistance support tools (helpdesks)" as an example where the exception does not apply. A store chatbot with a human first name and a friendly avatar is the opposite of obvious.

How should the disclosure look?

The guidelines give concrete examples. Good techniques include "prominent, plain-language labels or banners (e.g. 'You are interacting with an AI system') and first-turn greetings in chatbots", which can be combined with persistent badges or labels during the conversation. They recommend placing disclosures "close to the interaction interface (e.g. near the input/output field)."

They also list what is not enough on its own:

• a disclosure only in your terms and conditions or privacy policy
• metadata or watermarks the user cannot see
• vague labels such as a generic "assistant", or human-like representations that may mislead
• a site-wide line such as "Services on this website use AI"
• technical wording such as "this system uses LLMs" without saying the user is talking to AI

A single prominent notice before the first interaction "is likely to suffice in most instances", according to the guidelines. They expect more, such as reminders, where users are vulnerable, for example children or elderly people.

A practical pattern for a WooCommerce chat widget:

1. The launcher button carries a visible "AI" label.
2. The chat opens with a first message such as: "Hi, I'm the store's AI assistant. I can answer questions about products, delivery and orders. You can ask for a person at any time."
3. A short line under the input field stays visible: "AI assistant. Answers may contain mistakes."
4. The bot's name and avatar do not suggest a real employee.
5. Handoff to a human is clearly marked, so the customer knows when a person takes over.

Write the disclosure in every language your store sells in. It must work for screen reader users too, so the label should be real text, announced when the chat opens, not only an icon.

How does this fit with GDPR?

The AI Act disclosure does not replace your GDPR obligations. A chatbot usually processes personal data: names, email addresses, order numbers, and anything customers type into the box.

• Processor agreements. GDPR Article 28 requires a contract with every processor. That includes the chatbot vendor and, for custom builds, the AI model provider.
• Privacy notice. Update it to cover the chatbot: what is collected, why, which providers receive it, and how long transcripts are kept.
• Data minimisation. Send the model only what it needs. An order status question needs the order status, not the customer's full history.
• Data location. Check where data is processed. For example, OpenAI offers European data residency for eligible API customers, on new projects only.
• Retention. Set a retention period for chat logs and make sure logs are not kept forever by default.

What are the fines?

Article 99(4) of the AI Act sets fines of up to EUR 15 million or, for a company, up to 3% of total worldwide annual turnover, whichever is higher, for breaches of the Article 50 transparency obligations. For SMEs and start-ups, Article 99(6) applies whichever of the two amounts is lower. Enforcement is by national market surveillance authorities.

For a typical store, the realistic risk is a complaint or an authority request, followed by an order to fix. The fix is usually cheap. It makes sense to do it now rather than under a deadline.

Checklist for WooCommerce stores

• List every place where AI talks directly to customers: chat widget, email bot, WhatsApp or Messenger integrations.
• For each, decide whether you are provider (custom build) or deployer (vendor product).
• Check the vendor's disclosure is on and visible. Ask the vendor in writing how they comply with Article 50(1).
• Add a first-message disclosure in plain language, in every store language.
• Add a persistent "AI" label near the input field.
• Remove human names or photos that suggest a real person.
• Mark the handoff to a human clearly.
• Test the disclosure with a keyboard and a screen reader.
• Sign processor agreements with the vendor and model provider.
• Update your privacy notice and set chat log retention.
• Keep a short internal record of what you changed and when.

When to get help

If you use a vendor chatbot, most of this checklist is configuration and paperwork. If you run or plan a custom assistant, disclosure, data handling and accessibility need to be designed into it. Our AI shopping assistant service builds these in from the start, and our EU compliance review (from $1,500) checks your wider store against EU rules. This article is practical guidance, not legal advice.