Does the EU AI Act apply to my AI app or chatbot?

Key points

• Where your company is based does not decide it: the Act reaches providers and deployers outside the EU when their AI system’s output is used in the EU.
• The bans on prohibited practices have applied since 2 February 2025, and the rules for general-purpose AI model providers since 2 August 2025.
• Since 2 August 2026, a chatbot must tell people they are interacting with an AI, unless that is obvious.
• Generated images, audio, video and text must carry machine-readable marks; systems already on the market before 2 August 2026 have until 2 December 2026.
• The 2026 Digital Omnibus moved the high-risk rules to 2 December 2027 for Annex III uses and 2 August 2028 for AI in regulated products.
• This is not legal advice. If your product touches hiring, credit, education or another high-risk use, involve a lawyer early.

Who the AI Act applies to

The AI Act is Regulation (EU) 2024/1689. It entered into force on 1 August 2024 and applies in stages. It sorts the companies it covers into roles, and two of them matter most for a startup.

• Provider: whoever develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether it charges for it or gives it away.
• Deployer: whoever uses an AI system under its authority, except for personal, non-professional use.

Article 2 says the Act applies to providers that place AI systems on the EU market whether or not they are established in the EU, and to providers and deployers in other countries where the output of the AI system is used in the EU. A startup in India, the US or Brazil with users in the EU is in scope for those users.

If you build a chatbot on another company’s model and offer it under your own name, you are generally the provider of your chatbot, and the model company is the provider of the model. If you also use the chatbot in your own business, you can be its deployer as well.

The risk tiers in plain words

The European Commission says the vast majority of AI systems used in the EU fall into the minimal-risk group. A typical chatbot or AI feature sits in the transparency tier, unless it is used for one of the high-risk purposes listed in Annex III of the Act.

What already applies

• Prohibited practices, since 2 February 2025. The Commission lists eight bans in force from that date. A ninth, added in 2026, bans AI systems that generate non-consensual sexually explicit images of real people or child sexual abuse material, and applies from 2 December 2026.
• AI literacy, since 2 February 2025. Providers and deployers must take measures on the AI literacy of their staff and of others who operate AI on their behalf. The 2026 amendment softened the wording: it now asks you to take measures to support that literacy, and says you do not have to guarantee any specific level for any individual.
• General-purpose AI model rules, since 2 August 2025. These cover the companies that place general-purpose models on the market, with duties on documentation, transparency and copyright, and more for models with systemic risk. Calling another company’s model through an API does not by itself make you the provider of that model.
• The Article 50 transparency duties, since 2 August 2026. These are the ones most chatbots and AI features need to meet, and they are covered next.

The Article 50 transparency duties

The information must be clear and distinguishable, given at the latest at the first interaction or exposure, and it must meet accessibility requirements. The Commission adds that a deployer cannot rely on the provider’s machine-readable mark alone to disclose a deepfake: people must be able to see or hear the label without special tools.

The Commission has published guidelines on Article 50 and a Code of Practice on Transparency of AI-generated Content. Signing the code is voluntary. Providers and deployers who do not sign it must show they meet the marking and labeling duties by other adequate means.

What moved later: the 2026 Digital Omnibus

In July 2026 the EU adopted Regulation (EU) 2026/1744, the Digital Omnibus on AI, which amends the AI Act. It was published in the Official Journal on 24 July 2026. Its recitals give delayed standards and delayed national authorities as the reasons for moving the high-risk deadlines.

What did not move: the other Article 50 duties, including telling people they are talking to an AI, have applied since 2 August 2026, and the earlier bans and general-purpose AI rules still apply. If an older article gives 2 August 2026 for the high-risk rules, it predates the amendment; the official text now says 2 December 2027 and 2 August 2028.

The amendment also extends some of the lighter treatment for small and medium-sized companies to small mid-cap companies, including the lower cap on fines.

A practical checklist for a chatbot or AI feature

1. Write down your role for each AI feature: provider, deployer or both, and which model or vendor sits underneath it.
2. Check each use against the prohibited practices and the high-risk list in Annex III. If the AI helps decide who gets hired, admitted, insured or given credit, get legal advice before launch.
3. Tell people at the start of every chat or voice conversation that they are talking to an AI, unless it is truly obvious. A plain line in the first message, such as “You’re chatting with an AI assistant,” is simple and accessible.
4. If the feature generates images, audio, video or text for users, find out how that content is marked in a machine-readable way: by your model vendor, by you, or both. The Commission guidelines explain what counts as standard editing and is exempt.
5. If you publish generated images, video or audio that look like real people or events, or AI-written text that informs the public on matters of public interest, add a visible label.
6. Give the people who build, run or review the AI feature basic training on how it works and where it fails, and keep a record of it.
7. Document each AI feature: what it does, which model it uses, what instructions it is given and what it logs. That record answers most questions a customer or a regulator will ask.
8. Check the Commission’s AI Act pages before launch. The dates and guidance changed in 2026 and may change again.

For the product side of a chatbot, see Adding an AI chatbot to your website. If your AI takes actions as well as answering, the controls in How to stop an AI agent from doing damage also give you the logging and human oversight the Act expects of high-risk systems.

Penalties, and what this guide is not

• Using a prohibited practice: fines of up to 35 million euros or 7 percent of total worldwide annual turnover for the preceding financial year, whichever is higher.
• Breaking most other obligations, including the Article 50 transparency duties: up to 15 million euros or 3 percent, whichever is higher.
• Giving incorrect, incomplete or misleading information to authorities: up to 7.5 million euros or 1 percent, whichever is higher.
• For small and medium-sized companies, including start-ups, each cap is whichever of the two amounts is lower. The 2026 amendment extends this to small mid-cap companies.

National market surveillance authorities enforce most of the Article 50 rules. The Commission’s AI Office is responsible for AI systems built on a general-purpose model when the same company provides both, and for systems built into the largest online platforms and search engines.

This guide is general information, written on 25 October 2026 from the official texts listed below. It is not legal advice, and it does not cover every obligation in the Act. For a decision about your product, talk to a lawyer who works with EU technology law.

BYD Tech builds AI features and agents, including AI disclosures and logging, as part of AI agent development. We do not give legal or compliance advice.