AI chatbots on ecommerce stores: compliance requirements under the EU AI Act

AI-powered customer service chatbots are now standard on mid-market ecommerce stores. Gorgias, Tidio, Intercom, Zendesk and purpose-built AI shopping assistants handle everything from order tracking queries to product recommendations. Most were deployed without any consideration of the EU AI Act, which entered into force in August 2024 and established specific transparency requirements for AI systems that interact with humans.

The compliance gap is significant. The EU AI Act's transparency requirements for chatbots are not technically demanding, but they are widely ignored. Stores with EU customers that deploy AI chatbots without disclosure are already in breach.

What the EU AI Act Article 50 requires

Article 50 of the EU AI Act establishes transparency obligations for certain AI systems. For chatbots and AI customer interaction systems, the key obligation is in Article 50(1):

Providers of AI systems intended to interact directly with natural persons must ensure that the natural persons are informed that they are interacting with an AI system, unless this is obvious from the context. The disclosure must be made in a clear and distinguishable manner at the latest at the beginning of the first interaction.

This requirement is direct and absolute. If you deploy an AI chatbot that converses with customers in natural language, you must tell them they are talking to an AI before the conversation begins or at the very start of the first message. You cannot wait until they ask.

The "unless obvious from the context" exception is narrow. A customer service chatbot that appears in a chat window with a human name and avatar is not obviously an AI. The fact that chatbots exist generally is not sufficient to make it obvious that this specific interaction is with an AI. Default to disclosure.

Which chatbots are covered

The AI Act's chatbot disclosure requirement applies to AI systems intended to interact directly with natural persons. For ecommerce stores, this covers:

• Customer service chatbots. Any AI-powered chat window that responds to customer queries in natural language. This includes Tidio AI, Gorgias AI, Intercom Fin, Zendesk AI agents and similar products.
• Shopping assistants. AI systems that help customers find products, compare options or make purchase decisions through conversational interfaces. These are increasingly deployed by larger retailers and technology platforms.
• Size and fit recommendation tools. AI tools that ask customers questions and provide personalized recommendations through a conversational interface (e.g., "What is your height and build?").
• Order tracking bots. Automated systems that respond to "where is my order?" queries using natural language responses, even if rule-based, may be covered depending on their AI classification.
• Voice assistants. Voice-based customer service tools that use AI for speech recognition and response generation.

Simple rule-based chatbots that follow decision trees without AI language generation occupy a gray area. The EU AI Act's definition of an AI system requires that it be "machine-based" and "generate outputs such as predictions, content, recommendations or decisions." A pure decision tree with no machine learning component may not qualify as an AI system under the Act's definition. When in doubt, disclosure is safer.

Risk classification for ecommerce chatbots

The EU AI Act classifies AI systems by risk level, with different requirements for each tier. For a full breakdown, see our guide on EU AI Act risk categories for ecommerce. Most ecommerce chatbots fall into the "limited risk" category, which carries the transparency obligations of Article 50 but not the stringent conformity assessment requirements of high-risk systems.

High-risk AI systems under the Act include those used in employment and workers management, critical infrastructure, essential services, biometric identification and certain law enforcement contexts. Standard customer service and shopping assistant chatbots do not fall into high-risk categories.

However, an AI system that influences financial decisions, assesses creditworthiness or makes decisions with significant impact on consumers may be classified differently. A chatbot that decides whether to issue a discount or approve a payment plan based on AI assessment of the customer is closer to the high-risk boundary than a simple FAQ bot.

For typical ecommerce customer service and shopping assistant chatbots: limited risk classification applies, and Article 50 transparency requirements are the primary compliance obligation.

Timeline for compliance

The EU AI Act was published in the Official Journal on July 12, 2024 and entered into force on August 1, 2024. Its provisions apply at different times:

• Prohibited AI practices (Article 5): February 2, 2025
• GPAI model obligations and governance (Articles 51-68 and 71-93): August 2, 2025
• High-risk system obligations and transparency obligations including Article 50: August 2, 2026
• High-risk systems in Annex I (existing product safety legislation): August 2, 2027

Article 50's chatbot transparency requirements became applicable on August 2, 2026. Ecommerce stores deploying AI chatbots for EU customers without disclosure have been in breach since that date.

What the disclosure must say

The AI Act does not prescribe specific language for the disclosure. It requires that the disclosure be clear and distinguishable. In practice, this means:

• The user must be able to understand, without ambiguity, that they are interacting with an AI system rather than a human.
• The disclosure must appear before or at the start of the interaction, not buried in terms of service or accessible only through a help link.
• The disclosure must be distinguishable from the conversational content. It cannot be hidden in small text or obscured by design.

Acceptable disclosure approaches:

• A header or label on the chat widget reading "AI Assistant" or "Automated Support"
• An opening message from the chatbot that explicitly states it is an AI: "Hi, I am an AI assistant. How can I help you today?"
• A persistent indicator visible throughout the conversation showing AI status

Unacceptable approaches:

• Naming the bot with a human name (Sophie, Alex) with no AI disclosure
• Disclosing in the privacy policy but not in the chat interface itself
• Waiting for the user to ask "am I talking to a bot?" before disclosing
• Small-print disclosure below the chat window that most users will not read

Chatbot data collection and GDPR

AI chatbots on ecommerce stores create GDPR obligations beyond the AI Act transparency requirements. Chatbots typically collect:

• Customer name and contact information provided during the conversation
• Order numbers and transaction details
• The full text of the conversation, which may include personal information shared by the customer
• Device and session identifiers used to link conversations across sessions
• In some cases, the conversation is used to train or improve the AI model

Each of these creates GDPR obligations. Conversation data requires a lawful basis (typically legitimate interests or contract performance for customer service). If conversation data is used to train AI models, separate consent is likely required. The use of conversation data for AI training must be disclosed in the privacy policy.

Under GDPR data minimization principles, chatbots should only collect personal information necessary for the service. A chatbot that automatically requests name, email and order number before the customer explains their issue is likely over-collecting.

Data retention for chatbot conversations should be defined. Support conversations typically warrant retention for the duration of the customer relationship plus a reasonable follow-up period. Indefinite retention of all chatbot conversations is not compatible with GDPR storage limitation requirements.

Accessibility of chatbot interfaces

WCAG 2.1 AA accessibility requirements apply to chat interfaces on ecommerce stores. Common accessibility failures in chatbot interfaces:

• Focus management. When the chat window opens, keyboard focus must move to the window. When it closes, focus must return to the triggering element. Many chat widgets fail this requirement.
• Screen reader compatibility. Chat messages must be announced to screen reader users as they appear. ARIA live regions (aria-live="polite") should be used to announce new messages without interrupting the user's current activity.
• Keyboard navigation. All chat functions must be usable without a mouse. Opening and closing the chat, sending messages, navigating message history and accessing any buttons in the chat interface must be keyboard accessible.
• Color contrast. Text in chat interfaces must meet WCAG 4.5:1 contrast ratio for normal text and 3:1 for large text. Chat bubble designs often fail this, particularly light gray text on white backgrounds.
• Timeout warnings. If the chat session times out, users must be warned before timeout with enough time to respond. This is particularly important for screen reader users who may take longer to interact.

The European Accessibility Act, which has been enforceable since June 2025, requires that digital services including ecommerce are accessible. Chat interfaces are in scope.

Penalties for non-disclosure

The EU AI Act establishes a tiered fine structure. For violations of Article 50's transparency obligations, which fall under Article 99(3), fines can reach 15 million euros or 3% of worldwide annual turnover, whichever is higher.

For a mid-market ecommerce store with $20 million in annual revenue, 3% is $600,000. This is a material fine for a disclosure that costs essentially nothing to implement.

Enforcement authority rests with national market surveillance authorities designated by each EU member state. Early enforcement is expected to focus on egregious cases, particularly where AI systems are clearly trying to deceive users into believing they are interacting with a human. Ecommerce chatbots named after humans with no AI disclosure are a likely early enforcement target.

The Act also allows consumers to bring complaints to national authorities. A customer who feels they were deceived into believing they spoke with a human representative when they actually spoke with an AI has standing to file a complaint. Given the volume of ecommerce customer interactions with chatbots, complaints are inevitable.

Implementation checklist for ecommerce stores

• Inventory your chatbot deployments. Identify every chat widget or conversational AI tool on your store, including on product pages, checkout and post-purchase flows.
• Classify each as AI or rule-based. If the tool uses a large language model or machine learning to generate responses, it is an AI system subject to Article 50.
• Add disclosure to every AI chatbot interface. Update the chatbot configuration to include an explicit AI disclosure in the interface header or opening message. Do this for every page where the chatbot appears.
• Update your privacy policy. Add a section describing your use of AI chatbots, what data they collect, how long it is retained and whether it is used for AI training. See our ecommerce privacy policy guide for what to include.
• Review chatbot accessibility. Test the chat interface with a keyboard only and with a screen reader. Address focus management, ARIA announcements and color contrast issues.
• Check vendor AI Act compliance documentation. Ask your chatbot vendor whether their product includes Article 50 compliance features. Major vendors have updated their products to include AI disclosure options. Ensure these are enabled in your configuration.
• For non-EU stores: review US state AI disclosure trends. California and Colorado have introduced AI transparency requirements. Federal AI legislation is progressing. Building AI disclosure into your chatbot now positions you for emerging US requirements. The same transparency principles apply to AI-powered product recommendations and to AI-generated content disclosure.

Frequently asked questions

Do ecommerce chatbots need to disclose they are AI?

Yes. Under EU AI Act Article 50, any AI system that interacts directly with consumers must inform them they are communicating with an AI. The disclosure must happen at the start of the first interaction, not buried in terms of service.

What is the fine for not disclosing an AI chatbot?

Fines for violating Article 50 transparency obligations can reach 15 million euros or 3% of worldwide annual turnover. For a mid-market store with $20 million revenue, that is $600,000.

Are rule-based chatbots covered by the EU AI Act?

Pure decision-tree chatbots without machine learning may not qualify as AI systems under the Act. However, any chatbot using a large language model or machine learning to generate responses is covered. When in doubt, disclosure is safer.

When did the AI chatbot disclosure requirement start?

Article 50 chatbot transparency requirements became applicable on August 2, 2026. Ecommerce stores deploying AI chatbots for EU customers without disclosure have been in breach since that date.