Chatbot and the EU AI Act: what to check before 28 October 2026

Since 2 August 2026, a chatbot that talks to customers has to be designed so that the person knows they are writing with AI, unless that is obvious. The duty falls formally on the provider of the system, but the provider can also be a company that commissioned the bot and put it into service under its own name. From 28 October 2026, Poland has rules on complaints, inspections and fines in force.

It is easy to assume that, because an outside contractor built the bot, the AI Act is their problem. Sometimes it is. Sometimes it is not, because the definition of a provider also covers whoever commissions an AI system and puts it into service under their own name. Below are five checks: the notice in the first message, who the provider is, a list of AI systems, a path to a person with logs, and generated content. You can do them before someone else asks.

What we see in the market: three dates and one ceiling on fines

The Polish act comes into force in stages (28 July, 11 August and 28 October 2026), and the AI Act has dates of its own. We collected them from EU and Polish sources.

• 2 August 2026. Transparency duties in Article 50 of the AI Act, including telling people that the other party is AI.
• 11 August 2026. The main part of the Polish Act on Artificial Intelligence Systems, including the provisions on how KRiBSI is set up.
• 28 October 2026. Inspections, proceedings, complaints, individual opinions and administrative fines.
• November 2026 at the earliest. KRiBSI actually starts work.
• 2 December 2026. Marking of generated content for systems placed on the market before 2 August 2026, Article 50(2).

KRiBSI is the Polish commission for AI development and safety (our translation of the name). On 31 July 2026 the European Commission stated that from 2 August chatbots and other interactive AI systems must tell users they are talking to AI and not to a person. A breach of Article 50 can be fined up to 15 million euro or 3 percent of total worldwide annual turnover, and for small and medium-sized companies the lower of the two applies. That is a ceiling, not a rate.

Two things are easy to miss. First, Article 50(1) speaks of providers, not of every company that has a chat window on its site. Second, according to the Polish press KRiBSI will start work in November at the earliest, so 28 October is the date of the rules, not of the first inspection.

Five checks of a chatbot

Article 50(1) covers AI systems intended to interact directly with people, so it covers a plain chat built on a language model as well as an agent. How the two differ, we described in Corporate chatbot or AI agent - which to choose?.

1. The notice in the first message. Article 50(5) requires the information to be given in a clear and distinguishable way, at the latest at the first interaction, and to meet accessibility requirements. A concrete trap: the notice sits in the terms or the footer, while in the chat window the bot is signed with a human name and a human photo. For an ordinary customer chat, paragraph 1 lifts the duty only when it is obvious to a reasonably well-informed, observant and circumspect person, and with a human name and photo it is hard to say that it is obvious.

2. Who the provider is. If you bought a finished product, the provider is the manufacturer, and you should have in writing how it meets Article 50(1). If you commissioned a bot and it runs under your name, you may be the provider. Ask the builder before you sign, and that includes us, and leave the final call to a lawyer.

3. A list of AI systems in the company. What runs, for what, on what data, and who answers for it. This is not a separate duty for a chatbot but a practice that lets you answer a letter without hunting for what is actually running in the company. The law firm Sobota Jachira points out that after 28 October AI documentation becomes evidence in inspections.

4. A path to a person, and logs. When a customer complains, someone has to show what the bot said and when the case reached a person. We describe it in our texts on handing a conversation to a person in customer service and on hallucinations and AI agents: logs have to exist, somebody has to read them, and reading them has to be in someone’s job description. That is practice, not a provision. The oversight modes and the hours they take are in Human in the loop AI: when a person approves and when they only watch.

5. Generated content. Article 50(2) requires providers to mark generated content in a machine-readable format, and Regulation 2026/1744 gives systems placed on the market before 2 August 2026 until 2 December 2026. The Commission also announces that deepfake-type content will have to be labelled. If you only use a bought tool for texts and images, ask the provider how it meets this duty. The same question applies to background agents that can write in your name, like OpenAI dots. Their availability in Europe is covered in OpenAI dots in Europe: who can turn them on and what to set first.

What this text does not settle

We do not know whether your bot falls under the exception “obvious to the other party.” We do not know which role an authority would assign to you in your deployment. We know the Polish act from law firm commentary and from the press, not from reading the whole text, so for the details of the complaint procedure we send you to the act itself and to a lawyer.

What this means for your company

Probable conclusion. The nearest risk is a customer complaint, not an inspection. KRiBSI will start work in November at the earliest, and the fines are ceilings. The five checks are mostly questions to your builder and your lawyer, plus one list of systems.

Probable conclusion. The AI literacy duty in Article 4 is weaker after the July changes than older guides say. Regulation 2026/1744 replaced the requirement to ensure a sufficient level of AI literacy to the best of one’s ability with a duty to take measures that support its development. Do not base a training budget on the sentence that it is a hard obligation. Training makes sense for another reason, which you can check at home: who pastes what data into AI tools today.

Hypothesis to test. The Polish complaint rules may start to generate letters faster than KRiBSI can settle its practice. For now this is a prediction, not an observation. To check once the authority’s first communications appear.

What happens when you contact us

You talk to a person who knows your deployment from the inside. The call lasts 45 minutes, and at the end you get a concrete idea and a price range. If your bot only needs a notice added to the first message, we will say so plainly. We build with you, not for you: the list of AI systems and the path to a person we write together with the person who answers for them.

If you want to see the whole picture, we run a two-week AI audit with scope and price agreed before we start. We check every recommendation against GDPR and the AI Act, and you get the report even when the conclusion is “don’t deploy this.” An agent built around your own process is covered by our AI agents service. We don’t leave you with a finished product. We stay when you use it.

We are not a law firm, this text is not legal advice, and we do not issue certificates of compliance with the AI Act. A lawyer classifies your system. Book a 45-minute call.

Sources

All pages accessed on 5 October 2026.

• Act of 3 July 2026 on Artificial Intelligence Systems (Poland), Dz. U. 2026 item 1003, according to the act’s record on INFOR. We have not read the full text.
• Regulation (EU) 2024/1689 (AI Act), Article 3(3), Article 50 and Article 99: EUR-Lex.
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), in force from 27 July 2026, Article 1(5) (Article 4) and (40) (Article 113): EUR-Lex.
• European Commission, 31 July 2026: Commission starts enforcing AI Act rules and new transparency requirements from 2 August.
• European Commission, AI Act: regulatory framework.
• Sobota Jachira law firm (Polish), Ustawa o systemach sztucznej inteligencji ogłoszona. Co zmienia dla biznesu?, dates of the later parts of the act.
• Rzeczpospolita (Polish), Ustawa o AI weszła już w życie. Od października będzie można się na nią poskarżyć.
• Strefa Biznesu (Polish), Nowy nadzór nad sztuczną inteligencją. Komisja będzie mogła nakładać kary, KRiBSI start of work in November 2026 at the earliest.
• MyCompany Polska (Polish), KRiBSI: kary dla firm od 28 października. Za co?, fine ceilings.