Your Chatbot Must Now Say It Is AI: What Changed in August
The EU AI Act transparency obligations have applied since 2 August 2026. What changes for anyone running a customer-facing bot in Spain and Portugal.
1. What changed on 2 August 2026
The EU AI Act applies in phases, and the phase that matters to anyone running a bot in front of customers began this summer. Since **2 August 2026** the transparency obligations of **Article 50** apply, and the AI Office can exercise supervisory powers. In practice, three things became enforceable: people interacting with an AI system have to know it, artificially generated content has to be identifiable, and content imitating real people has to be labelled. Fines reach **EUR 15 million or 3% of worldwide turnover**, whichever is higher. That is not a figure designed for a small business, but the regime applies regardless — and Spain’s authority, **AESIA**, was among the first in the EU to be set up. This article is not legal advice. It is an engineer’s reading of what it forces you to change in the code.
2. Your bot has to say it is a bot
This is the obligation with the widest reach, because almost any business with automated support falls under it. People interacting with an AI system have to be informed, unless it is obvious to a reasonably observant person. The difficulty is there: "obvious" is not what seems obvious to you, it is what an average customer understands. **A mistake I found on our own site** before writing this: the Portuguese version said "assistente de inteligência artificial" and the English one "AI assistant", but the **Spanish** one said only "asistente inteligente". "Intelligent" is a marketing adjective. It tells nobody they are talking to a machine. It is exactly the kind of failure that goes unnoticed: someone translates the message, picks a word that reads better, and the disclosure disappears in one language. We fixed it before publishing this. **What to do:** say "artificial intelligence" or "AI" explicitly, in the first message, in every language. Do not rely on "virtual assistant", "smart assistant" or "bot" alone — none of those informs unambiguously.
3. Where the obligation applies, and where it does not
Worth distinguishing, because not everything using AI falls under Article 50.
| Situation | Disclosure |
|---|---|
| Customer-facing chatbot | Sim, antes da interação |
| WhatsApp sales bot | Sim, na primeira mensagem |
| Synthetic voice in support | Sim |
| Published AI-generated text | Depende do uso e do contexto |
| Image or video imitating a real person | Sim, rotulagem |
| AI sorting email internally | Não é interação com o público |
| AI writing code for you | Não |
4. How to implement disclosure without hurting conversion
The usual fear is that saying "I am a bot" drives people away. In practice they work it out by the second message, and discovering it themselves costs more trust than having been told. Three rules that work: **In the first message, not in a footer.** One line before any question. Burying disclosure in the terms of service informs nobody. **In every language, with the same words.** This is where we failed. If your bot speaks three languages, the disclosure has to be explicit in all three — and reviewed by someone who speaks each. **With a way through to a human.** Article 50 does not require it, but it solves half the trust problem disclosure creates. Someone who knows they are talking to a machine wants to know how to reach a person.
// A divulgação faz parte da primeira mensagem, não de um aviso separado
// que se possa traduzir mal ou esquecer numa língua.
const boasVindas = {
pt: 'Olá! Sou o assistente de inteligência artificial da empresa. '
+ 'Posso ajudar com dúvidas sobre serviços; para falar com uma pessoa, escreva "humano".',
es: '¡Hola! Soy el asistente de inteligencia artificial de la empresa. '
+ 'Puedo resolver dudas sobre servicios; para hablar con una persona, escribe "humano".',
en: 'Hi! I am the company\'s artificial intelligence assistant. '
+ 'I can answer questions about our services; to reach a person, type "human".',
} as const;
// Verificação em testes: a divulgação não pode desaparecer numa tradução.
const TERMOS = [/intelig[êe]ncia artificial/i, /inteligencia artificial/i, /artificial intelligence/i];
for (const [lang, texto] of Object.entries(boasVindas)) {
if (!TERMOS.some((t) => t.test(texto))) {
throw new Error(`Divulgação de IA em falta na mensagem: ${lang}`);
}
}5. What this regulation is not
There is a fair amount of alarmism around this, so it is worth drawing the boundaries. **It does not ban using AI in business.** The overwhelming majority of commercial uses — classifying requests, drafting text, automating tasks — are not even treated as high risk. **It does not require expensive audits** for a support chatbot. The heavy Annex III obligations are for high-risk systems: recruitment, credit, education, critical infrastructure. A bot answering questions about opening hours is not among them. **It is not solved by a sentence in the terms of service.** That is the mistake in the other direction: complying on paper while informing nobody. For most Iberian small businesses, Article 50 compliance is half an hour of work: review the bot messages in every language, make sure they say "artificial intelligence", and add the route to a human.
6. And September’s new models? Do they change anything?
September brought releases from practically every major lab in the same week — Google, Anthropic, Amazon and Meta — including native speech models built for real-time conversation. Accenture and Google Cloud announced a unit dedicated to enterprise deployments. For anyone choosing tools, this changes less than it appears, and more than it appears. **Less:** the gap between frontier models, on ordinary business tasks — classify, extract, summarise, answer — is small today. Switching provider over half a point on a benchmark changes no outcome your customer will notice. **More:** the release cadence means any architecture tied to one specific model ages in months. Isolating the model call behind an interface of your own, so you can swap without rewriting, is worth more than picking correctly today. And native voice is the development with a direct regulatory consequence: a phone line answered by a synthetic voice falls under Article 50 exactly as a text chatbot does.
7. A half-hour checklist
If you have a bot in front of customers, walk through this today. **Does the first message say "artificial intelligence"?** Explicitly, not "virtual assistant". **Does it say so in every language the bot speaks?** Check them one by one. This is where we failed. **Is there a way to reach a person?** A clear instruction that works. **If you use a synthetic voice, do you disclose it?** The same applies as for text. **If you publish generated content, is it identifiable?** It depends on use, but when in doubt, mark it. **Does your privacy policy say data goes to the model provider?** If the bot forwards conversations to a third-party API, that is processing which has to be stated. **Do you keep conversation logs? For how long?** Decide and write it down. Customer conversations are personal data.
Frequently Asked Questions
Does this apply to a small business?
Article 50 does not distinguish by size. It applies to whoever provides or operates the system, and a chatbot on a small company website is covered. The good news is that complying costs half an hour, not an audit.
I use a third-party platform. Is the responsibility mine or theirs?
The regulation distinguishes the provider of the system from the deployer, and both carry duties. In practice, whoever puts the bot in front of their customers answers for what it says and for disclosing that it is AI. Do not assume the platform handles it.
Do I have to label text written with AI assistance?
It depends on use and context, and this is the most debated area. Synthetically generated text published as public information tends to fall under it; a draft a person rewrites and stands behind does not. When in doubt, marking it costs nothing and protects you.
Who enforces this in Spain and Portugal?
Spain set up AESIA early as its AI supervisory authority. Portugal’s supervisory arrangement has been taking shape, and it is worth checking the current position before assuming who oversees you. The European AI Office holds its own powers over general-purpose models.
Does complying reduce the bot’s conversion?
We have no data of our own to claim either way, and be sceptical of anyone presenting figures they did not measure. What can be said without inventing: people work out they are talking to a machine within two messages, and discovering it themselves costs more trust than being told upfront.