Does your chatbot have to admit it's a bot?
New rules on telling people when they're talking to a machine came into force in Europe in August, and some US states already have their own. The headlines make it sound like every café with a chat widget is in trouble. The truth is narrower — and the sensible fix costs nothing.
Since August, a particular kind of email has been landing in small business inboxes: new AI law now in force — is your website compliant? Usually followed by a package that will make it so, for a monthly fee.
There is a real rule behind it. But most of what’s being said about it to small businesses is wrong in one direction or the other — either “this doesn’t apply to you” or “this applies to everything you do.” Neither is right.
Here is what actually changed, who it lands on, and the one thing worth doing either way.
What changed in Europe
On 2 August 2026, a set of transparency rules in the EU’s AI law came into force on schedule, even as other parts of the law were pushed back.
The headline duty: an AI system that talks directly to people — a chatbot, a voice assistant — must be designed so that people are told they are dealing with an AI, unless that is already obvious. The “obvious” exception is narrow. Lawyers’ guidance specifically gives an online helpdesk chatbot as a case where people might think they’re talking to a person, so disclosure is needed.
The rules reach beyond Europe, too: a business outside the EU is caught where its AI’s output is meant to be used by people in the EU. The maximum fines are large — up to €15 million or 3% of worldwide turnover.
The part most coverage gets wrong
That chatbot duty falls on the provider — whoever builds the AI system, or has it built, and puts it out under their own name.
A café that pays a company for a chat widget and drops it on its website is, in the law’s language, a deployer, not a provider. Under these rules, the duty to make the bot announce itself sits mainly with the company that makes it.
Two important caveats:
- If you built your own bot, or had one made and run it under your own name, you may be the provider. Then the duty is yours.
- “It’s the vendor’s job” is a legal answer, not a customer one. If your website’s chatbot fools someone, they won’t blame the software company. They’ll blame you. We made the same point about chatbots’ promises in an earlier post.
The other rule people panic about
There is also a rule about labelling AI-written text. It applies to text published to inform the public on matters of public interest — and even then, not where the text has been through human editorial review with someone taking responsibility for it.
Your opening hours, your menu, your services page and your prices are not that. Nobody needs to stamp “written by AI” on a bakery’s homepage because of this rule. If someone is selling you a package to do exactly that, it is worth asking what they think it’s for.
What changed in the US
There is no single US law, but several states have their own. Two matter for ordinary small businesses:
- Maine requires anyone using a bot in trade or commerce to make a clear and conspicuous disclosure that the customer isn’t dealing with a human, wherever the bot could mislead them into thinking it’s a person. A complaint doesn’t need to show anyone was actually fooled.
- Utah requires a business using generative AI to tell customers if they ask whether they’re dealing with AI. People in regulated professions have to say so at the start of certain higher-risk conversations.
Other states have narrower rules, mostly aimed at high-risk decisions or at deliberate deception.
(General information, not legal advice. These rules are new and differ by place; if you’re unsure, ask someone qualified.)
The sensible fix, whoever the law names
Here’s the useful conclusion: the cheapest compliance and the best customer service are the same thing.
A bot that says it’s a bot, and a clear way to reach a person.
People mind being misled far more than they mind automation. A chat window that opens with “Hi — I’m an automated assistant. I can answer common questions, or you can ring us on 0123 456 7890 between 9 and 5” breaks no rule anywhere, costs nothing, and earns a bit of trust in the process.
The fair question
devkoi doesn’t build chatbots, so there is no devkoi bot on your site to disclose.
What it builds is the plainer alternative we’ve argued for before: pages that answer the common questions directly — hours, prices, what you do, how to reach a human — so fewer people need to ask a bot anything at all.
What to do this week
1. List everything that talks to customers automatically. A chat widget on your website, an automated phone answering service, auto-replies on messaging apps, an assistant that books appointments.
2. Make each one say what it is, at the start. One clear line, not small print.
“I’m an automated assistant — I can help with common questions.”
3. Always offer a person. A phone number, an email, and the hours someone actually answers — on the bot and on your site.
“Add to the contact page: our chat assistant is automated; to speak to a person, ring 0123 456 7890, Monday to Friday, 9 to 5.”
4. If someone asks “am I talking to a real person?”, the answer must be honest. That is the Utah rule, and it’s just good manners everywhere else.
5. Don’t give your bot a human name and a staff photo. “Sophie from our team” is exactly the kind of design that misleads people into thinking it’s a person.
6. If you have customers in Europe, ask your chatbot company in writing how their product meets the EU disclosure rule. The duty is mainly theirs — make sure they’re actually doing it, and keep the answer.
7. Don’t pay for a compliance package for your menu page. The AI-text labelling rule is about public-interest publishing, not a café’s opening hours.
The rule is new, but the principle is old: don’t let customers think they’re talking to someone they’re not.
Most small businesses that use a bot can meet it with one sentence and a phone number. The ones who can’t are usually the ones who were trying to hide it in the first place.