Many businesses heard one thing about the AI Act this summer: "it was delayed". That is half true. The Digital Omnibus, adopted in June and in force since late July 2026, postponed the rules for high-risk AI systems. It did not postpone the rules most likely to affect a normal business website.
If your site has a chatbot, publishes AI-generated images or uses AI to produce content, the relevant obligations already apply.
Transparency is the part of the AI Act that reaches almost everyone — and it was never delayed.
The timeline, as it stands
- 1 August 2024 — the AI Act enters into force.
- 2 February 2025 — banned practices (such as manipulative or exploitative AI) and the AI literacy duty apply.
- 2 August 2025 — rules for general-purpose AI models apply.
- 2 August 2026 — transparency obligations (Article 50) and most remaining rules apply.
- 2 December 2026 — new ban on AI systems that generate non-consensual intimate imagery; end of the grace period for machine-readable marking by systems already on the market.
- 2 December 2027 — high-risk rules for stand-alone systems (Annex III), such as AI used in hiring or credit decisions — postponed by the Omnibus.
- 2 August 2028 — high-risk rules for AI built into regulated products (Annex I).
What applies to a business website today
1. Chatbots must be recognisable as AI
AI systems that interact directly with people must be designed so that people know they are dealing with a machine, unless it is obvious from the context (Article 50(1)). Formally, this duty sits with the provider of the system. In practice, it is your visitors who must be told — so the disclosure belongs in your design: a clear label at the start of the conversation, not a sentence hidden in the privacy policy.
2. Deepfakes must be disclosed
If you publish AI-generated or manipulated images, audio or video that look real — a realistic "photo" of a person, a place or an event — you must disclose that it is artificial (Article 50(4)). Clearly artistic, satirical or fictional work gets a lighter, adapted treatment. A stylised illustration is not the problem; a realistic fake "customer photo" is.
3. AI-written public-interest text
AI-generated text published to inform the public on matters of public interest must be disclosed — unless it has gone through human review and someone holds editorial responsibility. For a business blog, the lesson is simple: keep a human editor in the loop and stand behind what you publish.
4. AI literacy in your team
Since February 2025, organisations that use AI systems must take measures to build sufficient AI literacy among the people who use them on their behalf (Article 4). The Omnibus softened this — you no longer have to guarantee a specific level for each person — but the duty to take measures remains. A short internal guideline and basic training count.
When AI becomes high-risk
Some uses are classed as high-risk because they can decide people's opportunities: screening job applications, evaluating employees, assessing creditworthiness, access to education or essential services. If your website or HR process uses AI to rank applicants, you are close to this category. The detailed duties — risk management, documentation, human oversight — now apply from December 2027. That is not a reason to wait; it is preparation time.
It is also where the law still has gaps. As I have argued elsewhere, private employers using AI in hiring are not required to carry out a fundamental-rights impact assessment before deployment — a check the Act does require for credit and insurance. Legal knowledge here means knowing not only what is required, but what is wise.
The AI Act does not replace the GDPR
A chatbot conversation is full of personal data. The GDPR applies in parallel: you need a legal basis, a processor agreement with the chatbot provider, a line in your privacy notice and a plan for how long conversations are stored. Decisions with legal or similarly significant effects may not be left purely to automated processing (Article 22 GDPR). Most AI compliance problems on websites are, in the end, data protection problems.
What fines look like
Violating the banned practices can cost up to €35 million or 7% of worldwide turnover; most other breaches, including transparency, up to €15 million or 3%. For SMEs and start-ups, the lower of the two amounts applies. As with the GDPR, the realistic risk for a small business is less a maximum fine than a complaint, a correction order — or lost trust.
A short checklist
- List every AI tool on your website and in your workflows.
- Label your chatbot clearly as AI at the start of every conversation.
- Disclose realistic AI-generated images, audio and video.
- Keep a human editor responsible for published content.
- Update your privacy notice and processor agreements for AI tools.
- Write a one-page internal AI guideline for your team.
The point
AI makes it easy to add impressive features to a website in an afternoon. The law asks a slower question: will the people on the other side know what they are dealing with? Building that honesty into the design from the start is not a burden. It is what makes the feature trustworthy enough to use.
Adding a chatbot or AI features to your website? We design them with the right disclosures and privacy setup built in — get in touch.
Lawyer by training, web builder by trade. Goran writes about EU digital law — GDPR, the DSA and the AI Act — and what it means for the people who build and run websites.
Sources
This article is general information, not legal advice. It reflects the law as of its publication date.