The EU AI Act: what it means for businesses using chatbots and voice agents
25 October 2026 · 6 min read · Dennis BorsosIf you have a chatbot on your website, an assistant on WhatsApp or a voice agent answering the phone, you have probably heard of the AI Act and wondered whether it applies to you. The short answer: yes, but for most small businesses the obligations are clear and easy to meet, provided the system is built properly from the start.
In this article you will find what the AI Act is, which dates matter, what a business using chatbots and voice agents needs to do, and a practical checklist. This is not legal advice. For special cases, talk to a specialist lawyer.
The AI Act in brief
The AI Act is Regulation (EU) 2024/1689, the first complete set of rules for artificial intelligence at European Union level. Because it is a regulation, it applies directly in every member state, Romania included, with no need for national legislation to transpose it.
Its logic is risk-based. The more seriously an AI system can affect people's rights or safety, the stricter the rules:
- Prohibited practices: for example, manipulation that can cause significant harm, exploiting vulnerabilities linked to age, disability or social or economic circumstances, social scoring, or emotion recognition in the workplace and in education (with medical or safety exceptions).
- High-risk systems: those used, for example, in recruitment and HR, education or certain important decisions about people. They carry strict requirements for documentation, human oversight and assessment.
- Transparency obligations: this is where chatbots and voice agents that talk to people sit, along with artificially generated or manipulated content.
- Everything else: many everyday uses only carry general obligations, such as AI literacy.
The timeline: what applies and when
The AI Act did not come into force all at once. According to the European Commission, the main dates are:
| Date | What applies |
|---|---|
| 1 August 2024 | The regulation enters into force |
| 2 February 2025 | Prohibited practices and AI literacy obligations |
| 2 August 2025 | Rules for general-purpose AI models and governance |
| 2 August 2026 | General application, including transparency obligations, with some exceptions |
| 2 December 2027 | Rules for high-risk systems in Annex III (for example employment, education) |
| 2 August 2028 | Rules for high-risk systems built into products covered by Annex I |
The deadlines for high-risk systems were pushed back by the simplification package known as the "AI Omnibus", which, according to the Commission, entered into force on 27 July 2026. The transparency obligations, the ones that matter most for chatbots and voice agents, were not moved: they apply from 2 August 2026. In other words, if you already use a bot, the rules apply now.
What it means for chatbots and voice agents
1. People must know they are talking to an AI
Article 50 of the AI Act requires AI systems that interact directly with people to be designed so that those people are informed they are interacting with an AI system. The exception is where this is obvious to a reasonably well-informed, observant person. The information must be clear and given no later than the first interaction.
In practice, do not rely on the exception. A voice agent that sounds natural is not "obviously" an AI. Concretely:
- Voice agent: in the first few seconds of the call, a simple line such as "Hello, I'm the virtual assistant for Company X. I can help you with bookings and information."
- Website or WhatsApp chatbot: the first message says it is a virtual assistant, and the name and avatar do not suggest a real person.
- Handover to a person: when the conversation passes to a colleague, say so clearly.
2. Be careful with voices and images that imitate real people
Article 50 also requires anyone using AI to generate or manipulate deepfake images, audio or video to disclose that the content is artificially generated. If you want your voice agent to use a cloned voice of an employee or the owner, speak to a lawyer first and, in any case, tell the listener clearly. The safest option for a customer service agent is a synthetic voice that does not imitate any specific person.
3. No manipulation
A sales bot can recommend products, upsell and politely persist. What it must not do is use manipulative or deceptive techniques that distort a person's decision and could cause them significant harm, or exploit vulnerabilities such as age or financial hardship. That is a prohibited practice, carrying the highest fines in the regulation.
4. Your team must understand what they are using
Article 4 on AI literacy has applied since February 2025 and was reworded by the AI Omnibus. The core idea remains: businesses that use AI systems take steps so that the people working with them understand what the systems do, where they get things wrong and when to step in. For a small business, that means short, documented training for whoever supervises the bot.
Is your chatbot a high-risk system?
Generally, a chatbot or voice agent that answers questions, takes orders and books appointments does not fall into the high-risk category. That changes if the system makes, or decisively influences, important decisions about people, for example if it:
- screens job applicants or evaluates employees;
- decides on access to education or assesses students;
- is used in other areas listed in Annex III of the regulation.
If your bot does any of these things, get a dedicated legal review. For these systems the application date is now 2 December 2027, but preparation takes time.
What you risk if you break the rules
For breaching the Article 50 transparency obligations, the AI Act sets fines of up to €15 million or 3% of worldwide annual turnover. For prohibited practices, the cap is €35 million or 7%. For SMEs, the regulation says the lower of the two amounts applies. These are ceilings, not automatic fines, but they show how seriously the subject is taken.
More important than the fine is trust. A customer who discovers they spent ten minutes talking to a robot thinking it was a person will not come back.
A checklist for your business
- List every AI system you use: website chatbot, WhatsApp, voice agent, AI automations, internal tools.
- Check the opening message of each bot. Does it clearly say it is an AI assistant?
- Check the voice and avatar. Do they imitate a real person? If so, do you have that person's consent and do you tell the listener clearly?
- Review the bot's instructions. Is there anything that could push it towards pressure or deception?
- Check whether any system makes decisions about people (hiring, assessment, access to essential services).
- Train the team that supervises the bot and keep a short record of the training.
- Make sure there is a route to a human: the customer can ask to speak to someone on the team at any time.
- Tie it all to GDPR: the AI Act does not replace data protection rules, it adds to them.
How we build agents with the AI Act in mind
The agents we build run on Claude, Anthropic's model, and data is stored in Supabase on EU servers. Every voice agent or WhatsApp chatbot introduces itself as a virtual assistant from the first sentence, has clear instructions about what it is allowed to do and hands the conversation to a person when needed. You can read more about how we handle data on our data security page.
A concrete example: a chain of cake shops in Sibiu uses a voice agent that recovers around 20 calls a day that used to be lost orders. Customers know from the first second that they are talking to a virtual assistant, and that has not stopped them ordering.
In short
For a business using chatbots and voice agents, the AI Act is first and foremost about transparency: people must know they are talking to an AI, with no manipulation and no voices secretly imitating real people. Add short training for your team and a check that the bot does not make important decisions about people, and you have covered the essentials.
If you would like us to check where your bot stands together, or you want to build one that is compliant from day one, book a free 30-minute call.
Frequently asked questions
Since when do chatbots have to say they are AI?
The transparency obligations in Article 50 of the AI Act apply from 2 August 2026. Unlike some of the rules for high-risk systems, they were not postponed by the AI Omnibus. This means any chatbot or voice agent that talks to people must clearly tell them, no later than the first interaction, that they are dealing with an AI system.
Does the AI Act apply to small businesses in Romania?
Yes. The AI Act is an EU regulation and applies directly in Romania, regardless of company size. For SMEs, fines are capped at the lower of the fixed amount and the percentage of turnover. For most businesses using ordinary chatbots, the main obligations are transparency and training the team.
Is a voice agent for bookings a high-risk system?
Generally, no. An agent that answers questions, takes orders or books appointments does not usually fall into the high-risk categories in Annex III. That changes if the system makes, or decisively influences, decisions about people, for example in recruitment or education. In those cases, get a dedicated legal review.
What fines does the AI Act set for a lack of transparency?
For breaching the Article 50 transparency obligations, the cap is up to €15 million or 3% of worldwide annual turnover. For SMEs, the lower of the two applies. Prohibited practices carry a higher cap of €35 million or 7%.
Does the AI Act replace GDPR for chatbots?
No. The AI Act adds to GDPR rather than replacing it. If your bot processes personal data such as names, phone numbers or order details, all GDPR obligations still apply: a lawful basis, informing people, contracts with suppliers and data security. The two need to be handled together.
Related articles
Prefer to talk directly?
We reply the same business day. Choose whatever suits you best.
The EU AI Act: what it means for businesses using chatbots and voice agents
25 October 2026 · 6 min read · Dennis BorsosIf you have a chatbot on your website, an assistant on WhatsApp or a voice agent answering the phone, you have probably heard of the AI Act and wondered whether it applies to you. The short answer: yes, but for most small businesses the obligations are clear and easy to meet, provided the system is built properly from the start.
In this article you will find what the AI Act is, which dates matter, what a business using chatbots and voice agents needs to do, and a practical checklist. This is not legal advice. For special cases, talk to a specialist lawyer.
The AI Act in brief
The AI Act is Regulation (EU) 2024/1689, the first complete set of rules for artificial intelligence at European Union level. Because it is a regulation, it applies directly in every member state, Romania included, with no need for national legislation to transpose it.
Its logic is risk-based. The more seriously an AI system can affect people's rights or safety, the stricter the rules:
- Prohibited practices: for example, manipulation that can cause significant harm, exploiting vulnerabilities linked to age, disability or social or economic circumstances, social scoring, or emotion recognition in the workplace and in education (with medical or safety exceptions).
- High-risk systems: those used, for example, in recruitment and HR, education or certain important decisions about people. They carry strict requirements for documentation, human oversight and assessment.
- Transparency obligations: this is where chatbots and voice agents that talk to people sit, along with artificially generated or manipulated content.
- Everything else: many everyday uses only carry general obligations, such as AI literacy.
The timeline: what applies and when
The AI Act did not come into force all at once. According to the European Commission, the main dates are:
| Date | What applies |
|---|---|
| 1 August 2024 | The regulation enters into force |
| 2 February 2025 | Prohibited practices and AI literacy obligations |
| 2 August 2025 | Rules for general-purpose AI models and governance |
| 2 August 2026 | General application, including transparency obligations, with some exceptions |
| 2 December 2027 | Rules for high-risk systems in Annex III (for example employment, education) |
| 2 August 2028 | Rules for high-risk systems built into products covered by Annex I |
The deadlines for high-risk systems were pushed back by the simplification package known as the "AI Omnibus", which, according to the Commission, entered into force on 27 July 2026. The transparency obligations, the ones that matter most for chatbots and voice agents, were not moved: they apply from 2 August 2026. In other words, if you already use a bot, the rules apply now.
What it means for chatbots and voice agents
1. People must know they are talking to an AI
Article 50 of the AI Act requires AI systems that interact directly with people to be designed so that those people are informed they are interacting with an AI system. The exception is where this is obvious to a reasonably well-informed, observant person. The information must be clear and given no later than the first interaction.
In practice, do not rely on the exception. A voice agent that sounds natural is not "obviously" an AI. Concretely:
- Voice agent: in the first few seconds of the call, a simple line such as "Hello, I'm the virtual assistant for Company X. I can help you with bookings and information."
- Website or WhatsApp chatbot: the first message says it is a virtual assistant, and the name and avatar do not suggest a real person.
- Handover to a person: when the conversation passes to a colleague, say so clearly.
2. Be careful with voices and images that imitate real people
Article 50 also requires anyone using AI to generate or manipulate deepfake images, audio or video to disclose that the content is artificially generated. If you want your voice agent to use a cloned voice of an employee or the owner, speak to a lawyer first and, in any case, tell the listener clearly. The safest option for a customer service agent is a synthetic voice that does not imitate any specific person.
3. No manipulation
A sales bot can recommend products, upsell and politely persist. What it must not do is use manipulative or deceptive techniques that distort a person's decision and could cause them significant harm, or exploit vulnerabilities such as age or financial hardship. That is a prohibited practice, carrying the highest fines in the regulation.
4. Your team must understand what they are using
Article 4 on AI literacy has applied since February 2025 and was reworded by the AI Omnibus. The core idea remains: businesses that use AI systems take steps so that the people working with them understand what the systems do, where they get things wrong and when to step in. For a small business, that means short, documented training for whoever supervises the bot.
Is your chatbot a high-risk system?
Generally, a chatbot or voice agent that answers questions, takes orders and books appointments does not fall into the high-risk category. That changes if the system makes, or decisively influences, important decisions about people, for example if it:
- screens job applicants or evaluates employees;
- decides on access to education or assesses students;
- is used in other areas listed in Annex III of the regulation.
If your bot does any of these things, get a dedicated legal review. For these systems the application date is now 2 December 2027, but preparation takes time.
What you risk if you break the rules
For breaching the Article 50 transparency obligations, the AI Act sets fines of up to €15 million or 3% of worldwide annual turnover. For prohibited practices, the cap is €35 million or 7%. For SMEs, the regulation says the lower of the two amounts applies. These are ceilings, not automatic fines, but they show how seriously the subject is taken.
More important than the fine is trust. A customer who discovers they spent ten minutes talking to a robot thinking it was a person will not come back.
A checklist for your business
- List every AI system you use: website chatbot, WhatsApp, voice agent, AI automations, internal tools.
- Check the opening message of each bot. Does it clearly say it is an AI assistant?
- Check the voice and avatar. Do they imitate a real person? If so, do you have that person's consent and do you tell the listener clearly?
- Review the bot's instructions. Is there anything that could push it towards pressure or deception?
- Check whether any system makes decisions about people (hiring, assessment, access to essential services).
- Train the team that supervises the bot and keep a short record of the training.
- Make sure there is a route to a human: the customer can ask to speak to someone on the team at any time.
- Tie it all to GDPR: the AI Act does not replace data protection rules, it adds to them.
How we build agents with the AI Act in mind
The agents we build run on Claude, Anthropic's model, and data is stored in Supabase on EU servers. Every voice agent or WhatsApp chatbot introduces itself as a virtual assistant from the first sentence, has clear instructions about what it is allowed to do and hands the conversation to a person when needed. You can read more about how we handle data on our data security page.
A concrete example: a chain of cake shops in Sibiu uses a voice agent that recovers around 20 calls a day that used to be lost orders. Customers know from the first second that they are talking to a virtual assistant, and that has not stopped them ordering.
In short
For a business using chatbots and voice agents, the AI Act is first and foremost about transparency: people must know they are talking to an AI, with no manipulation and no voices secretly imitating real people. Add short training for your team and a check that the bot does not make important decisions about people, and you have covered the essentials.
If you would like us to check where your bot stands together, or you want to build one that is compliant from day one, book a free 30-minute call.
Frequently asked questions
Since when do chatbots have to say they are AI?
The transparency obligations in Article 50 of the AI Act apply from 2 August 2026. Unlike some of the rules for high-risk systems, they were not postponed by the AI Omnibus. This means any chatbot or voice agent that talks to people must clearly tell them, no later than the first interaction, that they are dealing with an AI system.
Does the AI Act apply to small businesses in Romania?
Yes. The AI Act is an EU regulation and applies directly in Romania, regardless of company size. For SMEs, fines are capped at the lower of the fixed amount and the percentage of turnover. For most businesses using ordinary chatbots, the main obligations are transparency and training the team.
Is a voice agent for bookings a high-risk system?
Generally, no. An agent that answers questions, takes orders or books appointments does not usually fall into the high-risk categories in Annex III. That changes if the system makes, or decisively influences, decisions about people, for example in recruitment or education. In those cases, get a dedicated legal review.
What fines does the AI Act set for a lack of transparency?
For breaching the Article 50 transparency obligations, the cap is up to €15 million or 3% of worldwide annual turnover. For SMEs, the lower of the two applies. Prohibited practices carry a higher cap of €35 million or 7%.
Does the AI Act replace GDPR for chatbots?
No. The AI Act adds to GDPR rather than replacing it. If your bot processes personal data such as names, phone numbers or order details, all GDPR obligations still apply: a lawful basis, informing people, contracts with suppliers and data security. The two need to be handled together.
Related articles
Prefer to talk directly?
We reply the same business day. Choose whatever suits you best.
