This is a hypothetical, illustrative example. The invented facts are: a small retailer uses a chatbot on its website to answer general product questions, to help customers find products, and to take order queries, with a human agent available for complaints and refunds. On those facts, the screening in this guide finds that the chatbot is an AI system in scope, that the chatbot vendor is a provider and the retailer is a deployer, that no Article 5 prohibition is shown, and that the Annex III route is not shown, but that Article 50 transparency duties apply because the chatbot interacts with natural persons, and that the chatbot must disclose that it is a machine. The conclusion is provisional, tied to the invented facts, and must be confirmed with a competent authority or legal adviser for any real chatbot. This example does not determine any real chatbot.
What are the invented facts?
The invented facts are stated here so that the screening can be tested against them. A small retailer, Deployer C, uses a chatbot, Chat D, on its website, supplied by a vendor, Provider E. Chat D answers general questions about products, prices and delivery, helps customers find products by asking about preferences, and takes order queries that are passed to a human agent for confirmation. Chat D does not decide credit, does not screen job applications, does not assess eligibility for a service, and does not make a consequential decision about a person. A human agent is available during business hours for complaints, refunds and complex queries, and the chatbot transfers the conversation to a human where it cannot answer. Chat D uses a general purpose model as one component, with a retrieval layer that draws on the retailer product catalogue. The chatbot is placed on the Union market by Provider E and put into service by Deployer C in the Union, and is used by customers in the Union. No biometric, emotion inference or social scoring function is included. Those facts are invented and simple, deliberately, so that the screening steps are visible. A real chatbot will have more complex facts, including the data used for training and retrieval, the escalation design, the handling of vulnerable customers, and the integration with ordering and payment systems, each of which can change the screening.
How is scope and role screened?
Chat D's facts are deliberately ordinary, and that is the point: the screening has to be done even where nothing looks high-risk. The chatbot answers product, price and delivery questions, helps customers find products by asking about preferences, and passes order queries to a human agent for confirmation. It decides no credit, screens no job applications, assesses no eligibility, and makes no consequential decision about a person, and a human agent is available in business hours for complaints, refunds and complex queries, with transfer where the chatbot cannot answer. The roles follow the facts: Provider E develops Chat D and places it on the market under its own name, and Deployer C, the retailer, uses it under its own authority for a professional activity, while the general-purpose model underneath is a separate upstream provider for Chapter V purposes. Chat D meets the Article 3(1) definition on these facts, subject to the Commission guidelines, and is placed on the Union market and used in the Union, so Article 2 is satisfied. Deployer C takes on no provider duties on these facts, but customising the chatbot or putting its name on it would reopen that question.
For the broader regulatory framework, see questions and misconceptions overview.
How is the prohibition screen done?
The prohibition questions for a sales chatbot are narrower than for a scoring system, but they still need answering in writing. The risk to check is deceptive design: do the conversation flow, the product suggestions or the disclosures use hidden persuasion or misleading statements that materially distort how customers behave? On the invented facts nothing deceptive is shown, but the design must be examined rather than assumed benign. Handling of vulnerable customers, including customers who disclose financial difficulty, must be checked for vulnerability exploitation. Social scoring, biometric categorisation, emotion inference and remote biometric identification are all absent from the facts, so those prohibitions are not shown, and the new December 2026 prohibitions are not shown either, since Chat D generates no intimate or sexual content. The screen is provisional and tied to the invented facts: adding a feature, such as assessing a customer for credit or a tenancy, would reopen it.
How is the Annex route screened?
Neither Article 6 route bites on the invented facts, but both must be worked through and recorded. Article 6(1) does not apply, because Chat D is neither a safety component of a product covered by Annex I legislation nor itself such a product. Article 6(2) and Annex III do not apply either, because no listed use case is met: the chatbot does no biometric identification, manages no critical infrastructure, assesses no education or vocational training, recruits or manages no workers, assesses no eligibility for essential public or private services such as credit or insurance, assists no law enforcement, migration or border control work, and assists in no administration of justice. The record should list the Annex III categories considered and rejected, so that a later reviewer can see the reasoning rather than a bare conclusion. A new purpose, such as assessing customers for credit, insurance or a tenancy, could bring the essential services use case into play and must trigger a fresh screening before the chatbot is used that way.
What transparency duties apply?
Article 50(1) requires that providers ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless that is obvious from the circumstances and context of use. On the invented facts, Chat D interacts directly with customers, and the interaction is not obviously with a machine from the circumstances alone, so the chatbot must disclose that it is a machine, in a clear and timely manner, at the start of the interaction and in a form that the customer can understand. The disclosure should be in the chatbot greeting, in the website terms or in the conversation design, and should be tested with real customers to ensure that it is understood. Deployer C, as deployer, must also ensure that the information is given, and must check that the vendor disclosure is present and accurate. Where Chat D generates synthetic content, such as product images or marketing text, Article 50(2) and (4) marking and disclosure duties must be checked, including the transitional deadline of 2 December 2026 for certain providers of synthetic content systems already placed on the market before 2 August 2026. The transparency record should state the disclosure wording, the placement, the language versions, and the test with customers, with a date and a reviewer. A chatbot that discloses only in small print, or only after the conversation has started, will not meet the clear and timely standard.
Continue with misconception: all AI is high risk.
What does this example not decide?
This walkthrough decides nothing about a real chatbot. It fixes no Article 50 position for a named product and gives no consumer law or data protection opinion for any website. It is a hypothetical exercise, built from invented facts, with a provisional conclusion tied to those facts and a confirm-with-authority exit. A provider or deployer with a real chatbot should run the screening order on its own facts, check the consolidated Regulation and the Commission guidelines, and confirm the classification and the transparency duties with a competent authority or legal adviser. The method is transferable; the answer for a real chatbot is not.
Frequently asked questions
Must a chatbot always say it is a machine?
Article 50(1) requires disclosure where a system is intended to interact directly with natural persons, unless that is obvious from the circumstances and context of use. A chatbot that is not obviously a machine must disclose that it is a machine, clearly and in a timely manner. A chatbot that is obviously a machine, from its name, design and context, can rely on that obviousness, but the position should be recorded and tested.
Is a product recommendation chatbot high risk?
Not on the invented facts in this example, where the chatbot answers general questions and helps customers find products without assessing eligibility for an essential service. A chatbot that assesses credit, insurance, housing or another essential service, or that recruits or manages workers, can be high risk under Annex III. The use, not the chatbot technology, drives the classification.
Who is responsible for the disclosure, the vendor or the retailer?
Both, in different ways. The provider must design and develop the system so that the person is informed, and the deployer must ensure that the information is given in use. The contract between the vendor and the retailer should allocate the disclosure design, the wording, the placement and the testing, with the record showing who did what.
What if the chatbot is used for complaints and refunds?
Complaints and refunds can involve consequential decisions about a customer, and the chatbot design, the escalation to a human, and the record of the decision must be examined. A chatbot that decides a refund, without human review, raises different questions from a chatbot that takes a query and passes it to a human. The Annex, prohibition and transparency screens must be redone for the complaints function.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗