EU AI Act: What the AI Regulation Means for Websites and Online Shops
· by Daniel
Since 2 August 2026, the transparency obligations of the European AI Regulation, the EU AI Act, apply. If you use an AI chatbot on your website, create images with AI or have texts written automatically, now is the time to check that everything is labelled correctly. At the same time, the EU postponed some deadlines in summer 2026 with the so-called Digital Omnibus. Here is what applies today, what comes later and what you should do as a website or shop owner.
Where things stand in October 2026
The AI Regulation (Regulation (EU) 2024/1689) has been in force since 1 August 2024 and applies in stages. With Regulation (EU) 2026/1744, the “Digital Omnibus on AI”, the EU postponed the deadlines for high-risk AI. This amendment has applied since 27 July 2026. Each EU country has designated authorities to supervise the rules – in Germany, for example, the Federal Network Agency (Bundesnetzagentur) has been the central authority, contact point and complaints office since 29 July 2026.
| Since / from | What applies |
|---|---|
| 2 February 2025 | Prohibited AI practices, for example manipulative techniques and social scoring, and the duty to build AI literacy in your team |
| 2 August 2025 | Obligations for providers of general-purpose AI models, such as large language models |
| 2 August 2026 | Transparency obligations: notice for chatbots, labelling of deepfakes and AI-generated content |
| 2 December 2026 | End of the transition period for machine-readable marking by AI systems already on the market before August 2026; new ban on AI that creates non-consensual intimate images |
| 2 December 2027 | Obligations for stand-alone high-risk AI, for example in recruiting or credit scoring |
| 2 August 2028 | Obligations for high-risk AI in regulated products such as machinery or medical devices |
Does this affect me?
The regulation mainly distinguishes between providers, who develop an AI system or offer it under their own name, and deployers, who use an AI system professionally under their own responsibility. An online shop that uses ChatGPT, Gemini or a ready-made chatbot plugin is usually a deployer. If you build your own assistant on top of an AI API and offer it on your website under your own name, you may count as a provider yourself.
The good news: the typical uses on websites are not high-risk AI. These include a customer service chatbot, AI texts for product descriptions, AI images for banners and product recommendations in a shop. For them, mainly the transparency obligations and the AI literacy duty apply.
What you should do now
1. Label chatbots as AI
People must be able to tell that they are talking to an AI – at the latest at the first interaction, unless it is obvious anyway. A short notice in the chat window is enough, for example: “You are chatting with our AI assistant. Answers may contain errors.” Also offer a way to reach a human, for example through a contact form or a support ticket.
2. Disclose deceptively real AI images and videos
Images, videos or audio created or altered with AI that show real people, places or events in a deceptively real way must be labelled as AI-generated. Evidently artistic or satirical works benefit from lighter rules. For product images, consumer protection law also applies: an AI image must not promise more than the real product delivers.
3. Review AI texts editorially
AI-generated texts that inform the public on matters of public interest must be disclosed – unless a human has reviewed them and holds editorial responsibility. Product descriptions usually do not fall under this rule. Still, have every AI text proofread by a human. This protects you from wrong product information and is good SEO practice anyway.
4. Build AI literacy in your team
Since February 2025, companies that use AI have had to ensure AI literacy among their staff. The Digital Omnibus softened this duty: instead of guaranteeing a certain level of knowledge, companies are to support the development of AI literacy. In practice, a short internal policy often does the job: Which tools are allowed? Which data must never go in, such as customer data, passwords or trade secrets? Who approves AI results? Document your training sessions, as they can serve as evidence if needed.
5. Rule out prohibited practices
Prohibited AI systems include those that push people into decisions that cause them significant harm through subliminal or manipulative techniques, or that deliberately exploit vulnerabilities such as age or financial hardship. For online shops, this means no AI-driven dark patterns, such as artificial time pressure targeted at the presumed vulnerability of individual customers.
6. Don’t forget data protection
The AI Act does not replace the GDPR. For a chatbot, you usually need a data processing agreement with the provider, a section in your privacy policy and consent through your cookie banner if the chat script sets cookies or transfers data to third parties. With our plugin WordPress GDPR, such services only load after consent.
7. Prepare AI in recruiting in good time
If you use AI to filter applications or assess candidates, you are using high-risk AI. The strict obligations such as risk management, human oversight and logging apply from 2 December 2027. Use the time to review your providers and processes.
What are the penalties?
Prohibited practices can lead to fines of up to 35 million euros or 7% of worldwide annual turnover. Breaches of most other obligations, including the transparency obligations, can cost up to 15 million euros or 3%. For small and medium-sized enterprises, the lower amount applies in each case. These are upper limits, and authorities must act proportionately. Whether competitors can also take legal action over missing AI notices under unfair competition law has not yet been settled – you should not rule it out.
Where to get help
National authorities and the European Commission offer guidance, especially for small and medium-sized businesses. Germany’s Federal Network Agency, for example, runs an AI Service Desk with a free online tool for a first assessment of an AI system’s risk class. We are happy to help with the technical side: we integrate chatbots with the correct notice and consent into WordPress and WooCommerce, label AI content and check your website for open issues. Get in touch.
Checklist
- List all AI tools on your website and in your team: chatbot, texts, images, translations, recommendations
- Chatbot with a clear AI notice and a way to reach a human
- Label deceptively real AI images and videos
- Have AI texts checked by a human before publishing
- Internal AI policy and short training, both documented
- Update privacy policy, data processing agreements and cookie consent
- Prepare AI used in recruiting for the high-risk obligations by December 2027
This article reflects the situation as of 29 October 2026 and is not legal advice.