{"id":34205,"date":"2026-08-17T12:00:00","date_gmt":"2026-08-17T10:00:00","guid":{"rendered":"https:\/\/salvadorvilalta.com\/?p=34205"},"modified":"2026-08-16T09:15:19","modified_gmt":"2026-08-16T07:15:19","slug":"did-you-know-that-your-chatbot-has-been-illegal-since-august-2","status":"publish","type":"post","link":"https:\/\/salvadorvilalta.com\/en\/did-you-know-that-your-chatbot-has-been-illegal-since-august-2\/","title":{"rendered":"Did you know that your chatbot has been illegal since August 2?"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The truth is, there weren’t many of us\u2026 and then all hell broke loose!
After nearly two years of waiting, as of August 2\u2014with half the country on vacation\u2014part of the European Artificial Intelligence Act is now in effect. This law directly impacts something that almost every company I know has set up: the customer service bot on its website

Complying with that specific part of the law literally takes just one sentence.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

What has gone into effect?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

It is called Article 50 of the European AI Regulation and deals with transparency. The Commission itself confirms this unequivocally<\/u><\/a>: the obligations under this article have been in effect since August 2, 2026. Not \u201cwill apply,\u201d not \u201care expected to,\u201d but THEY ARE ALREADY IN EFFECT NOW!<\/strong> <\/p>

But let\u2019s not get too worked up\u2026 or should we? This article doesn\u2019t ban anything at all (that\u2019s the misunderstanding I\u2019ve been encountering over the past few weeks). People assume that Brussels is here to tell them which AI they can and can\u2019t use, but it\u2019s actually a bit more boring\u2014and much more reasonable. You can use as much artificial intelligence as you want, but you can\u2019t let the person on the other end think they\u2019re talking to a human when they\u2019re actually talking to a machine. <\/p>

In practice, this comes down to four things: if a machine interacts with a person, you must indicate that it is a machine; if content is generated by AI, you must label it so that it can be detected; if you publish a deepfake, it must be labeled as such; and if your system categorizes people based on biometric features or reads their emotions, you must inform that person.<\/p>

That’s it, the full text of the article<\/u><\/a> is quite a bit longer, of course, with its nuances about who is a provider and who is an implementer, but the gist of it fits into a single paragraph.<\/p>

(And yes, the distinction between provider and implementer matters, because it\u2019s not the same to be the one who builds the system as it is to be the one who uses it in your business. Most of you are probably in the latter category.) <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

This legislation is being counted backward<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

This is what prompted me to write this article: for the past few days, I’ve been seeing this figure misrepresented on LinkedIn and in some reputable media outlets.<\/p>

What it says Article 99 of the regulation<\/u><\/a> is that failure to comply with the transparency obligations set forth in Article 50 is punishable by a fine of up to 15 million euros or<\/strong> up to 3% of the company\u2019s global annual turnover for the previous fiscal year, whichever is greater<\/em>.<\/p>

The phrase is phrased as “up to 15 million or 3%,” which sounds like you can choose whichever number suits you best, but that’s not the case.<\/p>

You can do the math: a company with annual revenue of 40 million doesn’t risk 15 million\u2014it risks 1.2 million (3%, which is less)\u2014but a company with annual revenue of 2,000 million doesn’t risk 15 million; it risks 60 million.<\/p>

Fifteen million isn’t the upper limit for large companies; it’s the lower limit (it’s exactly the same mechanism we’re already familiar with from the GDPR), yet we still tend to interpret it as a flat rate.<\/p>

For small and medium-sized businesses and startups, the logic is reversed: the lower of the two amounts is applied (otherwise, this would simply be unaffordable for a company with 20 employees).<\/p>

I sincerely hope that the sanctions won’t be imposed on small and medium-sized businesses, but it’s important to start doing our homework as soon as possible.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

The Extension Nobody Is Talking About<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

This is the piece of information that’s really worth taking away, and I haven’t seen it anywhere in Spanish.<\/p>

There is a grace period, but it is very short, and it is important to understand exactly how long it lasts. According to the Commission itself<\/u><\/a>, it applies only to systems already on the market before August 2, 2026, and only to the obligation to label and detect AI-generated content (Article 50(2)). Those systems have until December 2, 2026. <\/p>

If your concern is labeling AI-generated images or text in a system you already had set up, you can breathe easy until December, but if your concern is the bot that talks to your customers, you can\u2019t breathe easy at all. That takes effect in August. And I\u2019ll bet anything you want that there are plenty of consultants out there selling the extension as if it covered the entire article\u2014and it doesn\u2019t. <\/p>

In addition, there is a third aspect that almost no one mentions and that I think is important: the Commission has promoted a code of best practices regarding the transparency of AI-generated content<\/u><\/a>, and signatories can rely on its guidelines to demonstrate compliance. By the end of July, nearly 190 organizations had signed it, but keep in mind that it\u2019s not mandatory. Labeling content at the source (Anthropic is already labeling all content generated by its systems). I\u2019ll definitely talk more about this in another article. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\"EU\t\t\t\t\t\t\t\t\t\t\t
Source: European Commission <\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

So now, what can we do?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The first step is to take stock,<\/strong> and this takes less time than it seems: Where in my business does a machine interact with a person? The website chat, the WhatsApp bot, the system that automatically responds to emails, the voice agent that answers the phone if you have one\u2014and don\u2019t forget that \u201csmart\u201d form someone set up eight months ago that nobody remembers anymore. If a user might get confused, we have a problem. <\/p>

We can fix this simply by using the phrase: “Hello, I’m the virtual assistant for such-and-such company.”<\/strong> No asterisks in the footer, no complex privacy policy, and no legal text that nobody reads. Most importantly, it needs to be clear from the start, not at the end.

Next comes the content, and here it\u2019s important to be honest with yourself. If you publish AI-generated images, video, or audio, label them as such. If they\u2019re deepfakes, that\u2019s all the more reason to do so. And if the content is generated by a third-party system, ask the provider if its output includes machine-readable tags, because that responsibility falls on the system\u2019s developer, not on you\u2014but you\u2019ll be the ones held accountable. <\/span><\/p>

And finally, something that isn’t in the rules, but that I learned the hard way: write down somewhere who is responsible for this in your company, including their first and last names. Because a responsibility that belongs to everyone ends up belonging to no one in practice. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

My thoughts on this matter<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

To begin with\u2014and I\u2019m surprised to say this\u2014I think Article 50 is actually quite well thought out. There\u2019s plenty to criticize about European regulations (I\u2019ve been among those who\u2019ve grumbled about the bureaucratic burden), and I still think the \u201chigh-risk\u201d category is going to be a major headache for small businesses, but this specific provision calls for something anyone would support in a bar conversation: knowing whether there\u2019s a real person on the other end. <\/p>

On the other hand\u2014and this is where I feel a little more uncomfortable\u2014I suspect that actual compliance is going to be terrible for months, not because of bad faith, but out of sheer ignorance.<\/p>

Most Spanish companies with a chatbot on their website don’t even know that Article 50 exists, and those that do are waiting for someone to tell them exactly what to do.<\/p>

If you’re reading this at a company that uses an automated chatbot, I’ll bet you a cup of coffee that no one has reviewed the welcome message since it was set up.<\/p>

And there\u2019s one more thing: this turns transparency into a competitive advantage, not a cost. When, a year from now, half of the content (I think most of it) is generated by machines, clearly stating what you\u2019ve done and what the system has done will be a selling point, not just a formality. <\/p>

A company that gives advance notice seems more professional\u2014not any less modern\u2014and the ones that get caught out will be precisely those that are currently trying to make their bot sound as human as possible so that the customer doesn’t notice a thing.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"infografia-ai-act-EN\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

While preparing this article, I realized that a large portion of the infographics circulating that explain the AI law are actually generated by AI (without being labeled as such, of course). In other words, we\u2019re explaining the requirement to label synthetic content using unlabeled synthetic content. It\u2019s not a violation, but the irony is undeniable. <\/p>

If you have a chat feature on your website, take a look at it this week\u2014it’ll only take ten minutes, and you’ll solve a problem you didn’t see coming.<\/p>

Have a good week!<\/p>

LINKS OF INTEREST:<\/strong><\/p>