If an AI agent talks to customers, they must know they are talking to an AI: that is a transparency obligation under the EU AI Act (Article 50), which under the regulation's text applies from 2 August 2026. GDPR still governs personal data: you need a legal basis, a contract with the AI provider and a person involved in decisions with significant effects.
Transparency under the EU AI Act
People must be informed when they interact with an AI system, unless it is obvious. In practice the agent introduces itself as an AI at the start of the conversation, and the website explains how it works.
Personal data under GDPR
- A legal basis for the processing, as with any other personal data processing.
- A data processing agreement (Article 28) with the AI model provider.
- A clear privacy policy: what is collected, why and for how long.
- The right to human intervention in automated decisions with significant effects (Article 22).
What we do by default
- The agent always says it is an AI.
- Anything that spends money or matters goes through human approval.
- Every action of the agent is logged.
- You choose where the AI runs: contracted cloud, private EU cloud or your own server.
Important
This is a general overview, not legal advice. For your specific case, consult a lawyer. We can prepare the technical documentation the lawyer will ask for.