- Both the GDPR and the AI Act apply to your chatbot.
- Core: EU hosting, data processing agreement, data minimisation, informing users.
- Since 2 August 2026, a chatbot must identify itself as AI.
An AI chatbot can be run in a GDPR-compliant way if four things are right: data is processed in the EU or with appropriate safeguards, there is a data processing agreement with the provider, the bot only asks for what it really needs, and users are informed transparently. Since 2 August 2026, the AI Act adds one more: people must be able to tell they are talking to AI.
1. Provider and hosting
Find out where conversations are processed and stored and whether the provider uses the data to train its own models. Prefer processing in the EU. If data is transferred to a third country, you need a legal basis for that transfer.
2. Data processing agreement
The chatbot provider processes personal data on your behalf. Under Art. 28 GDPR you therefore need a data processing agreement covering purpose, duration, security measures and sub-processors.
3. Data minimisation
- Only ask for data needed for the request.
- Avoid special categories such as health data unless strictly necessary.
- Define how long conversation logs are stored, then delete them automatically.
- Pseudonymise analytics wherever possible.
4. Transparency for users
Add the chatbot to your privacy policy: purpose, legal basis, provider, retention period and data subject rights. The chat window itself should show a short note that an AI is answering, with a link to the privacy policy.
5. AI Act: disclosure as AI
Since 2 August 2026, Art. 50 AI Act requires that people can tell they are interacting with an AI system, unless that is obvious. A clear greeting such as “I'm the AI assistant of …” and a permanent note in the chat window reliably meet this.
6. Quality and liability
- Limit the bot to your approved content and have it cite sources.
- Define topics where the bot hands over to a person, such as complaints or contract questions.
- Test regularly with critical questions and review real conversations.
We build AI chatbots with EU hosting, a data processing agreement and AI Act disclosure as standard. Also read AI Act 2026 or request the free AI Scan.
This article is general information and not legal advice.
Frequently asked questions
Can an AI chatbot be GDPR-compliant?
Yes, with processing in the EU or appropriate safeguards, a data processing agreement, data minimisation and transparent information for users.
Do I need to mention the chatbot in my privacy policy?
Yes. State the purpose, legal basis, provider, retention period and data subject rights.
Does the chatbot have to say it is AI?
Yes. Since 2 August 2026, Art. 50 AI Act requires this unless it is obvious.