The short answer, and how firm it is
The AI Act hands out roles by what a company does, not by what a contract calls it. A provider develops an AI system, or has one developed, and places it on the market or puts it into service "under its own name or trademark" (Article 3(3)). A deployer uses an AI system "under its authority" in its work (Article 3(4)).
For a website chatbot, that splits the duties like this:
- Telling visitors they are talking to an AI (Article 50(1)) is the provider's duty, and a design duty: the system must be built so that people are informed.
- The deployer's own duties in Article 50 cover emotion recognition, biometric categorisation, deep fakes and AI text published to inform the public. An ordinary customer-service chatbot does none of these.
- Both owe AI literacy (Article 4).
As of 25 October 2026, the text settles the definitions, who Article 50(1) addresses, and that the name-or-trademark rule in Article 25 covers only high-risk systems. It does not settle whether your logo on someone else's chatbot makes you its provider: the European Commission's guidelines on Article 50 do not discuss white label, and they say they are not binding. The Commission approved their content on 20 July 2026 and says they will apply only once it has formally adopted them, when all language versions exist; as of 25 October 2026 they are available in English only. For the rest of Article 50, see our AI Act overview for website chatbots.
Provider, deployer and the other roles in Article 3
| Role | Article | What makes you one | Chatbot example |
|---|---|---|---|
| Provider | 3(3) | You develop an AI system or have one developed, and place it on the market or put it into service under your own name or trademark, paid or free | The chatbot vendor; a business that builds its own |
| Deployer | 3(4) | You use an AI system under your authority, other than for purely personal purposes | The business whose website the chatbot answers on |
| Distributor | 3(7) | You make an AI system available on the EU market without being its provider or importer | A reseller passing on a vendor's product under the vendor's name |
Placing on the market is the first making available of a system in the EU; putting into service is its supply for first use to a deployer, or for your own use (Article 3(9) and (11)). "Authority", the Commission explains, means taking responsibility for the decision to use the system and for how it is used; technical control is not required (guidelines, point 12). A business stays the deployer when an agency or a freelancer runs the chatbot for it, under its control (point 14). One company can hold several roles at once (recital 83), and Article 99 fines "operators", the umbrella term for all of them (Article 3(8)).
These are AI Act roles. The GDPR asks who determines the purposes and means of processing personal data (Article 4(7) GDPR), so an agency can be its client's processor under the GDPR and a provider under the AI Act at the same time. The data-protection side is covered in the GDPR roles of an agency and its clients.
What each role owes for a website chatbot
| Rule | Who it binds | What it means for a website chatbot | Applies from |
|---|---|---|---|
| Article 50(1): say it is an AI | Provider | Design the chat so that people are told clearly, at the latest at the first interaction (Article 50(5)), unless it is obvious. The guidelines name customer-support chatbots as in scope and helpdesk chatbots as not obvious | 2 August 2026 |
| Article 50(2): machine-readable marking | Provider of a system that generates text, images, audio or video | Mark the output in a machine-readable format and make it detectable as AI-generated; the guidelines require both | 2 August 2026; 2 December 2026 for systems already on the market before then |
| Article 50(3) and (4) | Deployer | Emotion recognition, biometric categorisation, deep fakes, and AI text published to inform the public on matters of public interest. A reply to one visitor is not a publication (the guidelines' example: a news summary shown only to the user who asked) | 2 August 2026 |
| Article 4: AI literacy | Provider and deployer | Take measures that support the AI literacy of staff and others who operate the system for you; no particular level has to be guaranteed | 2 February 2025; current wording since 27 July 2026 |
| Article 5: prohibited practices | Provider and deployer | Manipulative or exploitative uses are banned, whoever uses the system | 2 February 2025 |
| Articles 25 and 26 | High-risk systems only | Relevant only if the bot assesses people, for example by screening job applicants | 2 December 2027 for the uses in Annex III |
The Digital Omnibus on AI, Regulation (EU) 2026/1744, published on 24 July 2026, gave marking its four-month transition, moved the start of the high-risk rules and rewrote Article 4. It did not postpone the duty to tell people they are talking to an AI.
For chat text, the Code of Practice on Transparency of AI-generated Content, published on 10 June 2026 and assessed as adequate by the Commission and the AI Board, speaks of "free-form text" that cannot carry metadata and describes an imperceptible watermark for it, except for very short text, which it sets at under 200 tokens for now. The code is voluntary; a provider that does not sign it must show other ways of meeting Article 50(2) (guidelines, point 148).
That leaves the deployer of an ordinary website chatbot a short list: AI literacy, no prohibited use, and no high-risk use without the duties that come with it. In practice, also leave the provider's notice alone: do not cover it, style it out of sight, or give the bot a human persona that contradicts it. The guidelines count "human-like representations that may mislead users" among the signals that do not meet the duty on their own (point 38). For the wording itself, see what to write in a chatbot's AI notice. Consumer law and the GDPR's duties to inform apply alongside Article 50 (points 50 and 52).
Decision table: which role is likely yours
"Settled" means the Act's definitions answer it and the Commission's examples agree. "Judgement" means a reasoned reading that a regulator or a court could see differently.
| Your situation | Likely role | How firm | What to do |
|---|---|---|---|
| You embed a vendor's widget and its name stays visible | You: deployer. Vendor: provider | Settled in substance: the Commission's example of a chatbot offered under the vendor's name to businesses that use it as it comes | Check that the notice opens every conversation in your visitors' languages and that nothing on your page covers it; brief the staff who manage the bot |
| The same widget under your own name and logo, the vendor's badge removed | Probably still deployer; the vendor stays provider | Judgement: branding is not developing, and neither the Act nor the guidelines mention white label; read literally, the Bundesnetzagentur's overview points the other way | As above, plus the vendor's written commitment that the notice and the marking stay on whatever you configure |
| An agency resells a platform's chatbot under the platform's name | Agency: probably a distributor, or simply a service provider. Client: deployer. Platform: provider | Judgement; the distributor definition fits | Article 50 names only providers and deployers. Promise in your contract not to interfere with the notice |
| An agency sells the chatbot as its own product, under its own name and domain | Agency: probably a provider of what it sells. Platform: provider of its own system. Client: deployer | Judgement, but the definition fits closely: a system you had developed, placed on the market under your name | Act as a provider: make sure no client can switch the notice off, keep a record of how notice and marking work, and get the platform's written commitment to build and maintain both |
| An agency builds a chatbot for one client, under the client's brand | Client: deployer, and arguably provider of a system it had developed. Agency and platform: the provider side | Unsettled | Agree in writing who carries the provider duties and who checks the notice after every change |
| You build the chatbot yourself, on a model's API or on a model you fine-tune or host | You: provider and deployer. The model's vendor: typically a provider of a general-purpose AI model, under separate rules | Settled for the chatbot: the guidelines' example of a chatbot developed in-house and used under your own name. Duties for a model you change are outside this article | Build the notice and the machine-readable marking yourself |
| Your staff use a vendor's internal assistant, for HR policies or IT help | You: deployer. Vendor: provider | Settled for the role. The guidelines treat an assistant for trained, AI-literate staff as an obvious case, so the notice may not be needed | AI literacy for the users; no decisions about workers, which Annex III makes high-risk |
What changes the answer, and why white label is the hard case
Article 25 names three events that turn a distributor, importer, deployer or other third party into a provider: putting its name or trademark on a system already on the market, a substantial modification, and a change of intended purpose. The catch is in its first sentence: it concerns high-risk AI systems, whose rules, after the Digital Omnibus, apply from 2 December 2027 at the earliest. Some summaries drop "high-risk" from the first two cases; the overview of actors and duties on the Bundesnetzagentur's KI-Service Desk does so in its list, though it states the condition further down. Read the article itself.
For a chatbot that is not high-risk, Article 3(3) decides, with two conditions: you develop the system or have it developed, and you place it on the market or put it into service under your own name or trademark. A logo can at most meet the second. The Commission's examples (guidelines, point 11):
- a company offering a chatbot under its own name to businesses that use it "without the need for modifications or additional components" is the provider;
- an organisation that develops a chatbot in-house and uses it under its own name is the provider;
- a company that modifies an existing generative system, for example with new training data, and puts it into service under its own name becomes the provider of the new system; the original provider stays responsible for the original.
White label sits between the first and the third example, and published answers split on it: some say your brand on the bot makes you the provider, others that a business which switches on a vendor's chatbot stays the deployer. Read literally, the Bundesnetzagentur's overview supports the first: it names as provider whoever markets or uses a system under their own name or brand. Neither the Act nor the guidelines decides it. Our reading, a judgement and not the law:
- Configuring is using. Choosing sources, writing instructions and setting a name and colours is how a deployer uses a configurable product. A business that does only this is most likely still a deployer, even under its own brand.
- Selling under your trademark is providing. An agency that offers the chatbot to clients as its own product places it on the market under its name. Act as a provider.
- One client, the client's name, the agency's work is the least settled case: the client could be the provider of a system it had developed. Settle it in writing.
The label matters less than people fear. If the chat tells every visitor at the start that it is an AI, the result Article 50(1) asks for is there, whoever is called the provider. The role decides who must make that happen, and it bites when the notice can be switched off, when you build the interface yourself, and when a regulator asks who was responsible.
Why it matters: contracts, supervision and fines
A contract cannot turn a provider into a deployer, because the definitions look at what each party does. It can say who does the work and who answers for it. Settle these points between vendor and business, or between agency and client:
- Who acts as provider for Article 50, named per chatbot, because the Act leaves white label open.
- The notice: at the start of every conversation, in the visitor's language, and impossible for the client to switch off.
- The marking: how output is marked and detected, and whether the provider follows the Code of Practice.
- Changes: who checks the notice after a redesign or a new language. The provider must keep people informed "throughout the lifecycle of the AI system" (guidelines, point 33).
- Documentation: a short description of how the system informs people and marks its output, for your file and for a regulator's questions.
- Permitted uses: no assessing of people (job applicants, creditworthiness, health) without a separate agreement, because those uses are high-risk.
- AI literacy: who trains whom. The Commission's Q&A counts contractors, service providers and even clients among the "other persons" in Article 4.
Article 50 is supervised mainly by national market surveillance authorities; the EU's AI Office only in narrow cases, such as a system built on a general-purpose model by the same provider (Commission FAQ). As of 25 October 2026:
- Germany: the KI-MIG, Article 1 of the implementing act, has been in force since 29 July 2026. The Bundesnetzagentur is the market surveillance authority unless the law names another body, such as BaFin for AI systems tied to regulated financial activity.
- Netherlands: the Autoriteit Persoonsgegevens wrote on 9 October 2026 that it is the intended authority but not yet designated, and that the implementing act is still being prepared.
- Belgium: the FPS Economy coordinates the implementation; its pages, last updated on 3 September 2026, say the governance framework is still being put in place.
Breaches of Article 50 can be fined up to EUR 15 million or 3% of worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(4)). For small and medium-sized enterprises, and since the Omnibus also for small mid-caps, the lower of the two applies. Article 4 is not on that list; how a breach of it is sanctioned is left to national law.
How ChatterLab handles its part, and what stays with you
ChatterLab develops the chat system and offers it under its own name. Here is what that system does, from our documentation; it is not a ruling on your role.
- The AI notice is built in. Every conversation opens with a line such as "You're chatting with an AI assistant", in the widget's language. No plan, add-on or setting removes it, and it sits inside the chat frame, where your page cannot hide or restyle it: the Deploy page lists it as AI disclosure: Always shown (Languages and the AI notice).
- The agent says it is an AI. The platform's own rules tell it never to claim to be human and to say it is an AI when asked, whatever name you give it.
- Answers are marked in the page code with an attribute that software can read. Whether a marking meets Article 50(2) is for the provider to show, so ask any vendor, ChatterLab included, how its marking works and how it can be detected.
- White label keeps the notice. Your or your client's name, colour and logo go on the widget on every plan; removing the "Powered by ChatterLab" badge is an add-on of €49 a month on paid plans; your own domain comes with Studio and above, client records and reports with Agency and above. A client cannot sign in to your workspace. See white label for agencies and Clients.
- Records. Every conversation is stored with the sources behind each answer, and the audit log for 2 years (The EU AI Act).
- High-risk uses (recruitment, credit scoring, healthcare) are refused below Enterprise, which is agreed individually.
What stays with you: deciding your role and writing it into your client contracts, because using ChatterLab does not take an agency's AI Act obligations away; AI literacy for your own team; what the agent knows and what you use it for; your privacy notice and the GDPR contracts (a data processing agreement with us is sent on request); and, if you build your own chat on the API, the notice itself, because the widget's is not there.
Questions about provider and deployer roles
Am I a provider if I put my logo on a chatbot?
Not by the logo alone, on the most natural reading. The rule that a name or trademark makes you the provider (Article 25) covers high-risk systems only. For an ordinary website chatbot, Article 3(3) also requires that you develop the system or have it developed. Configuring a vendor's chatbot is closer to using it; selling it to others as your own product is closer to providing it. The Commission's guidelines do not address white label, so record your reading in your contracts.
Does the deployer have to show the AI notice?
Article 50(1) puts the duty on the provider: the chat must be designed so that people are told, at the latest at the first interaction, that they are dealing with an AI. A business using a vendor's chatbot has no separate duty to add one. It should not hide or contradict the provider's notice, though, and if it builds the chat interface itself, it is most likely the provider, and the notice is its own job.
Does Article 50 apply to a customer-service chatbot?
Yes. A chatbot that converses with visitors is an AI system intended to interact directly with people, and the Commission's guidelines name customer-support and e-commerce chatbots as examples. The exception for interactions that are obvious is read narrowly, and the guidelines give helpdesk chatbots as a case where it does not apply. A scripted bot with fixed answers and no AI behind it is outside the rule.
Who is liable if the AI notice is missing?
Under the AI Act the notice is the provider's duty; breaches of Article 50 can be fined up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher (for small and medium-sized enterprises, whichever is lower). If the vendor's system never showed a notice, the breach is the vendor's. If you hid it, the Act has no specific rule; settle that in the contract. The Act itself creates no right to compensation, the Commission notes: damages claims follow national law.
What is AI literacy, and does it apply to me?
Article 4 asks providers and deployers to take measures that support the AI literacy of their staff and of others who operate or use an AI system for them. Since the Digital Omnibus took effect on 27 July 2026, no particular level has to be guaranteed. A business running a website chatbot is a deployer, so it is covered. The Commission's Q&A says no certificate is needed, and that an internal record of training is one way to document it.
Does it matter where the chatbot vendor is based?
Not for the AI Act's duties. A provider is covered when it offers a system on the EU market, wherever it is established, and providers and deployers outside the EU are covered when the output is used in the EU (Article 2). A vendor outside the EU must appoint an EU representative only for high-risk systems or general-purpose AI models. Where visitors' data is processed is a GDPR question: see our EU hosting checklist.
Sources
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal of the European Union, read on 25 October 2026.
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal of the European Union, read on 25 October 2026.
- Guidelines on transparency obligations for providers and deployers of AI systems, European Commission, read on 25 October 2026.
- Transparency obligations under Article 50 of the AI Act, European Commission, read on 25 October 2026.
- Code of Practice on Transparency of AI-generated Content, European Commission, read on 25 October 2026.
- AI Literacy - Questions & Answers, European Commission, read on 25 October 2026.
- Regulation (EU) 2016/679 (General Data Protection Regulation), Official Journal of the European Union, read on 25 October 2026.
- Gesetz zur Durchführung der Verordnung über künstliche Intelligenz, BGBl. 2026 I Nr. 223, Bundesgesetzblatt, read on 25 October 2026.
- Bundesnetzagentur übernimmt zentrale Rolle bei der Umsetzung der KI-Verordnung, Bundesnetzagentur, read on 25 October 2026.
- Akteure und Pflichten, Bundesnetzagentur, KI-Service Desk, read on 25 October 2026.
- AP zet volgende stap in toezicht op AI, Autoriteit Persoonsgegevens, read on 25 October 2026.
- Verordening inzake artificiële intelligentie, FOD Economie, read on 25 October 2026.
- Veelgestelde vragen over artificiële intelligentie, de Artificial Intelligence Act en de toepassing daarvan, FOD Economie, read on 25 October 2026.
How this was made: drafted with AI, then checked against how ChatterLab actually works and against the sources listed in the article. Spotted an error? Write to management@sri-group.eu.