The EU AI Act
What the European AI regulation asks of a chat agent on a website, which parts ChatterLab builds in, and which parts remain yours.
Note. This page explains how the product relates to the AI Act. It is not legal advice. For your own situation, ask your lawyer.
The AI Act sorts AI systems by risk. A chat agent that answers questions about a business from that business's own content is in the lowest regulated group: allowed, with a duty to be transparent. A small number of uses are high-risk and carry heavy obligations. A few are forbidden outright.
Transparency: people must know it is an AI
Article 50 says that a system which talks to people must make clear that they are talking to an AI, and that generated text must be recognisable as such by software.
ChatterLab builds both in, so that they cannot be forgotten or switched off:
- The AI notice. Every conversation opens with a line such as "You're chatting with an AI assistant", in the widget's language. No plan, add-on or setting removes it, and it sits inside the chat where the surrounding page cannot hide it. Languages and the AI notice.
- Machine-readable marking. Every answer in the widget is marked in the page's code as AI-generated.
- It never claims to be a person. Asked whether it is a human or a robot, the agent says it is an AI assistant, whatever name and personality your instructions give it.
If you build your own chat on top of the API, none of this is drawn for you, and telling your users they are talking to an AI becomes your job.
High-risk uses are refused
When you create an agent you declare what it is for. Three purposes are refused, in the dashboard, over the API and over MCP alike:
| Declared use | Why |
|---|---|
| Recruitment and HR selection | Decisions about people's work and income |
| Credit scoring | Decisions about people's access to money |
| Healthcare | Advice where a mistake can harm someone's health |
Systems for such purposes must meet requirements on risk management, data quality, human oversight, documentation and conformity assessment that this product does not provide. So we do not pretend: the agent is not created, and the refusal is written to the audit log. If you have such a use in mind, talk to us first.
The check works on your declaration. It is a promise from you to us, not a filter we run over your content. Declaring "support" and then letting the agent screen job applicants moves the full weight of the Act onto you.
An ordinary agent may of course talk about these subjects: a clinic's agent that gives opening hours and explains how to make an appointment is customer service, not healthcare. The line is crossed when the agent assesses a person: their symptoms, their creditworthiness, their suitability for a job.
Records
Being able to show afterwards what a system said, and why, is the first thing a regulator or an unhappy customer asks for. ChatterLab keeps:
- Every conversation, with the sources and the measurements behind each answer, in Activity.
- An audit log of the events that matter: agents created, changed and deleted, sources added and removed, plan and billing changes, API keys made and revoked, conversations erased or exported, refusals for credit or for a high-risk use, and which model answered. A change made in the dashboard or with a key is recorded with who made it. It is kept for 2 years. Where the Act requires logs to be kept, it asks for at least six months.
Keeping a human in reach
No law requires your website's assistant to have a person standing by. Good practice does, and the Act's spirit with it:
- Put in the instructions when the agent must hand over, and to whom: a phone number, an e-mail address, a booking page.
- Read Overview regularly. Reviewing what a system said is a form of oversight, and the two measurements on each answer are built for it.
What remains yours
- What the agent knows. It repeats your sources. If they are wrong or out of date, so is the agent, and "the AI said it" is no defence towards a customer. In 2024 a Canadian tribunal held an airline to what its chatbot had told a passenger.
- Your privacy notice. See Data and privacy.
- What you use it for. The forbidden practices of the Act, such as manipulating people or exploiting their vulnerabilities, are forbidden whatever tool is used.