AI assistants on a website

More organisations now let visitors ask questions through an AI chat window or search box. The people who run the website decide what visitors are told about it. They also decide what it keeps and how it is checked.

Telling visitors it is AI

Visitors may want to know when they are talking to a machine. The EU AI Act deals with this in Article 50. It says providers must design AI systems that talk directly to people so that those people "are informed that they are interacting with an AI system". The exception is where that is obvious to a reasonably well-informed person.

Article 113 says the Regulation "shall apply from 2 August 2026", with listed exceptions that leave out Article 50. So Article 50(1) has applied since 2 August 2026.

Article 111(4) sets a later date for Article 50(2), which covers marking content that an AI system generates. Providers of systems that generate synthetic audio, images, video or text, and that were placed on the market before 2 August 2026, have until 2 December 2026 to comply with it. A UK organisation whose site serves visitors in the EU can check how this applies to it.

The privacy notice

A chat window collects what visitors type. People have the right to be informed about the collection and use of their personal data. The Information Commissioner's Office (ICO) says an organisation must give them information including "your purposes for processing their personal data, your retention periods for that personal data, and who it will be shared with". It must do so at the time it collects the data.

The ICO notes that this guidance is under review because of changes made by the Data (Use and Access) Act. It also publishes separate guidance on AI and data protection.

A chat window everyone can use

Some visitors use a keyboard instead of a mouse, and some use a screen reader. The people who build a chat window can check it against the Web Content Accessibility Guidelines (WCAG) 2.2, the World Wide Web Consortium's (W3C) standard for accessible web content, in the version dated 12 December 2024. The W3C also publishes the ARIA Authoring Practices Guide.

Hidden instructions

Visitors can type anything into a chat box, including text written to steer the AI. The National Cyber Security Centre (NCSC) wrote about this on 8 December 2025. It says a language model cannot reliably tell instructions from data. In its words, the technology "inherently does not distinguish between the two". The NCSC advises reducing the risk and its impact, especially where the system can use tools or other services.

Public bodies

Many public bodies have to keep an extra record. The Algorithmic Transparency Recording Standard (ATRS) helps them give clear information about how and why they use algorithmic tools. GOV.UK says the ATRS is mandatory for all government departments. It also applies to arm's-length bodies that deliver public or frontline services, or deal directly with the public.

Chatbots and online safety

Ofcom published an open letter on 8 November 2024 about how the Online Safety Act applies to generative AI and chatbots. It says a site where users can share text, images or videos made by a chatbot with other users is a "user-to-user service".

Useful links