Is my AI chatbot high risk under the EU AI Act? In most cases, no. A support assistant, an internal knowledge bot or a sales assistant on your website is limited risk. That means Article 50 transparency duties, which have applied since 2 August 2026. You tell people they are talking to an AI, and you mark generated content where the rules require it. A chatbot becomes high risk when it is used for a purpose listed in Annex III, such as screening job applicants, assessing creditworthiness or deciding admission to education. Then the full high-risk regime applies, from 2 December 2027.
The Act does not classify chatbots. It classifies uses. The same model, the same widget and the same code can be limited risk on your support page and high risk in your HR portal. So the useful question is not what your chatbot is. It is what its output gets used for.
Dates here follow the Act as amended by the Digital Omnibus on AI, in force since 27 July 2026. We are engineers who build these systems, not lawyers, and a borderline call should be confirmed by your counsel.
Why most business chatbots are limited risk
High risk is a closed list. Annex III names eight areas: biometrics, critical infrastructure, education, employment, essential private and public services, law enforcement, migration and justice. Annex I adds safety components of regulated products such as medical devices. If your chatbot's output does not feed a decision in one of those areas, it is not high risk.
That leaves most of what companies actually build. A support assistant inside the help center. A knowledge agent that answers staff questions from internal documents. An IT helpdesk bot. A sales assistant that answers product questions and books demos. An assistant inside the CRM that drafts replies for a human to send. In the projects we see, the large majority of chatbots and assistants land here.
Limited risk is not zero obligation. Article 50 applies. GDPR applies to every conversation that contains personal data. The AI literacy duty applies to the staff who run the system. None of it is heavy, and all of it should be in the product before launch.
What Article 50 asks of a chatbot
Article 50 is short. For a chatbot, four parts of it matter.
- Disclosure. People must be told they are interacting with an AI system, clearly and at the latest at the first interaction. Put it in the chat header and in the first message. In a voice bot, say it in the first sentence.
- The obvious exception. You need not disclose where it is obvious to a reasonably well-informed person. Do not rely on it. A bot with a human first name and a stock photo is designed to be not obvious.
- Marking generated content. Providers of systems that generate text, audio, images or video must mark the output in a machine-readable way, as far as technically feasible. Systems already on the market before 2 August 2026 have until 2 December 2026.
- Published text and deepfakes. If the bot publishes text to inform the public on matters of public interest without human editorial control, label it. If it uses a synthetic video avatar of a real person, label that too.
Who carries the duty depends on who built the chatbot. If you built it on a model API, you are the provider of the chatbot, even though the model is someone else's. If you bought a chatbot product, the vendor is the provider and you are the deployer. Check that the vendor's disclosure is switched on in your configuration, because your customers see your brand, not theirs.
Text marking is the weak spot. Read literally, Article 50(2) covers chatbots that generate text, but there is no mature, tamper-resistant way to watermark plain text. We add provenance metadata to API responses and exported documents, and write down what we did and why. Expect the guidance on this to firm up.
Breaching Article 50 falls in the middle tier of fines: up to €15 million or 3% of worldwide annual turnover, whichever is higher. For SMEs the lower of the two applies.
When a chatbot becomes high risk
A chatbot becomes high risk when its output makes or materially influences a decision about a person in an Annex III area. The interface does not matter. A chat window that ends in a score is a scoring system with a chat window in front of it. These are the cases we see most often.
- Recruitment. A bot that interviews applicants and scores, ranks or filters them is high risk under the employment area. So is an assistant that recommends promotions or flags employees for performance review.
- Credit. An assistant that gathers a customer's financial details and produces a creditworthiness assessment or an eligibility answer. Fraud detection is expressly excluded.
- Insurance. A bot that assesses risk or sets the price for life or health insurance.
- Public services. A bot run by or for a public authority that decides eligibility for benefits or services, including healthcare.
- Education. A bot that decides admission, evaluates learning outcomes, sets the level a student can access, or monitors students during tests.
- Emergency triage. A bot that classifies emergency calls or prioritizes patients.
- Emotion recognition. A voice bot that infers how callers feel from their voice falls under biometrics. Aimed at your own employees or at students, it is prohibited outright.
- Medical devices. A symptom checker that qualifies as a medical device needing a notified body is high risk under Annex I, from 2 August 2028.
Article 6(3) keeps some Annex III uses out. A system escapes if it only does a narrow procedural task, improves work a human already finished, spots patterns without replacing human review, or does preparatory work. A bot that schedules interviews is a narrow procedural task. A bot that answers applicants' questions about the process makes no decision at all.
The hard exception is profiling. If the bot evaluates a person's performance, reliability, behavior or economic situation in an Annex III area, it is high risk regardless of 6(3). If you rely on 6(3), document the assessment before you ship, and keep it where an authority could ask for it.
Chatbot use cases mapped to risk class
The table below is how we sort the chatbots we are asked about. The class follows the use, so the same codebase can appear in more than one row.
| Chatbot use case | Risk class | What you must do | From |
|---|---|---|---|
| Support assistant on your website | Limited | Disclose AI at first interaction. Mark generated content where feasible | 2 August 2026. Marking: 2 December 2026 if already on the market |
| Internal knowledge or IT helpdesk bot | Limited | Disclosure in the interface. AI literacy for the staff who run it | 2 August 2026. Literacy since 2 February 2025 |
| Sales assistant that qualifies leads | Limited | Disclosure. No manipulative techniques or exploiting vulnerabilities | 2 August 2026. Article 5 since 2 February 2025 |
| HR policy question bot | Limited | Disclosure. Stays limited while it answers questions and assesses nobody | 2 August 2026 |
| Recruiting bot that screens, scores or ranks | High (Annex III, employment) | Full high-risk regime. Inform candidates and workers' representatives | 2 December 2027 |
| Credit or loan eligibility assistant | High (Annex III, essential services) | Full regime. Deployer carries out a fundamental rights impact assessment | 2 December 2027 |
| Life or health insurance pricing bot | High (Annex III, essential services) | Full regime, plus a fundamental rights impact assessment | 2 December 2027 |
| Admissions, grading or exam proctoring bot | High (Annex III, education) | Full high-risk regime | 2 December 2027 |
| Voice bot that detects caller emotion | High (Annex III, biometrics). Prohibited on employees or students | Notice to callers under Article 50(3), plus the full regime | Notice: 2 August 2026. High risk: 2 December 2027 |
| Symptom checker that is a medical device | High (Annex I) | Full regime alongside medical device conformity | 2 August 2028 |
| Image-generating or companion chatbot | Limited, with new prohibitions | Marking, plus filters against intimate imagery of real people and abuse material | Bans apply from 2 December 2026 |
How a safe chatbot drifts into high risk
Most high-risk chatbots we come across were not designed as such. They drifted. Someone added a fit score to the recruiting assistant because the data was there. A sales team started using the support bot to pre-check loan eligibility. Each change was a small ticket. The risk class changed with it.
Article 25 makes this expensive. If you change the intended purpose of a system that was not high risk, so that it becomes high risk, you become its provider with all the provider duties. That holds even when the underlying model and the original product came from someone else.
Put the boundary in the architecture, not in the prompt. A system prompt that says 'do not assess candidates' is a suggestion. A deployment with no access to applicant data and no scoring tool is a boundary. Add a classification check to the release process for any change that touches who the bot serves or what its output feeds. It is one question in a pull request template, and it catches most drift.
What changes if your chatbot is high risk
From 2 December 2027, an Annex III chatbot needs the full high-risk regime. As provider, that means a risk management system, data governance, technical documentation to Annex IV, automatic logging, instructions for deployers, and human oversight built into the product. It also means declared accuracy and cybersecurity, a quality management system, a conformity assessment, registration in the EU database, post-market monitoring and serious incident reporting.
As deployer, you use it according to the provider's instructions and assign a competent person with real authority to oversee it. You keep its logs for at least six months and tell people when a decision about them involved it. Before using it on your own staff, you inform workers' representatives. Deployers in credit and in life or health insurance also carry out a fundamental rights impact assessment. People affected by a decision can ask for an explanation of the system's role in it.
For most Annex III areas the conformity assessment is internal control, with no notified body. SMEs and small mid-caps, under 750 employees and up to €150 million turnover, get simplified technical documentation and proportionate quality management. A high-risk system already on the market before 2 August 2026 is caught only if its design changes significantly afterwards. Chatbots change constantly, with new models, new tools and new prompts, so we would not plan around that exemption.
Check your own chatbot in an afternoon
- 01Who talks to it, and are they told it is an AI at the first interaction?
- 02Does its output feed a decision about a specific person, or does it only answer questions?
- 03If it feeds a decision, is that decision in an Annex III area?
- 04Does it evaluate people's performance, behavior, reliability or finances? Then it is profiling, and 6(3) will not help.
- 05Could a team repurpose it into one of those areas without an engineer noticing?
Write the answers down, with a date and a name. If all five come back clean, you have a limited-risk chatbot and an Article 50 job, which is usually a few days of work. If any come back unclear, that is where the time should go. We do this classification as part of the AI readiness assessment, and a five day review covers a single existing chatbot, including its disclosure and logging gaps.