EU AI Act Explained for Website Owners

The AI Act applies to anyone placing an AI system on the EU market or putting it into service in the EU, regardless of where the business is based — the same extraterritorial logic as GDPR. A US-based SaaS company with EU customers, or a Slovenian e-commerce site using an AI chatbot, are both in scope.

Scope depends on usage, not company size or intent to build AI. If your website runs an AI-powered chatbot, uses AI to generate or moderate content shown to visitors, or embeds a third-party AI feature (a recommendation engine, an AI-powered search box, an automated support assistant), you're a deployer under the Act.

The Act sorts AI systems into four risk tiers: unacceptable risk (prohibited outright — e.g. social scoring), high risk (strict obligations — e.g. AI used in hiring, credit scoring, or medical decisions), limited risk (transparency obligations — e.g. chatbots, AI-generated content), and minimal risk (no specific obligations).

Most websites fall into the limited-risk tier: a customer service chatbot or AI-written blog content typically triggers disclosure obligations, not the much stricter high-risk regime. High-risk obligations become relevant mainly for sites using AI to make or materially influence decisions about individuals — screening job applicants, scoring creditworthiness, or similar.

Generally yes, for content that could be mistaken for authentic human content or communication — this is one of the Act's core transparency obligations for limited-risk systems. Practically, this means: label AI-generated text, images, audio, or video that's published or shown to visitors, and tell visitors when they're talking to a chatbot rather than a person.

The Act entered into force in August 2024, but obligations phase in over several years. Prohibited-practice rules and AI literacy obligations applied first. Transparency obligations for limited-risk systems — the ones most relevant to a typical website's chatbot or AI-generated content — are already in effect. Obligations for deployers of high-risk AI systems take full effect from August 2026, which is the deadline most commonly cited for businesses to prepare.

GDPR and the AI Act are complementary, not overlapping substitutes. GDPR governs personal data processing — its question is "is this data being handled lawfully?" The AI Act governs AI system safety and transparency — its question is "is this AI system's risk level being managed and disclosed correctly?" A single AI feature, like a chatbot that processes visitor messages, can trigger obligations under both: GDPR because it processes personal data, and the AI Act because it's an AI system interacting with a person who needs to know that.

Formal penalties for AI Act violations can be significant, with maximums set higher than GDPR's in some categories. In practice, for most small and medium businesses using off-the-shelf AI tools, the immediate risk is lower than the headline fines suggest — enforcement is still ramping up as national market surveillance authorities stand up their processes. The more concrete near-term risk is reputational: visitors increasingly notice undisclosed AI use, and procurement processes are starting to ask about AI governance the way they already ask about GDPR compliance.

Because AI Act obligations depend heavily on how AI is used internally — governance policies, risk assessments, human oversight — rather than on what's visible in a page's rendered HTML, this is better suited to a self-assessment questionnaire than a browser-based scan. GetGDPRScan's free assessment covers company profile, AI usage, decision-making impact, transparency practices, and governance, and returns a risk score plus a prioritized action checklist.