Cookie Banner and Privacy Policy? Here's the One Compliance Gap That's Still Open

Most small businesses that take compliance seriously have the same setup: a privacy policy, a cookie consent banner, maybe terms and conditions. If you've done that work — especially post-GDPR — you're already ahead of the majority. But there's a new obligation arriving on 2 August 2026 that your current setup doesn't cover, and it has nothing to do with cookies or data protection.

What your current setup covers

Your privacy policy documents how you process personal data — what you collect, why, who sees it, and what rights your users have. Your cookie banner handles consent for tracking technologies. Together they satisfy GDPR's core requirements for most small websites.

These tools were built to answer one question: "how do we handle your data?"

The question they don't answer

EU AI Act Article 50 introduces a different question: "is this a human or an AI you're talking to?"

If your website has a chatbot, a live chat with AI features, or any AI assistant that responds to visitors, Article 50(1) requires you to clearly inform those visitors — at the start of the interaction, before they type anything — that they are talking to an AI system.

This isn't covered by your privacy policy. It isn't covered by your cookie banner. It isn't satisfied by an AI clause you added to your terms. The obligation is specifically about real-time disclosure at the moment of first interaction — not a document visitors can find if they look for it.

Why the deadline is 2 August 2026

Article 50 is part of the EU AI Act, which has been building toward this date for two years. Unlike the high-risk AI provisions that affect large enterprise systems, Article 50's chatbot disclosure rule applies to any business deploying an AI system that interacts with people — regardless of company size, industry, or where in the world you're based.

Non-compliance carries fines up to 3% of global annual turnover under Article 99. For a business turning over €300,000, that's up to €9,000. For a €1 million business, up to €30,000. The fine calculator on our homepage lets you put a real number on your specific exposure.

How to close the gap

The fix is simpler than the underlying regulation makes it sound. Three things:

First, check whether you're actually in scope. Not every website triggers Article 50. The key question is whether you deploy an AI system that your visitors interact with directly — a chatbot, a live AI assistant, an AI-powered support tool. An AI tool you use behind the scenes, for internal tasks only, generally doesn't count.

Second, add a compliant first-interaction disclosure. The disclosure must be clear, timely (before the visitor's first message), and distinguishable — not a small label at the bottom of the chat window. The opening message from your chatbot is the natural place for it: "This is an AI assistant. I can help with [topic] but I am not a human."

Third, keep evidence that the disclosure was shown. This is the part most businesses overlook. A screenshot doesn't prove continuous compliance. A configuring change in your chatbot settings doesn't prove what was shown three months ago. You need a timestamped log of disclosure events, maintained automatically over time.

Close the gap in 15 minutes

The Disclo Compliance Kit gives you ready-made disclosure texts for chatbots, chat labels, and voice agents — in your language, based on official EU guidelines, ready to paste into your chatbot settings today. For ongoing proof, Disclo Pro adds an automated evidence log tied to actual badge display events, exportable for any regulator with one click.

This is general guidance, not legal advice.