Article 50 Guide for Agencies

Article 50 and GDPR for chatbots: where the two overlap

Last reviewed 19 October 2026

Short answer. The two laws ask different questions. Article 50 asks whether people know they are talking to an AI. The GDPR asks what happens to their personal data. A chatbot that collects names, emails or order details needs both, and the AI Act says it does not affect the GDPR. You can put both messages at the start of the chat, but meeting one does not meet the other.

Two laws, two questions

A customer chatbot on an EU-facing site usually falls under two sets of rules at once.

AI Act, Article 50(1) GDPR
The question Do people know they are dealing with an AI system? Is their personal data handled lawfully, fairly and transparently?
Who carries it The provider of the chatbot system (who builds or brands it) The controller (who decides why and how data is processed), with processors acting for it
When it applies Whenever the system interacts directly with people, unless it is obvious Whenever the chatbot processes personal data
Main output A clear AI disclosure at the latest at first interaction (Article 50(5)) A privacy notice, a lawful basis, contracts, security, and rights handling

Article 2(7) of the AI Act says the Act does not affect the GDPR. Article 50(6) adds that the transparency duties are without prejudice to other transparency obligations in EU or national law. So the GDPR applies in full alongside the AI disclosure; one does not replace the other.

Where they overlap

Both laws care about what the user is told at the start of the conversation. That is the one place where you can do both jobs with one design:

"You're chatting with an AI assistant. It can make mistakes, and you can ask for a person at any time. We use what you type here to answer your question. See our privacy notice for how we handle it."

The first sentence handles Article 50. The last two point to the GDPR information. The disclosure wording guide covers the AI part in more detail.

What the overlap does not do: a link to a privacy notice is not an AI disclosure, and an AI disclosure is not a privacy notice. If either half is missing, that law is not met.

GDPR points that chatbots often miss

These come up in most chatbot builds. They are general pointers, not a full GDPR review.

  1. The privacy notice has to cover the chat. Article 13 GDPR requires information at the time data is collected: who the controller is, the purposes, the lawful basis, recipients (including the chatbot vendor), retention, and the user's rights. A site-wide notice written before the bot existed usually says nothing about chat logs.
  2. The vendor is usually a processor. If a third-party platform or model provider processes chat content for your client, the client needs a data processing agreement with it under Article 28. Check whether the vendor uses chat data to train its models, and whether that can be switched off.
  3. International transfers. If the vendor or its model runs outside the EU, the transfer rules in Chapter V GDPR apply. Check what mechanism the vendor relies on.
  4. Retention. Decide how long chat transcripts are kept and delete them on schedule. "Forever, in the vendor's dashboard" is the common default and the common problem.
  5. Users type more than you ask for. People paste order numbers, health details and account information into chat boxes. Plan for special category data even if the bot never asks for it, for example by warning users not to share it and by limiting who can read transcripts.
  6. Automated decisions. If the bot decides something with legal or similarly significant effects on a person by itself, such as refusing a refund or a loan, Article 22 GDPR applies. Most support bots stay clear of this by handing those decisions to a person.
  7. Impact assessment. A data protection impact assessment under Article 35 is required where processing is likely to result in a high risk. New technology handling customer data at scale is a common trigger; decide and document whether one is needed.
  8. Cookies and local storage. A chat widget that stores identifiers in the browser can fall under the ePrivacy rules on storing and reading information on a user's device, which are separate from both laws above.

Who does what in an agency setup

Roles under the two laws do not always line up. An agency can be the provider of a branded chatbot under the AI Act while its client is the controller under the GDPR, and the agency is the client's processor. The guide on whether Article 50 applies to client chatbots covers the AI Act roles. For the GDPR, write the roles into the contract: who is controller, who is processor, and who answers access and deletion requests that arrive through the chat.

A combined launch check

Sources