What does the EU AI Act agreement mean for chatbots?

On Friday, December 8, negotiators for the European Parliament and for the EU Council, where member state governments sit, struck a provisional deal on the Artificial Intelligence Act. It is the political deal on a law the European Commission first proposed in April 2021. The text still has to be finalized and formally adopted by both institutions, so details can shift. But the main lines are now public, and several of them apply directly to chatbots like ChatGPT and to the companies that build them.

The Act keeps the risk-based design of the original proposal. A law is risk-based when the strictness of its rules depends on how much harm a use of AI could cause. Most AI tools, such as spam filters or recommendation systems, carry minimal risk and face no new obligations. A short list of uses is banned outright. High-risk uses, such as AI that screens job applicants or affects access to education, must meet strict requirements. And a separate category covers transparency risk, which is where most chatbots sit.

Rule 1: tell people they are talking to a machine

The Commission's summary of the deal states the principle plainly: when AI systems such as chatbots are used, people should be aware that they are dealing with a machine. This idea was already in the 2021 proposal, which said people must be told when an AI system is talking with them, except where that is already obvious from the situation.

In practice, a company that puts a chat assistant on its website, in an app or on a phone line will need to make clear that it is not a human agent.

Rule 2: label AI-generated content

The agreement also requires that deep fakes and other AI-generated content be labeled. Providers of systems that generate audio, images, video or text will have to build them so their output is marked in a machine-readable way, meaning a signal software can detect, and can be identified as artificially generated or manipulated. People must also be told when emotion recognition or biometric categorization systems are used on them.

Rule 3: duties for the model makers

The newest part of the deal concerns general-purpose AI, models trained to handle a wide range of tasks rather than one, like the large language models behind chatbots. These models and the systems built on them will have to meet transparency requirements, covered in the last section below. For the most powerful models, which could pose what the text calls systemic risks, there are extra binding duties.

A worked example: who does what

Here is how the agreement would sort the parties involved in one everyday chatbot. The scenario is illustrative, and the final text may adjust the details.

Party	Example	What the deal asks of it
Model provider	A company that trains a large general-purpose language model	Technical documentation, respect for EU copyright law, a detailed summary of training content; more if the model poses systemic risk
Deployer	A bank that adds a customer-service chatbot built on that model	Make clear to customers they are chatting with AI
Same bank, different use	Using AI to assess loan applications	Likely high-risk duties (the 2021 proposal listed credit scoring as high-risk), a stricter regime
Content tool	An app that generates realistic voices or images	Machine-readable marking of output; deep fakes labeled

The table shows the key idea: the same technology can fall under different rules depending on what it is used for. A chatbot answering questions about opening hours mostly needs a clear disclosure. The same model used to decide who gets credit moves into high-risk territory.

Timing matters too. According to the Commission, once the law enters into force it would apply after two years, with the bans taking effect after six months and the general-purpose AI rules after twelve. Fines for the most serious breaches can reach 35 million euros or 7% of a company's global annual turnover.

Try it: Think of three AI tools you use or that your workplace uses: a chatbot, an image generator and something that makes decisions about people. For each, write which category above it would likely fall into and the one duty that would apply. Then note what you would want to be told as a user.

What will general-purpose AI models have to disclose?

According to the European Parliament, all general-purpose AI models will have to meet three transparency requirements. First, their makers must draw up technical documentation about the model. The Commission presents these rules as bringing transparency along the value chain, that is, to the companies that build their own products on top of a model. Second, they must show they comply with EU copyright law. Third, they must publish a detailed summary of the content used for training, the text, images and other data the model learned from.

That third point is the one most visible to the public. A required summary would give writers, artists and researchers a better view of what went into these models, though the exact level of detail will depend on the final text and on guidance that follows.

Models that meet criteria for high impact, those considered to carry systemic risk, face more: model evaluations, assessing and reducing those risks, adversarial testing (deliberately trying to make the model misbehave), reporting serious incidents to the Commission, ensuring cybersecurity and reporting on energy efficiency. Until formal EU standards exist, these companies may rely on codes of practice to show compliance, and a new AI Office inside the Commission will supervise the general-purpose AI rules. For chatbot users, the result should be more information about the systems you talk to, and clearer signals when what you see or hear was made by a machine.