The regulatory framework in 2026
Deploying a chatbot in Europe in 2026 means navigating two overlapping regulatory frameworks:
- GDPR (General Data Protection Regulation), in force since 2018, applying to all personal data processing of European citizens.
- The EU AI Act, which entered into force in 2024, classifying AI systems by risk level and imposing specific obligations on high-risk systems.
What GDPR requires from chatbots
A chatbot processes personal data as soon as it receives a name, email, order number, or any identifying information. Key obligations:
- Legal basis: you must have a legal ground for processing (consent, contract performance, legitimate interest).
- User information: the user must know they're talking to a chatbot, what data is collected and why.
- Retention period: conversations must not be kept indefinitely. Define a clear retention policy.
- Data subject rights: access, rectification, erasure on request.
- Security: encryption in transit and at rest, access control on logs.
The AI Act and chatbots
The AI Act classifies chatbots as limited risk in most CX and supply chain use cases. This mainly requires transparency: the user must know they're interacting with an AI.
Practical checklist
- ☑ Explicit mention "You are chatting with an automated assistant" at the start
- ☑ Privacy policy accessible from the chatbot interface
- ☑ Log retention period defined and documented
- ☑ Data subject request handling procedure in place
- ☑ Processing register updated (GDPR obligation)
- ☑ TLS encryption for exchanges, at-rest encryption for logs
- ☑ No data transfer outside EU without appropriate guarantees
- ☑ DPA signed with your chatbot provider